drivers/nfc/pn533.c

   1 /*
   2  * Copyright (C) 2011 Instituto Nokia de Tecnologia
   3  * Copyright (C) 2012-2013 Tieto Poland
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License as published by
   7  * the Free Software Foundation; either version 2 of the License, or
   8  * (at your option) any later version.
   9  *
  10  * This program is distributed in the hope that it will be useful,
  11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  13  * GNU General Public License for more details.
  14  *
  15  * You should have received a copy of the GNU General Public License
  16  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  17  */
  18
  19 #include <linux/device.h>
  20 #include <linux/kernel.h>
  21 #include <linux/module.h>
  22 #include <linux/slab.h>
  23 #include <linux/usb.h>
  24 #include <linux/nfc.h>
  25 #include <linux/netdevice.h>
  26 #include <net/nfc/nfc.h>
  27
  28 #define VERSION "0.2"
  29
  30 #define PN533_VENDOR_ID 0x4CC
  31 #define PN533_PRODUCT_ID 0x2533
  32
  33 #define SCM_VENDOR_ID 0x4E6
  34 #define SCL3711_PRODUCT_ID 0x5591
  35
  36 #define SONY_VENDOR_ID         0x054c
  37 #define PASORI_PRODUCT_ID      0x02e1
  38
  39 #define ACS_VENDOR_ID 0x072f
  40 #define ACR122U_PRODUCT_ID 0x2200
  41
  42 #define PN533_DEVICE_STD     0x1
  43 #define PN533_DEVICE_PASORI  0x2
  44 #define PN533_DEVICE_ACR122U 0x3
  45
  46 #define PN533_ALL_PROTOCOLS (NFC_PROTO_JEWEL_MASK | NFC_PROTO_MIFARE_MASK |\
  47                              NFC_PROTO_FELICA_MASK | NFC_PROTO_ISO14443_MASK |\
  48                              NFC_PROTO_NFC_DEP_MASK |\
  49                              NFC_PROTO_ISO14443_B_MASK)
  50
  51 #define PN533_NO_TYPE_B_PROTOCOLS (NFC_PROTO_JEWEL_MASK | \
  52                                    NFC_PROTO_MIFARE_MASK | \
  53                                    NFC_PROTO_FELICA_MASK | \
  54                                    NFC_PROTO_ISO14443_MASK | \
  55                                    NFC_PROTO_NFC_DEP_MASK)
  56
  57 static const struct usb_device_id pn533_table[] = {
  58         { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE,
  59           .idVendor             = PN533_VENDOR_ID,
  60           .idProduct            = PN533_PRODUCT_ID,
  61           .driver_info          = PN533_DEVICE_STD,
  62         },
  63         { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE,
  64           .idVendor             = SCM_VENDOR_ID,
  65           .idProduct            = SCL3711_PRODUCT_ID,
  66           .driver_info          = PN533_DEVICE_STD,
  67         },
  68         { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE,
  69           .idVendor             = SONY_VENDOR_ID,
  70           .idProduct            = PASORI_PRODUCT_ID,
  71           .driver_info          = PN533_DEVICE_PASORI,
  72         },
  73         { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE,
  74           .idVendor             = ACS_VENDOR_ID,
  75           .idProduct            = ACR122U_PRODUCT_ID,
  76           .driver_info          = PN533_DEVICE_ACR122U,
  77         },
  78         { }
  79 };
  80 MODULE_DEVICE_TABLE(usb, pn533_table);
  81
  82 /* How much time we spend listening for initiators */
  83 #define PN533_LISTEN_TIME 2
  84 /* Delay between each poll frame (ms) */
  85 #define PN533_POLL_INTERVAL 10
  86
  87 /* Standard pn533 frame definitions (standard and extended)*/
  88 #define PN533_STD_FRAME_HEADER_LEN (sizeof(struct pn533_std_frame) \
  89                                         + 2) /* data[0] TFI, data[1] CC */
  90 #define PN533_STD_FRAME_TAIL_LEN 2 /* data[len] DCS, data[len + 1] postamble*/
  91
  92 #define PN533_EXT_FRAME_HEADER_LEN (sizeof(struct pn533_ext_frame) \
  93                                         + 2) /* data[0] TFI, data[1] CC */
  94
  95 #define PN533_CMD_DATAEXCH_DATA_MAXLEN  262
  96 #define PN533_CMD_DATAFRAME_MAXLEN      240     /* max data length (send) */
  97
  98 /*
  99  * Max extended frame payload len, excluding TFI and CC
 100  * which are already in PN533_FRAME_HEADER_LEN.
 101  */
 102 #define PN533_STD_FRAME_MAX_PAYLOAD_LEN 263
 103
 104 #define PN533_STD_FRAME_ACK_SIZE 6 /* Preamble (1), SoPC (2), ACK Code (2),
 105                                   Postamble (1) */
 106 #define PN533_STD_FRAME_CHECKSUM(f) (f->data[f->datalen])
 107 #define PN533_STD_FRAME_POSTAMBLE(f) (f->data[f->datalen + 1])
 108 /* Half start code (3), LEN (4) should be 0xffff for extended frame */
 109 #define PN533_STD_IS_EXTENDED(hdr) ((hdr)->datalen == 0xFF \
 110                                         && (hdr)->datalen_checksum == 0xFF)
 111 #define PN533_EXT_FRAME_CHECKSUM(f) (f->data[be16_to_cpu(f->datalen)])
 112
 113 /* start of frame */
 114 #define PN533_STD_FRAME_SOF 0x00FF
 115
 116 /* standard frame identifier: in/out/error */
 117 #define PN533_STD_FRAME_IDENTIFIER(f) (f->data[0]) /* TFI */
 118 #define PN533_STD_FRAME_DIR_OUT 0xD4
 119 #define PN533_STD_FRAME_DIR_IN 0xD5
 120
 121 /* ACS ACR122 pn533 frame definitions */
 122 #define PN533_ACR122_TX_FRAME_HEADER_LEN (sizeof(struct pn533_acr122_tx_frame) \
 123                                           + 2)
 124 #define PN533_ACR122_TX_FRAME_TAIL_LEN 0
 125 #define PN533_ACR122_RX_FRAME_HEADER_LEN (sizeof(struct pn533_acr122_rx_frame) \
 126                                           + 2)
 127 #define PN533_ACR122_RX_FRAME_TAIL_LEN 2
 128 #define PN533_ACR122_FRAME_MAX_PAYLOAD_LEN PN533_STD_FRAME_MAX_PAYLOAD_LEN
 129
 130 /* CCID messages types */
 131 #define PN533_ACR122_PC_TO_RDR_ICCPOWERON 0x62
 132 #define PN533_ACR122_PC_TO_RDR_ESCAPE 0x6B
 133
 134 #define PN533_ACR122_RDR_TO_PC_ESCAPE 0x83
 135
 136 /* PN533 Commands */
 137 #define PN533_FRAME_CMD(f) (f->data[1])
 138
 139 #define PN533_CMD_GET_FIRMWARE_VERSION 0x02
 140 #define PN533_CMD_RF_CONFIGURATION 0x32
 141 #define PN533_CMD_IN_DATA_EXCHANGE 0x40
 142 #define PN533_CMD_IN_COMM_THRU     0x42
 143 #define PN533_CMD_IN_LIST_PASSIVE_TARGET 0x4A
 144 #define PN533_CMD_IN_ATR 0x50
 145 #define PN533_CMD_IN_RELEASE 0x52
 146 #define PN533_CMD_IN_JUMP_FOR_DEP 0x56
 147
 148 #define PN533_CMD_TG_INIT_AS_TARGET 0x8c
 149 #define PN533_CMD_TG_GET_DATA 0x86
 150 #define PN533_CMD_TG_SET_DATA 0x8e
 151 #define PN533_CMD_TG_SET_META_DATA 0x94
 152 #define PN533_CMD_UNDEF 0xff
 153
 154 #define PN533_CMD_RESPONSE(cmd) (cmd + 1)
 155
 156 /* PN533 Return codes */
 157 #define PN533_CMD_RET_MASK 0x3F
 158 #define PN533_CMD_MI_MASK 0x40
 159 #define PN533_CMD_RET_SUCCESS 0x00
 160
 161 struct pn533;
 162
 163 typedef int (*pn533_send_async_complete_t) (struct pn533 *dev, void *arg,
 164                                         struct sk_buff *resp);
 165
 166 /* structs for pn533 commands */
 167
 168 /* PN533_CMD_GET_FIRMWARE_VERSION */
 169 struct pn533_fw_version {
 170         u8 ic;
 171         u8 ver;
 172         u8 rev;
 173         u8 support;
 174 };
 175
 176 /* PN533_CMD_RF_CONFIGURATION */
 177 #define PN533_CFGITEM_RF_FIELD    0x01
 178 #define PN533_CFGITEM_TIMING      0x02
 179 #define PN533_CFGITEM_MAX_RETRIES 0x05
 180 #define PN533_CFGITEM_PASORI      0x82
 181
 182 #define PN533_CFGITEM_RF_FIELD_AUTO_RFCA 0x2
 183 #define PN533_CFGITEM_RF_FIELD_ON        0x1
 184 #define PN533_CFGITEM_RF_FIELD_OFF       0x0
 185
 186 #define PN533_CONFIG_TIMING_102 0xb
 187 #define PN533_CONFIG_TIMING_204 0xc
 188 #define PN533_CONFIG_TIMING_409 0xd
 189 #define PN533_CONFIG_TIMING_819 0xe
 190
 191 #define PN533_CONFIG_MAX_RETRIES_NO_RETRY 0x00
 192 #define PN533_CONFIG_MAX_RETRIES_ENDLESS 0xFF
 193
 194 struct pn533_config_max_retries {
 195         u8 mx_rty_atr;
 196         u8 mx_rty_psl;
 197         u8 mx_rty_passive_act;
 198 } __packed;
 199
 200 struct pn533_config_timing {
 201         u8 rfu;
 202         u8 atr_res_timeout;
 203         u8 dep_timeout;
 204 } __packed;
 205
 206 /* PN533_CMD_IN_LIST_PASSIVE_TARGET */
 207
 208 /* felica commands opcode */
 209 #define PN533_FELICA_OPC_SENSF_REQ 0
 210 #define PN533_FELICA_OPC_SENSF_RES 1
 211 /* felica SENSF_REQ parameters */
 212 #define PN533_FELICA_SENSF_SC_ALL 0xFFFF
 213 #define PN533_FELICA_SENSF_RC_NO_SYSTEM_CODE 0
 214 #define PN533_FELICA_SENSF_RC_SYSTEM_CODE 1
 215 #define PN533_FELICA_SENSF_RC_ADVANCED_PROTOCOL 2
 216
 217 /* type B initiator_data values */
 218 #define PN533_TYPE_B_AFI_ALL_FAMILIES 0
 219 #define PN533_TYPE_B_POLL_METHOD_TIMESLOT 0
 220 #define PN533_TYPE_B_POLL_METHOD_PROBABILISTIC 1
 221
 222 union pn533_cmd_poll_initdata {
 223         struct {
 224                 u8 afi;
 225                 u8 polling_method;
 226         } __packed type_b;
 227         struct {
 228                 u8 opcode;
 229                 __be16 sc;
 230                 u8 rc;
 231                 u8 tsn;
 232         } __packed felica;
 233 };
 234
 235 /* Poll modulations */
 236 enum {
 237         PN533_POLL_MOD_106KBPS_A,
 238         PN533_POLL_MOD_212KBPS_FELICA,
 239         PN533_POLL_MOD_424KBPS_FELICA,
 240         PN533_POLL_MOD_106KBPS_JEWEL,
 241         PN533_POLL_MOD_847KBPS_B,
 242         PN533_LISTEN_MOD,
 243
 244         __PN533_POLL_MOD_AFTER_LAST,
 245 };
 246 #define PN533_POLL_MOD_MAX (__PN533_POLL_MOD_AFTER_LAST - 1)
 247
 248 struct pn533_poll_modulations {
 249         struct {
 250                 u8 maxtg;
 251                 u8 brty;
 252                 union pn533_cmd_poll_initdata initiator_data;
 253         } __packed data;
 254         u8 len;
 255 };
 256
 257 static const struct pn533_poll_modulations poll_mod[] = {
 258         [PN533_POLL_MOD_106KBPS_A] = {
 259                 .data = {
 260                         .maxtg = 1,
 261                         .brty = 0,
 262                 },
 263                 .len = 2,
 264         },
 265         [PN533_POLL_MOD_212KBPS_FELICA] = {
 266                 .data = {
 267                         .maxtg = 1,
 268                         .brty = 1,
 269                         .initiator_data.felica = {
 270                                 .opcode = PN533_FELICA_OPC_SENSF_REQ,
 271                                 .sc = PN533_FELICA_SENSF_SC_ALL,
 272                                 .rc = PN533_FELICA_SENSF_RC_SYSTEM_CODE,
 273                                 .tsn = 0x03,
 274                         },
 275                 },
 276                 .len = 7,
 277         },
 278         [PN533_POLL_MOD_424KBPS_FELICA] = {
 279                 .data = {
 280                         .maxtg = 1,
 281                         .brty = 2,
 282                         .initiator_data.felica = {
 283                                 .opcode = PN533_FELICA_OPC_SENSF_REQ,
 284                                 .sc = PN533_FELICA_SENSF_SC_ALL,
 285                                 .rc = PN533_FELICA_SENSF_RC_SYSTEM_CODE,
 286                                 .tsn = 0x03,
 287                         },
 288                  },
 289                 .len = 7,
 290         },
 291         [PN533_POLL_MOD_106KBPS_JEWEL] = {
 292                 .data = {
 293                         .maxtg = 1,
 294                         .brty = 4,
 295                 },
 296                 .len = 2,
 297         },
 298         [PN533_POLL_MOD_847KBPS_B] = {
 299                 .data = {
 300                         .maxtg = 1,
 301                         .brty = 8,
 302                         .initiator_data.type_b = {
 303                                 .afi = PN533_TYPE_B_AFI_ALL_FAMILIES,
 304                                 .polling_method =
 305                                         PN533_TYPE_B_POLL_METHOD_TIMESLOT,
 306                         },
 307                 },
 308                 .len = 3,
 309         },
 310         [PN533_LISTEN_MOD] = {
 311                 .len = 0,
 312         },
 313 };
 314
 315 /* PN533_CMD_IN_ATR */
 316
 317 struct pn533_cmd_activate_response {
 318         u8 status;
 319         u8 nfcid3t[10];
 320         u8 didt;
 321         u8 bst;
 322         u8 brt;
 323         u8 to;
 324         u8 ppt;
 325         /* optional */
 326         u8 gt[];
 327 } __packed;
 328
 329 struct pn533_cmd_jump_dep_response {
 330         u8 status;
 331         u8 tg;
 332         u8 nfcid3t[10];
 333         u8 didt;
 334         u8 bst;
 335         u8 brt;
 336         u8 to;
 337         u8 ppt;
 338         /* optional */
 339         u8 gt[];
 340 } __packed;
 341
 342
 343 /* PN533_TG_INIT_AS_TARGET */
 344 #define PN533_INIT_TARGET_PASSIVE 0x1
 345 #define PN533_INIT_TARGET_DEP 0x2
 346
 347 #define PN533_INIT_TARGET_RESP_FRAME_MASK 0x3
 348 #define PN533_INIT_TARGET_RESP_ACTIVE     0x1
 349 #define PN533_INIT_TARGET_RESP_DEP        0x4
 350
 351 enum  pn533_protocol_type {
 352         PN533_PROTO_REQ_ACK_RESP = 0,
 353         PN533_PROTO_REQ_RESP
 354 };
 355
 356 struct pn533 {
 357         struct usb_device *udev;
 358         struct usb_interface *interface;
 359         struct nfc_dev *nfc_dev;
 360         u32 device_type;
 361         enum pn533_protocol_type protocol_type;
 362
 363         struct urb *out_urb;
 364         struct urb *in_urb;
 365
 366         struct sk_buff_head resp_q;
 367         struct sk_buff_head fragment_skb;
 368
 369         struct workqueue_struct *wq;
 370         struct work_struct cmd_work;
 371         struct work_struct cmd_complete_work;
 372         struct delayed_work poll_work;
 373         struct work_struct mi_rx_work;
 374         struct work_struct mi_tx_work;
 375         struct work_struct mi_tm_rx_work;
 376         struct work_struct mi_tm_tx_work;
 377         struct work_struct tg_work;
 378         struct work_struct rf_work;
 379
 380         struct list_head cmd_queue;
 381         struct pn533_cmd *cmd;
 382         u8 cmd_pending;
 383         struct mutex cmd_lock;  /* protects cmd queue */
 384
 385         void *cmd_complete_mi_arg;
 386         void *cmd_complete_dep_arg;
 387
 388         struct pn533_poll_modulations *poll_mod_active[PN533_POLL_MOD_MAX + 1];
 389         u8 poll_mod_count;
 390         u8 poll_mod_curr;
 391         u8 poll_dep;
 392         u32 poll_protocols;
 393         u32 listen_protocols;
 394         struct timer_list listen_timer;
 395         int cancel_listen;
 396
 397         u8 *gb;
 398         size_t gb_len;
 399
 400         u8 tgt_available_prots;
 401         u8 tgt_active_prot;
 402         u8 tgt_mode;
 403
 404         struct pn533_frame_ops *ops;
 405 };
 406
 407 struct pn533_cmd {
 408         struct list_head queue;
 409         u8 code;
 410         int status;
 411         struct sk_buff *req;
 412         struct sk_buff *resp;
 413         int resp_len;
 414         pn533_send_async_complete_t  complete_cb;
 415         void *complete_cb_context;
 416 };
 417
 418 struct pn533_std_frame {
 419         u8 preamble;
 420         __be16 start_frame;
 421         u8 datalen;
 422         u8 datalen_checksum;
 423         u8 data[];
 424 } __packed;
 425
 426 struct pn533_ext_frame {        /* Extended Information frame */
 427         u8 preamble;
 428         __be16 start_frame;
 429         __be16 eif_flag;        /* fixed to 0xFFFF */
 430         __be16 datalen;
 431         u8 datalen_checksum;
 432         u8 data[];
 433 } __packed;
 434
 435 struct pn533_frame_ops {
 436         void (*tx_frame_init)(void *frame, u8 cmd_code);
 437         void (*tx_frame_finish)(void *frame);
 438         void (*tx_update_payload_len)(void *frame, int len);
 439         int tx_header_len;
 440         int tx_tail_len;
 441
 442         bool (*rx_is_frame_valid)(void *frame, struct pn533 *dev);
 443         int (*rx_frame_size)(void *frame);
 444         int rx_header_len;
 445         int rx_tail_len;
 446
 447         int max_payload_len;
 448         u8 (*get_cmd_code)(void *frame);
 449 };
 450
 451 struct pn533_acr122_ccid_hdr {
 452         u8 type;
 453         u32 datalen;
 454         u8 slot;
 455         u8 seq;
 456         u8 params[3]; /* 3 msg specific bytes or status, error and 1 specific
 457                          byte for reposnse msg */
 458         u8 data[]; /* payload */
 459 } __packed;
 460
 461 struct pn533_acr122_apdu_hdr {
 462         u8 class;
 463         u8 ins;
 464         u8 p1;
 465         u8 p2;
 466 } __packed;
 467
 468 struct pn533_acr122_tx_frame {
 469         struct pn533_acr122_ccid_hdr ccid;
 470         struct pn533_acr122_apdu_hdr apdu;
 471         u8 datalen;
 472         u8 data[]; /* pn533 frame: TFI ... */
 473 } __packed;
 474
 475 struct pn533_acr122_rx_frame {
 476         struct pn533_acr122_ccid_hdr ccid;
 477         u8 data[]; /* pn533 frame : TFI ... */
 478 } __packed;
 479
 480 static void pn533_acr122_tx_frame_init(void *_frame, u8 cmd_code)
 481 {
 482         struct pn533_acr122_tx_frame *frame = _frame;
 483
 484         frame->ccid.type = PN533_ACR122_PC_TO_RDR_ESCAPE;
 485         frame->ccid.datalen = sizeof(frame->apdu) + 1; /* sizeof(apdu_hdr) +
 486                                                           sizeof(datalen) */
 487         frame->ccid.slot = 0;
 488         frame->ccid.seq = 0;
 489         frame->ccid.params[0] = 0;
 490         frame->ccid.params[1] = 0;
 491         frame->ccid.params[2] = 0;
 492
 493         frame->data[0] = PN533_STD_FRAME_DIR_OUT;
 494         frame->data[1] = cmd_code;
 495         frame->datalen = 2;  /* data[0] + data[1] */
 496
 497         frame->apdu.class = 0xFF;
 498         frame->apdu.ins = 0;
 499         frame->apdu.p1 = 0;
 500         frame->apdu.p2 = 0;
 501 }
 502
 503 static void pn533_acr122_tx_frame_finish(void *_frame)
 504 {
 505         struct pn533_acr122_tx_frame *frame = _frame;
 506
 507         frame->ccid.datalen += frame->datalen;
 508 }
 509
 510 static void pn533_acr122_tx_update_payload_len(void *_frame, int len)
 511 {
 512         struct pn533_acr122_tx_frame *frame = _frame;
 513
 514         frame->datalen += len;
 515 }
 516
 517 static bool pn533_acr122_is_rx_frame_valid(void *_frame, struct pn533 *dev)
 518 {
 519         struct pn533_acr122_rx_frame *frame = _frame;
 520
 521         if (frame->ccid.type != 0x83)
 522                 return false;
 523
 524         if (!frame->ccid.datalen)
 525                 return false;
 526
 527         if (frame->data[frame->ccid.datalen - 2] == 0x63)
 528                 return false;
 529
 530         return true;
 531 }
 532
 533 static int pn533_acr122_rx_frame_size(void *frame)
 534 {
 535         struct pn533_acr122_rx_frame *f = frame;
 536
 537         /* f->ccid.datalen already includes tail length */
 538         return sizeof(struct pn533_acr122_rx_frame) + f->ccid.datalen;
 539 }
 540
 541 static u8 pn533_acr122_get_cmd_code(void *frame)
 542 {
 543         struct pn533_acr122_rx_frame *f = frame;
 544
 545         return PN533_FRAME_CMD(f);
 546 }
 547
 548 static struct pn533_frame_ops pn533_acr122_frame_ops = {
 549         .tx_frame_init = pn533_acr122_tx_frame_init,
 550         .tx_frame_finish = pn533_acr122_tx_frame_finish,
 551         .tx_update_payload_len = pn533_acr122_tx_update_payload_len,
 552         .tx_header_len = PN533_ACR122_TX_FRAME_HEADER_LEN,
 553         .tx_tail_len = PN533_ACR122_TX_FRAME_TAIL_LEN,
 554
 555         .rx_is_frame_valid = pn533_acr122_is_rx_frame_valid,
 556         .rx_header_len = PN533_ACR122_RX_FRAME_HEADER_LEN,
 557         .rx_tail_len = PN533_ACR122_RX_FRAME_TAIL_LEN,
 558         .rx_frame_size = pn533_acr122_rx_frame_size,
 559
 560         .max_payload_len = PN533_ACR122_FRAME_MAX_PAYLOAD_LEN,
 561         .get_cmd_code = pn533_acr122_get_cmd_code,
 562 };
 563
 564 /* The rule: value(high byte) + value(low byte) + checksum = 0 */
 565 static inline u8 pn533_ext_checksum(u16 value)
 566 {
 567         return ~(u8)(((value & 0xFF00) >> 8) + (u8)(value & 0xFF)) + 1;
 568 }
 569
 570 /* The rule: value + checksum = 0 */
 571 static inline u8 pn533_std_checksum(u8 value)
 572 {
 573         return ~value + 1;
 574 }
 575
 576 /* The rule: sum(data elements) + checksum = 0 */
 577 static u8 pn533_std_data_checksum(u8 *data, int datalen)
 578 {
 579         u8 sum = 0;
 580         int i;
 581
 582         for (i = 0; i < datalen; i++)
 583                 sum += data[i];
 584
 585         return pn533_std_checksum(sum);
 586 }
 587
 588 static void pn533_std_tx_frame_init(void *_frame, u8 cmd_code)
 589 {
 590         struct pn533_std_frame *frame = _frame;
 591
 592         frame->preamble = 0;
 593         frame->start_frame = cpu_to_be16(PN533_STD_FRAME_SOF);
 594         PN533_STD_FRAME_IDENTIFIER(frame) = PN533_STD_FRAME_DIR_OUT;
 595         PN533_FRAME_CMD(frame) = cmd_code;
 596         frame->datalen = 2;
 597 }
 598
 599 static void pn533_std_tx_frame_finish(void *_frame)
 600 {
 601         struct pn533_std_frame *frame = _frame;
 602
 603         frame->datalen_checksum = pn533_std_checksum(frame->datalen);
 604
 605         PN533_STD_FRAME_CHECKSUM(frame) =
 606                 pn533_std_data_checksum(frame->data, frame->datalen);
 607
 608         PN533_STD_FRAME_POSTAMBLE(frame) = 0;
 609 }
 610
 611 static void pn533_std_tx_update_payload_len(void *_frame, int len)
 612 {
 613         struct pn533_std_frame *frame = _frame;
 614
 615         frame->datalen += len;
 616 }
 617
 618 static bool pn533_std_rx_frame_is_valid(void *_frame, struct pn533 *dev)
 619 {
 620         u8 checksum;
 621         struct pn533_std_frame *stdf = _frame;
 622
 623         if (stdf->start_frame != cpu_to_be16(PN533_STD_FRAME_SOF))
 624                 return false;
 625
 626         if (likely(!PN533_STD_IS_EXTENDED(stdf))) {
 627                 /* Standard frame code */
 628                 dev->ops->rx_header_len = PN533_STD_FRAME_HEADER_LEN;
 629
 630                 checksum = pn533_std_checksum(stdf->datalen);
 631                 if (checksum != stdf->datalen_checksum)
 632                         return false;
 633
 634                 checksum = pn533_std_data_checksum(stdf->data, stdf->datalen);
 635                 if (checksum != PN533_STD_FRAME_CHECKSUM(stdf))
 636                         return false;
 637         } else {
 638                 /* Extended */
 639                 struct pn533_ext_frame *eif = _frame;
 640
 641                 dev->ops->rx_header_len = PN533_EXT_FRAME_HEADER_LEN;
 642
 643                 checksum = pn533_ext_checksum(be16_to_cpu(eif->datalen));
 644                 if (checksum != eif->datalen_checksum)
 645                         return false;
 646
 647                 /* check data checksum */
 648                 checksum = pn533_std_data_checksum(eif->data,
 649                                                    be16_to_cpu(eif->datalen));
 650                 if (checksum != PN533_EXT_FRAME_CHECKSUM(eif))
 651                         return false;
 652         }
 653
 654         return true;
 655 }
 656
 657 static bool pn533_std_rx_frame_is_ack(struct pn533_std_frame *frame)
 658 {
 659         if (frame->start_frame != cpu_to_be16(PN533_STD_FRAME_SOF))
 660                 return false;
 661
 662         if (frame->datalen != 0 || frame->datalen_checksum != 0xFF)
 663                 return false;
 664
 665         return true;
 666 }
 667
 668 static inline int pn533_std_rx_frame_size(void *frame)
 669 {
 670         struct pn533_std_frame *f = frame;
 671
 672         /* check for Extended Information frame */
 673         if (PN533_STD_IS_EXTENDED(f)) {
 674                 struct pn533_ext_frame *eif = frame;
 675
 676                 return sizeof(struct pn533_ext_frame)
 677                         + be16_to_cpu(eif->datalen) + PN533_STD_FRAME_TAIL_LEN;
 678         }
 679
 680         return sizeof(struct pn533_std_frame) + f->datalen +
 681                PN533_STD_FRAME_TAIL_LEN;
 682 }
 683
 684 static u8 pn533_std_get_cmd_code(void *frame)
 685 {
 686         struct pn533_std_frame *f = frame;
 687         struct pn533_ext_frame *eif = frame;
 688
 689         if (PN533_STD_IS_EXTENDED(f))
 690                 return PN533_FRAME_CMD(eif);
 691         else
 692                 return PN533_FRAME_CMD(f);
 693 }
 694
 695 static struct pn533_frame_ops pn533_std_frame_ops = {
 696         .tx_frame_init = pn533_std_tx_frame_init,
 697         .tx_frame_finish = pn533_std_tx_frame_finish,
 698         .tx_update_payload_len = pn533_std_tx_update_payload_len,
 699         .tx_header_len = PN533_STD_FRAME_HEADER_LEN,
 700         .tx_tail_len = PN533_STD_FRAME_TAIL_LEN,
 701
 702         .rx_is_frame_valid = pn533_std_rx_frame_is_valid,
 703         .rx_frame_size = pn533_std_rx_frame_size,
 704         .rx_header_len = PN533_STD_FRAME_HEADER_LEN,
 705         .rx_tail_len = PN533_STD_FRAME_TAIL_LEN,
 706
 707         .max_payload_len =  PN533_STD_FRAME_MAX_PAYLOAD_LEN,
 708         .get_cmd_code = pn533_std_get_cmd_code,
 709 };
 710
 711 static bool pn533_rx_frame_is_cmd_response(struct pn533 *dev, void *frame)
 712 {
 713         return (dev->ops->get_cmd_code(frame) ==
 714                                 PN533_CMD_RESPONSE(dev->cmd->code));
 715 }
 716
 717 static void pn533_recv_response(struct urb *urb)
 718 {
 719         struct pn533 *dev = urb->context;
 720         struct pn533_cmd *cmd = dev->cmd;
 721         u8 *in_frame;
 722
 723         cmd->status = urb->status;
 724
 725         switch (urb->status) {
 726         case 0:
 727                 break; /* success */
 728         case -ECONNRESET:
 729         case -ENOENT:
 730                 dev_dbg(&dev->interface->dev,
 731                         "The urb has been canceled (status %d)\n",
 732                         urb->status);
 733                 goto sched_wq;
 734         case -ESHUTDOWN:
 735         default:
 736                 nfc_err(&dev->interface->dev,
 737                         "Urb failure (status %d)\n", urb->status);
 738                 goto sched_wq;
 739         }
 740
 741         in_frame = dev->in_urb->transfer_buffer;
 742
 743         dev_dbg(&dev->interface->dev, "Received a frame\n");
 744         print_hex_dump_debug("PN533 RX: ", DUMP_PREFIX_NONE, 16, 1, in_frame,
 745                              dev->ops->rx_frame_size(in_frame), false);
 746
 747         if (!dev->ops->rx_is_frame_valid(in_frame, dev)) {
 748                 nfc_err(&dev->interface->dev, "Received an invalid frame\n");
 749                 cmd->status = -EIO;
 750                 goto sched_wq;
 751         }
 752
 753         if (!pn533_rx_frame_is_cmd_response(dev, in_frame)) {
 754                 nfc_err(&dev->interface->dev,
 755                         "It it not the response to the last command\n");
 756                 cmd->status = -EIO;
 757                 goto sched_wq;
 758         }
 759
 760 sched_wq:
 761         queue_work(dev->wq, &dev->cmd_complete_work);
 762 }
 763
 764 static int pn533_submit_urb_for_response(struct pn533 *dev, gfp_t flags)
 765 {
 766         dev->in_urb->complete = pn533_recv_response;
 767
 768         return usb_submit_urb(dev->in_urb, flags);
 769 }
 770
 771 static void pn533_recv_ack(struct urb *urb)
 772 {
 773         struct pn533 *dev = urb->context;
 774         struct pn533_cmd *cmd = dev->cmd;
 775         struct pn533_std_frame *in_frame;
 776         int rc;
 777
 778         cmd->status = urb->status;
 779
 780         switch (urb->status) {
 781         case 0:
 782                 break; /* success */
 783         case -ECONNRESET:
 784         case -ENOENT:
 785                 dev_dbg(&dev->interface->dev,
 786                         "The urb has been stopped (status %d)\n",
 787                         urb->status);
 788                 goto sched_wq;
 789         case -ESHUTDOWN:
 790         default:
 791                 nfc_err(&dev->interface->dev,
 792                         "Urb failure (status %d)\n", urb->status);
 793                 goto sched_wq;
 794         }
 795
 796         in_frame = dev->in_urb->transfer_buffer;
 797
 798         if (!pn533_std_rx_frame_is_ack(in_frame)) {
 799                 nfc_err(&dev->interface->dev, "Received an invalid ack\n");
 800                 cmd->status = -EIO;
 801                 goto sched_wq;
 802         }
 803
 804         rc = pn533_submit_urb_for_response(dev, GFP_ATOMIC);
 805         if (rc) {
 806                 nfc_err(&dev->interface->dev,
 807                         "usb_submit_urb failed with result %d\n", rc);
 808                 cmd->status = rc;
 809                 goto sched_wq;
 810         }
 811
 812         return;
 813
 814 sched_wq:
 815         queue_work(dev->wq, &dev->cmd_complete_work);
 816 }
 817
 818 static int pn533_submit_urb_for_ack(struct pn533 *dev, gfp_t flags)
 819 {
 820         dev->in_urb->complete = pn533_recv_ack;
 821
 822         return usb_submit_urb(dev->in_urb, flags);
 823 }
 824
 825 static int pn533_send_ack(struct pn533 *dev, gfp_t flags)
 826 {
 827         u8 ack[PN533_STD_FRAME_ACK_SIZE] = {0x00, 0x00, 0xff, 0x00, 0xff, 0x00};
 828         /* spec 7.1.1.3:  Preamble, SoPC (2), ACK Code (2), Postamble */
 829         int rc;
 830
 831         dev->out_urb->transfer_buffer = ack;
 832         dev->out_urb->transfer_buffer_length = sizeof(ack);
 833         rc = usb_submit_urb(dev->out_urb, flags);
 834
 835         return rc;
 836 }
 837
 838 static int __pn533_send_frame_async(struct pn533 *dev,
 839                                         struct sk_buff *out,
 840                                         struct sk_buff *in,
 841                                         int in_len)
 842 {
 843         int rc;
 844
 845         dev->out_urb->transfer_buffer = out->data;
 846         dev->out_urb->transfer_buffer_length = out->len;
 847
 848         dev->in_urb->transfer_buffer = in->data;
 849         dev->in_urb->transfer_buffer_length = in_len;
 850
 851         print_hex_dump_debug("PN533 TX: ", DUMP_PREFIX_NONE, 16, 1,
 852                              out->data, out->len, false);
 853
 854         rc = usb_submit_urb(dev->out_urb, GFP_KERNEL);
 855         if (rc)
 856                 return rc;
 857
 858         if (dev->protocol_type == PN533_PROTO_REQ_RESP) {
 859                 /* request for response for sent packet directly */
 860                 rc = pn533_submit_urb_for_response(dev, GFP_ATOMIC);
 861                 if (rc)
 862                         goto error;
 863         } else if (dev->protocol_type == PN533_PROTO_REQ_ACK_RESP) {
 864                 /* request for ACK if that's the case */
 865                 rc = pn533_submit_urb_for_ack(dev, GFP_KERNEL);
 866                 if (rc)
 867                         goto error;
 868         }
 869
 870         return 0;
 871
 872 error:
 873         usb_unlink_urb(dev->out_urb);
 874         return rc;
 875 }
 876
 877 static void pn533_build_cmd_frame(struct pn533 *dev, u8 cmd_code,
 878                                   struct sk_buff *skb)
 879 {
 880         /* payload is already there, just update datalen */
 881         int payload_len = skb->len;
 882         struct pn533_frame_ops *ops = dev->ops;
 883
 884
 885         skb_push(skb, ops->tx_header_len);
 886         skb_put(skb, ops->tx_tail_len);
 887
 888         ops->tx_frame_init(skb->data, cmd_code);
 889         ops->tx_update_payload_len(skb->data, payload_len);
 890         ops->tx_frame_finish(skb->data);
 891 }
 892
 893 static int pn533_send_async_complete(struct pn533 *dev)
 894 {
 895         struct pn533_cmd *cmd = dev->cmd;
 896         int status = cmd->status;
 897
 898         struct sk_buff *req = cmd->req;
 899         struct sk_buff *resp = cmd->resp;
 900
 901         int rc;
 902
 903         dev_kfree_skb(req);
 904
 905         if (status < 0) {
 906                 rc = cmd->complete_cb(dev, cmd->complete_cb_context,
 907                                       ERR_PTR(status));
 908                 dev_kfree_skb(resp);
 909                 goto done;
 910         }
 911
 912         skb_put(resp, dev->ops->rx_frame_size(resp->data));
 913         skb_pull(resp, dev->ops->rx_header_len);
 914         skb_trim(resp, resp->len - dev->ops->rx_tail_len);
 915
 916         rc = cmd->complete_cb(dev, cmd->complete_cb_context, resp);
 917
 918 done:
 919         kfree(cmd);
 920         dev->cmd = NULL;
 921         return rc;
 922 }
 923
 924 static int __pn533_send_async(struct pn533 *dev, u8 cmd_code,
 925                               struct sk_buff *req, struct sk_buff *resp,
 926                               int resp_len,
 927                               pn533_send_async_complete_t complete_cb,
 928                               void *complete_cb_context)
 929 {
 930         struct pn533_cmd *cmd;
 931         int rc = 0;
 932
 933         dev_dbg(&dev->interface->dev, "Sending command 0x%x\n", cmd_code);
 934
 935         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
 936         if (!cmd)
 937                 return -ENOMEM;
 938
 939         cmd->code = cmd_code;
 940         cmd->req = req;
 941         cmd->resp = resp;
 942         cmd->resp_len = resp_len;
 943         cmd->complete_cb = complete_cb;
 944         cmd->complete_cb_context = complete_cb_context;
 945
 946         pn533_build_cmd_frame(dev, cmd_code, req);
 947
 948         mutex_lock(&dev->cmd_lock);
 949
 950         if (!dev->cmd_pending) {
 951                 rc = __pn533_send_frame_async(dev, req, resp, resp_len);
 952                 if (rc)
 953                         goto error;
 954
 955                 dev->cmd_pending = 1;
 956                 dev->cmd = cmd;
 957                 goto unlock;
 958         }
 959
 960         dev_dbg(&dev->interface->dev, "%s Queueing command 0x%x\n",
 961                 __func__, cmd_code);
 962
 963         INIT_LIST_HEAD(&cmd->queue);
 964         list_add_tail(&cmd->queue, &dev->cmd_queue);
 965
 966         goto unlock;
 967
 968 error:
 969         kfree(cmd);
 970 unlock:
 971         mutex_unlock(&dev->cmd_lock);
 972         return rc;
 973 }
 974
 975 static int pn533_send_data_async(struct pn533 *dev, u8 cmd_code,
 976                                  struct sk_buff *req,
 977                                  pn533_send_async_complete_t complete_cb,
 978                                  void *complete_cb_context)
 979 {
 980         struct sk_buff *resp;
 981         int rc;
 982         int  resp_len = dev->ops->rx_header_len +
 983                         dev->ops->max_payload_len +
 984                         dev->ops->rx_tail_len;
 985
 986         resp = nfc_alloc_recv_skb(resp_len, GFP_KERNEL);
 987         if (!resp)
 988                 return -ENOMEM;
 989
 990         rc = __pn533_send_async(dev, cmd_code, req, resp, resp_len, complete_cb,
 991                                 complete_cb_context);
 992         if (rc)
 993                 dev_kfree_skb(resp);
 994
 995         return rc;
 996 }
 997
 998 static int pn533_send_cmd_async(struct pn533 *dev, u8 cmd_code,
 999                                 struct sk_buff *req,
1000                                 pn533_send_async_complete_t complete_cb,
1001                                 void *complete_cb_context)
1002 {
1003         struct sk_buff *resp;
1004         int rc;
1005         int  resp_len = dev->ops->rx_header_len +
1006                         dev->ops->max_payload_len +
1007                         dev->ops->rx_tail_len;
1008
1009         resp = alloc_skb(resp_len, GFP_KERNEL);
1010         if (!resp)
1011                 return -ENOMEM;
1012
1013         rc = __pn533_send_async(dev, cmd_code, req, resp, resp_len, complete_cb,
1014                                 complete_cb_context);
1015         if (rc)
1016                 dev_kfree_skb(resp);
1017
1018         return rc;
1019 }
1020
1021 /*
1022  * pn533_send_cmd_direct_async
1023  *
1024  * The function sends a piority cmd directly to the chip omiting the cmd
1025  * queue. It's intended to be used by chaining mechanism of received responses
1026  * where the host has to request every single chunk of data before scheduling
1027  * next cmd from the queue.
1028  */
1029 static int pn533_send_cmd_direct_async(struct pn533 *dev, u8 cmd_code,
1030                                        struct sk_buff *req,
1031                                        pn533_send_async_complete_t complete_cb,
1032                                        void *complete_cb_context)
1033 {
1034         struct sk_buff *resp;
1035         struct pn533_cmd *cmd;
1036         int rc;
1037         int resp_len = dev->ops->rx_header_len +
1038                        dev->ops->max_payload_len +
1039                        dev->ops->rx_tail_len;
1040
1041         resp = alloc_skb(resp_len, GFP_KERNEL);
1042         if (!resp)
1043                 return -ENOMEM;
1044
1045         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
1046         if (!cmd) {
1047                 dev_kfree_skb(resp);
1048                 return -ENOMEM;
1049         }
1050
1051         cmd->code = cmd_code;
1052         cmd->req = req;
1053         cmd->resp = resp;
1054         cmd->resp_len = resp_len;
1055         cmd->complete_cb = complete_cb;
1056         cmd->complete_cb_context = complete_cb_context;
1057
1058         pn533_build_cmd_frame(dev, cmd_code, req);
1059
1060         rc = __pn533_send_frame_async(dev, req, resp, resp_len);
1061         if (rc < 0) {
1062                 dev_kfree_skb(resp);
1063                 kfree(cmd);
1064         } else {
1065                 dev->cmd = cmd;
1066         }
1067
1068         return rc;
1069 }
1070
1071 static void pn533_wq_cmd_complete(struct work_struct *work)
1072 {
1073         struct pn533 *dev = container_of(work, struct pn533, cmd_complete_work);
1074         int rc;
1075
1076         rc = pn533_send_async_complete(dev);
1077         if (rc != -EINPROGRESS)
1078                 queue_work(dev->wq, &dev->cmd_work);
1079 }
1080
1081 static void pn533_wq_cmd(struct work_struct *work)
1082 {
1083         struct pn533 *dev = container_of(work, struct pn533, cmd_work);
1084         struct pn533_cmd *cmd;
1085         int rc;
1086
1087         mutex_lock(&dev->cmd_lock);
1088
1089         if (list_empty(&dev->cmd_queue)) {
1090                 dev->cmd_pending = 0;
1091                 mutex_unlock(&dev->cmd_lock);
1092                 return;
1093         }
1094
1095         cmd = list_first_entry(&dev->cmd_queue, struct pn533_cmd, queue);
1096
1097         list_del(&cmd->queue);
1098
1099         mutex_unlock(&dev->cmd_lock);
1100
1101         rc = __pn533_send_frame_async(dev, cmd->req, cmd->resp, cmd->resp_len);
1102         if (rc < 0) {
1103                 dev_kfree_skb(cmd->req);
1104                 dev_kfree_skb(cmd->resp);
1105                 kfree(cmd);
1106                 return;
1107         }
1108
1109         dev->cmd = cmd;
1110 }
1111
1112 struct pn533_sync_cmd_response {
1113         struct sk_buff *resp;
1114         struct completion done;
1115 };
1116
1117 static int pn533_send_sync_complete(struct pn533 *dev, void *_arg,
1118                                     struct sk_buff *resp)
1119 {
1120         struct pn533_sync_cmd_response *arg = _arg;
1121
1122         arg->resp = resp;
1123         complete(&arg->done);
1124
1125         return 0;
1126 }
1127
1128 /*  pn533_send_cmd_sync
1129  *
1130  *  Please note the req parameter is freed inside the function to
1131  *  limit a number of return value interpretations by the caller.
1132  *
1133  *  1. negative in case of error during TX path -> req should be freed
1134  *
1135  *  2. negative in case of error during RX path -> req should not be freed
1136  *     as it's been already freed at the begining of RX path by
1137  *     async_complete_cb.
1138  *
1139  *  3. valid pointer in case of succesfult RX path
1140  *
1141  *  A caller has to check a return value with IS_ERR macro. If the test pass,
1142  *  the returned pointer is valid.
1143  *
1144  * */
1145 static struct sk_buff *pn533_send_cmd_sync(struct pn533 *dev, u8 cmd_code,
1146                                                struct sk_buff *req)
1147 {
1148         int rc;
1149         struct pn533_sync_cmd_response arg;
1150
1151         init_completion(&arg.done);
1152
1153         rc = pn533_send_cmd_async(dev, cmd_code, req,
1154                                   pn533_send_sync_complete, &arg);
1155         if (rc) {
1156                 dev_kfree_skb(req);
1157                 return ERR_PTR(rc);
1158         }
1159
1160         wait_for_completion(&arg.done);
1161
1162         return arg.resp;
1163 }
1164
1165 static void pn533_send_complete(struct urb *urb)
1166 {
1167         struct pn533 *dev = urb->context;
1168
1169         switch (urb->status) {
1170         case 0:
1171                 break; /* success */
1172         case -ECONNRESET:
1173         case -ENOENT:
1174                 dev_dbg(&dev->interface->dev,
1175                         "The urb has been stopped (status %d)\n",
1176                         urb->status);
1177                 break;
1178         case -ESHUTDOWN:
1179         default:
1180                 nfc_err(&dev->interface->dev, "Urb failure (status %d)\n",
1181                         urb->status);
1182         }
1183 }
1184
1185 static void pn533_abort_cmd(struct pn533 *dev, gfp_t flags)
1186 {
1187         /* ACR122U does not support any command which aborts last
1188          * issued command i.e. as ACK for standard PN533. Additionally,
1189          * it behaves stange, sending broken or incorrect responses,
1190          * when we cancel urb before the chip will send response.
1191          */
1192         if (dev->device_type == PN533_DEVICE_ACR122U)
1193                 return;
1194
1195         /* An ack will cancel the last issued command */
1196         pn533_send_ack(dev, flags);
1197
1198         /* cancel the urb request */
1199         usb_kill_urb(dev->in_urb);
1200 }
1201
1202 static struct sk_buff *pn533_alloc_skb(struct pn533 *dev, unsigned int size)
1203 {
1204         struct sk_buff *skb;
1205
1206         skb = alloc_skb(dev->ops->tx_header_len +
1207                         size +
1208                         dev->ops->tx_tail_len, GFP_KERNEL);
1209
1210         if (skb)
1211                 skb_reserve(skb, dev->ops->tx_header_len);
1212
1213         return skb;
1214 }
1215
1216 struct pn533_target_type_a {
1217         __be16 sens_res;
1218         u8 sel_res;
1219         u8 nfcid_len;
1220         u8 nfcid_data[];
1221 } __packed;
1222
1223
1224 #define PN533_TYPE_A_SENS_RES_NFCID1(x) ((u8)((be16_to_cpu(x) & 0x00C0) >> 6))
1225 #define PN533_TYPE_A_SENS_RES_SSD(x) ((u8)((be16_to_cpu(x) & 0x001F) >> 0))
1226 #define PN533_TYPE_A_SENS_RES_PLATCONF(x) ((u8)((be16_to_cpu(x) & 0x0F00) >> 8))
1227
1228 #define PN533_TYPE_A_SENS_RES_SSD_JEWEL 0x00
1229 #define PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL 0x0C
1230
1231 #define PN533_TYPE_A_SEL_PROT(x) (((x) & 0x60) >> 5)
1232 #define PN533_TYPE_A_SEL_CASCADE(x) (((x) & 0x04) >> 2)
1233
1234 #define PN533_TYPE_A_SEL_PROT_MIFARE 0
1235 #define PN533_TYPE_A_SEL_PROT_ISO14443 1
1236 #define PN533_TYPE_A_SEL_PROT_DEP 2
1237 #define PN533_TYPE_A_SEL_PROT_ISO14443_DEP 3
1238
1239 static bool pn533_target_type_a_is_valid(struct pn533_target_type_a *type_a,
1240                                                         int target_data_len)
1241 {
1242         u8 ssd;
1243         u8 platconf;
1244
1245         if (target_data_len < sizeof(struct pn533_target_type_a))
1246                 return false;
1247
1248         /* The lenght check of nfcid[] and ats[] are not being performed because
1249            the values are not being used */
1250
1251         /* Requirement 4.6.3.3 from NFC Forum Digital Spec */
1252         ssd = PN533_TYPE_A_SENS_RES_SSD(type_a->sens_res);
1253         platconf = PN533_TYPE_A_SENS_RES_PLATCONF(type_a->sens_res);
1254
1255         if ((ssd == PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
1256              platconf != PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL) ||
1257             (ssd != PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
1258              platconf == PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL))
1259                 return false;
1260
1261         /* Requirements 4.8.2.1, 4.8.2.3, 4.8.2.5 and 4.8.2.7 from NFC Forum */
1262         if (PN533_TYPE_A_SEL_CASCADE(type_a->sel_res) != 0)
1263                 return false;
1264
1265         return true;
1266 }
1267
1268 static int pn533_target_found_type_a(struct nfc_target *nfc_tgt, u8 *tgt_data,
1269                                                         int tgt_data_len)
1270 {
1271         struct pn533_target_type_a *tgt_type_a;
1272
1273         tgt_type_a = (struct pn533_target_type_a *)tgt_data;
1274
1275         if (!pn533_target_type_a_is_valid(tgt_type_a, tgt_data_len))
1276                 return -EPROTO;
1277
1278         switch (PN533_TYPE_A_SEL_PROT(tgt_type_a->sel_res)) {
1279         case PN533_TYPE_A_SEL_PROT_MIFARE:
1280                 nfc_tgt->supported_protocols = NFC_PROTO_MIFARE_MASK;
1281                 break;
1282         case PN533_TYPE_A_SEL_PROT_ISO14443:
1283                 nfc_tgt->supported_protocols = NFC_PROTO_ISO14443_MASK;
1284                 break;
1285         case PN533_TYPE_A_SEL_PROT_DEP:
1286                 nfc_tgt->supported_protocols = NFC_PROTO_NFC_DEP_MASK;
1287                 break;
1288         case PN533_TYPE_A_SEL_PROT_ISO14443_DEP:
1289                 nfc_tgt->supported_protocols = NFC_PROTO_ISO14443_MASK |
1290                                                         NFC_PROTO_NFC_DEP_MASK;
1291                 break;
1292         }
1293
1294         nfc_tgt->sens_res = be16_to_cpu(tgt_type_a->sens_res);
1295         nfc_tgt->sel_res = tgt_type_a->sel_res;
1296         nfc_tgt->nfcid1_len = tgt_type_a->nfcid_len;
1297         memcpy(nfc_tgt->nfcid1, tgt_type_a->nfcid_data, nfc_tgt->nfcid1_len);
1298
1299         return 0;
1300 }
1301
1302 struct pn533_target_felica {
1303         u8 pol_res;
1304         u8 opcode;
1305         u8 nfcid2[NFC_NFCID2_MAXSIZE];
1306         u8 pad[8];
1307         /* optional */
1308         u8 syst_code[];
1309 } __packed;
1310
1311 #define PN533_FELICA_SENSF_NFCID2_DEP_B1 0x01
1312 #define PN533_FELICA_SENSF_NFCID2_DEP_B2 0xFE
1313
1314 static bool pn533_target_felica_is_valid(struct pn533_target_felica *felica,
1315                                                         int target_data_len)
1316 {
1317         if (target_data_len < sizeof(struct pn533_target_felica))
1318                 return false;
1319
1320         if (felica->opcode != PN533_FELICA_OPC_SENSF_RES)
1321                 return false;
1322
1323         return true;
1324 }
1325
1326 static int pn533_target_found_felica(struct nfc_target *nfc_tgt, u8 *tgt_data,
1327                                                         int tgt_data_len)
1328 {
1329         struct pn533_target_felica *tgt_felica;
1330
1331         tgt_felica = (struct pn533_target_felica *)tgt_data;
1332
1333         if (!pn533_target_felica_is_valid(tgt_felica, tgt_data_len))
1334                 return -EPROTO;
1335
1336         if ((tgt_felica->nfcid2[0] == PN533_FELICA_SENSF_NFCID2_DEP_B1) &&
1337             (tgt_felica->nfcid2[1] == PN533_FELICA_SENSF_NFCID2_DEP_B2))
1338                 nfc_tgt->supported_protocols = NFC_PROTO_NFC_DEP_MASK;
1339         else
1340                 nfc_tgt->supported_protocols = NFC_PROTO_FELICA_MASK;
1341
1342         memcpy(nfc_tgt->sensf_res, &tgt_felica->opcode, 9);
1343         nfc_tgt->sensf_res_len = 9;
1344
1345         memcpy(nfc_tgt->nfcid2, tgt_felica->nfcid2, NFC_NFCID2_MAXSIZE);
1346         nfc_tgt->nfcid2_len = NFC_NFCID2_MAXSIZE;
1347
1348         return 0;
1349 }
1350
1351 struct pn533_target_jewel {
1352         __be16 sens_res;
1353         u8 jewelid[4];
1354 } __packed;
1355
1356 static bool pn533_target_jewel_is_valid(struct pn533_target_jewel *jewel,
1357                                                         int target_data_len)
1358 {
1359         u8 ssd;
1360         u8 platconf;
1361
1362         if (target_data_len < sizeof(struct pn533_target_jewel))
1363                 return false;
1364
1365         /* Requirement 4.6.3.3 from NFC Forum Digital Spec */
1366         ssd = PN533_TYPE_A_SENS_RES_SSD(jewel->sens_res);
1367         platconf = PN533_TYPE_A_SENS_RES_PLATCONF(jewel->sens_res);
1368
1369         if ((ssd == PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
1370              platconf != PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL) ||
1371             (ssd != PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
1372              platconf == PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL))
1373                 return false;
1374
1375         return true;
1376 }
1377
1378 static int pn533_target_found_jewel(struct nfc_target *nfc_tgt, u8 *tgt_data,
1379                                                         int tgt_data_len)
1380 {
1381         struct pn533_target_jewel *tgt_jewel;
1382
1383         tgt_jewel = (struct pn533_target_jewel *)tgt_data;
1384
1385         if (!pn533_target_jewel_is_valid(tgt_jewel, tgt_data_len))
1386                 return -EPROTO;
1387
1388         nfc_tgt->supported_protocols = NFC_PROTO_JEWEL_MASK;
1389         nfc_tgt->sens_res = be16_to_cpu(tgt_jewel->sens_res);
1390         nfc_tgt->nfcid1_len = 4;
1391         memcpy(nfc_tgt->nfcid1, tgt_jewel->jewelid, nfc_tgt->nfcid1_len);
1392
1393         return 0;
1394 }
1395
1396 struct pn533_type_b_prot_info {
1397         u8 bitrate;
1398         u8 fsci_type;
1399         u8 fwi_adc_fo;
1400 } __packed;
1401
1402 #define PN533_TYPE_B_PROT_FCSI(x) (((x) & 0xF0) >> 4)
1403 #define PN533_TYPE_B_PROT_TYPE(x) (((x) & 0x0F) >> 0)
1404 #define PN533_TYPE_B_PROT_TYPE_RFU_MASK 0x8
1405
1406 struct pn533_type_b_sens_res {
1407         u8 opcode;
1408         u8 nfcid[4];
1409         u8 appdata[4];
1410         struct pn533_type_b_prot_info prot_info;
1411 } __packed;
1412
1413 #define PN533_TYPE_B_OPC_SENSB_RES 0x50
1414
1415 struct pn533_target_type_b {
1416         struct pn533_type_b_sens_res sensb_res;
1417         u8 attrib_res_len;
1418         u8 attrib_res[];
1419 } __packed;
1420
1421 static bool pn533_target_type_b_is_valid(struct pn533_target_type_b *type_b,
1422                                                         int target_data_len)
1423 {
1424         if (target_data_len < sizeof(struct pn533_target_type_b))
1425                 return false;
1426
1427         if (type_b->sensb_res.opcode != PN533_TYPE_B_OPC_SENSB_RES)
1428                 return false;
1429
1430         if (PN533_TYPE_B_PROT_TYPE(type_b->sensb_res.prot_info.fsci_type) &
1431                                                 PN533_TYPE_B_PROT_TYPE_RFU_MASK)
1432                 return false;
1433
1434         return true;
1435 }
1436
1437 static int pn533_target_found_type_b(struct nfc_target *nfc_tgt, u8 *tgt_data,
1438                                                         int tgt_data_len)
1439 {
1440         struct pn533_target_type_b *tgt_type_b;
1441
1442         tgt_type_b = (struct pn533_target_type_b *)tgt_data;
1443
1444         if (!pn533_target_type_b_is_valid(tgt_type_b, tgt_data_len))
1445                 return -EPROTO;
1446
1447         nfc_tgt->supported_protocols = NFC_PROTO_ISO14443_B_MASK;
1448
1449         return 0;
1450 }
1451
1452 static int pn533_target_found(struct pn533 *dev, u8 tg, u8 *tgdata,
1453                               int tgdata_len)
1454 {
1455         struct nfc_target nfc_tgt;
1456         int rc;
1457
1458         dev_dbg(&dev->interface->dev, "%s: modulation=%d\n",
1459                 __func__, dev->poll_mod_curr);
1460
1461         if (tg != 1)
1462                 return -EPROTO;
1463
1464         memset(&nfc_tgt, 0, sizeof(struct nfc_target));
1465
1466         switch (dev->poll_mod_curr) {
1467         case PN533_POLL_MOD_106KBPS_A:
1468                 rc = pn533_target_found_type_a(&nfc_tgt, tgdata, tgdata_len);
1469                 break;
1470         case PN533_POLL_MOD_212KBPS_FELICA:
1471         case PN533_POLL_MOD_424KBPS_FELICA:
1472                 rc = pn533_target_found_felica(&nfc_tgt, tgdata, tgdata_len);
1473                 break;
1474         case PN533_POLL_MOD_106KBPS_JEWEL:
1475                 rc = pn533_target_found_jewel(&nfc_tgt, tgdata, tgdata_len);
1476                 break;
1477         case PN533_POLL_MOD_847KBPS_B:
1478                 rc = pn533_target_found_type_b(&nfc_tgt, tgdata, tgdata_len);
1479                 break;
1480         default:
1481                 nfc_err(&dev->interface->dev,
1482                         "Unknown current poll modulation\n");
1483                 return -EPROTO;
1484         }
1485
1486         if (rc)
1487                 return rc;
1488
1489         if (!(nfc_tgt.supported_protocols & dev->poll_protocols)) {
1490                 dev_dbg(&dev->interface->dev,
1491                         "The Tg found doesn't have the desired protocol\n");
1492                 return -EAGAIN;
1493         }
1494
1495         dev_dbg(&dev->interface->dev,
1496                 "Target found - supported protocols: 0x%x\n",
1497                 nfc_tgt.supported_protocols);
1498
1499         dev->tgt_available_prots = nfc_tgt.supported_protocols;
1500
1501         nfc_targets_found(dev->nfc_dev, &nfc_tgt, 1);
1502
1503         return 0;
1504 }
1505
1506 static inline void pn533_poll_next_mod(struct pn533 *dev)
1507 {
1508         dev->poll_mod_curr = (dev->poll_mod_curr + 1) % dev->poll_mod_count;
1509 }
1510
1511 static void pn533_poll_reset_mod_list(struct pn533 *dev)
1512 {
1513         dev->poll_mod_count = 0;
1514 }
1515
1516 static void pn533_poll_add_mod(struct pn533 *dev, u8 mod_index)
1517 {
1518         dev->poll_mod_active[dev->poll_mod_count] =
1519                 (struct pn533_poll_modulations *)&poll_mod[mod_index];
1520         dev->poll_mod_count++;
1521 }
1522
1523 static void pn533_poll_create_mod_list(struct pn533 *dev,
1524                                        u32 im_protocols, u32 tm_protocols)
1525 {
1526         pn533_poll_reset_mod_list(dev);
1527
1528         if ((im_protocols & NFC_PROTO_MIFARE_MASK) ||
1529             (im_protocols & NFC_PROTO_ISO14443_MASK) ||
1530             (im_protocols & NFC_PROTO_NFC_DEP_MASK))
1531                 pn533_poll_add_mod(dev, PN533_POLL_MOD_106KBPS_A);
1532
1533         if (im_protocols & NFC_PROTO_FELICA_MASK ||
1534             im_protocols & NFC_PROTO_NFC_DEP_MASK) {
1535                 pn533_poll_add_mod(dev, PN533_POLL_MOD_212KBPS_FELICA);
1536                 pn533_poll_add_mod(dev, PN533_POLL_MOD_424KBPS_FELICA);
1537         }
1538
1539         if (im_protocols & NFC_PROTO_JEWEL_MASK)
1540                 pn533_poll_add_mod(dev, PN533_POLL_MOD_106KBPS_JEWEL);
1541
1542         if (im_protocols & NFC_PROTO_ISO14443_B_MASK)
1543                 pn533_poll_add_mod(dev, PN533_POLL_MOD_847KBPS_B);
1544
1545         if (tm_protocols)
1546                 pn533_poll_add_mod(dev, PN533_LISTEN_MOD);
1547 }
1548
1549 static int pn533_start_poll_complete(struct pn533 *dev, struct sk_buff *resp)
1550 {
1551         u8 nbtg, tg, *tgdata;
1552         int rc, tgdata_len;
1553
1554         /* Toggle the DEP polling */
1555         dev->poll_dep = 1;
1556
1557         nbtg = resp->data[0];
1558         tg = resp->data[1];
1559         tgdata = &resp->data[2];
1560         tgdata_len = resp->len - 2;  /* nbtg + tg */
1561
1562         if (nbtg) {
1563                 rc = pn533_target_found(dev, tg, tgdata, tgdata_len);
1564
1565                 /* We must stop the poll after a valid target found */
1566                 if (rc == 0) {
1567                         pn533_poll_reset_mod_list(dev);
1568                         return 0;
1569                 }
1570         }
1571
1572         return -EAGAIN;
1573 }
1574
1575 static struct sk_buff *pn533_alloc_poll_tg_frame(struct pn533 *dev)
1576 {
1577         struct sk_buff *skb;
1578         u8 *felica, *nfcid3, *gb;
1579
1580         u8 *gbytes = dev->gb;
1581         size_t gbytes_len = dev->gb_len;
1582
1583         u8 felica_params[18] = {0x1, 0xfe, /* DEP */
1584                                 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, /* random */
1585                                 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
1586                                 0xff, 0xff}; /* System code */
1587
1588         u8 mifare_params[6] = {0x1, 0x1, /* SENS_RES */
1589                                0x0, 0x0, 0x0,
1590                                0x40}; /* SEL_RES for DEP */
1591
1592         unsigned int skb_len = 36 + /* mode (1), mifare (6),
1593                                        felica (18), nfcid3 (10), gb_len (1) */
1594                                gbytes_len +
1595                                1;  /* len Tk*/
1596
1597         skb = pn533_alloc_skb(dev, skb_len);
1598         if (!skb)
1599                 return NULL;
1600
1601         /* DEP support only */
1602         *skb_put(skb, 1) = PN533_INIT_TARGET_DEP;
1603
1604         /* MIFARE params */
1605         memcpy(skb_put(skb, 6), mifare_params, 6);
1606
1607         /* Felica params */
1608         felica = skb_put(skb, 18);
1609         memcpy(felica, felica_params, 18);
1610         get_random_bytes(felica + 2, 6);
1611
1612         /* NFCID3 */
1613         nfcid3 = skb_put(skb, 10);
1614         memset(nfcid3, 0, 10);
1615         memcpy(nfcid3, felica, 8);
1616
1617         /* General bytes */
1618         *skb_put(skb, 1) = gbytes_len;
1619
1620         gb = skb_put(skb, gbytes_len);
1621         memcpy(gb, gbytes, gbytes_len);
1622
1623         /* Len Tk */
1624         *skb_put(skb, 1) = 0;
1625
1626         return skb;
1627 }
1628
1629 #define PN533_CMD_DATAEXCH_HEAD_LEN 1
1630 #define PN533_CMD_DATAEXCH_DATA_MAXLEN 262
1631 static void pn533_wq_tm_mi_recv(struct work_struct *work);
1632 static struct sk_buff *pn533_build_response(struct pn533 *dev);
1633
1634 static int pn533_tm_get_data_complete(struct pn533 *dev, void *arg,
1635                                       struct sk_buff *resp)
1636 {
1637         struct sk_buff *skb;
1638         u8 status, ret, mi;
1639         int rc;
1640
1641         dev_dbg(&dev->interface->dev, "%s\n", __func__);
1642
1643         if (IS_ERR(resp)) {
1644                 skb_queue_purge(&dev->resp_q);
1645                 return PTR_ERR(resp);
1646         }
1647
1648         status = resp->data[0];
1649
1650         ret = status & PN533_CMD_RET_MASK;
1651         mi = status & PN533_CMD_MI_MASK;
1652
1653         skb_pull(resp, sizeof(status));
1654
1655         if (ret != PN533_CMD_RET_SUCCESS) {
1656                 rc = -EIO;
1657                 goto error;
1658         }
1659
1660         skb_queue_tail(&dev->resp_q, resp);
1661
1662         if (mi) {
1663                 queue_work(dev->wq, &dev->mi_tm_rx_work);
1664                 return -EINPROGRESS;
1665         }
1666
1667         skb = pn533_build_response(dev);
1668         if (!skb) {
1669                 rc = -EIO;
1670                 goto error;
1671         }
1672
1673         return nfc_tm_data_received(dev->nfc_dev, skb);
1674
1675 error:
1676         nfc_tm_deactivated(dev->nfc_dev);
1677         dev->tgt_mode = 0;
1678         skb_queue_purge(&dev->resp_q);
1679         dev_kfree_skb(resp);
1680
1681         return rc;
1682 }
1683
1684 static void pn533_wq_tm_mi_recv(struct work_struct *work)
1685 {
1686         struct pn533 *dev = container_of(work, struct pn533, mi_tm_rx_work);
1687         struct sk_buff *skb;
1688         int rc;
1689
1690         dev_dbg(&dev->interface->dev, "%s\n", __func__);
1691
1692         skb = pn533_alloc_skb(dev, 0);
1693         if (!skb)
1694                 return;
1695
1696         rc = pn533_send_cmd_direct_async(dev,
1697                                         PN533_CMD_TG_GET_DATA,
1698                                         skb,
1699                                         pn533_tm_get_data_complete,
1700                                         NULL);
1701
1702         if (rc < 0)
1703                 dev_kfree_skb(skb);
1704
1705         return;
1706 }
1707
1708 static int pn533_tm_send_complete(struct pn533 *dev, void *arg,
1709                                   struct sk_buff *resp);
1710 static void pn533_wq_tm_mi_send(struct work_struct *work)
1711 {
1712         struct pn533 *dev = container_of(work, struct pn533, mi_tm_tx_work);
1713         struct sk_buff *skb;
1714         int rc;
1715
1716         dev_dbg(&dev->interface->dev, "%s\n", __func__);
1717
1718         /* Grab the first skb in the queue */
1719         skb = skb_dequeue(&dev->fragment_skb);
1720         if (skb == NULL) {      /* No more data */
1721                 /* Reset the queue for future use */
1722                 skb_queue_head_init(&dev->fragment_skb);
1723                 goto error;
1724         }
1725
1726         /* last entry - remove MI bit */
1727         if (skb_queue_len(&dev->fragment_skb) == 0) {
1728                 rc = pn533_send_cmd_direct_async(dev, PN533_CMD_TG_SET_DATA,
1729                                         skb, pn533_tm_send_complete, NULL);
1730         } else
1731                 rc = pn533_send_cmd_direct_async(dev,
1732                                         PN533_CMD_TG_SET_META_DATA,
1733                                         skb, pn533_tm_send_complete, NULL);
1734
1735         if (rc == 0) /* success */
1736                 return;
1737
1738         dev_err(&dev->interface->dev,
1739                 "Error %d when trying to perform set meta data_exchange", rc);
1740
1741         dev_kfree_skb(skb);
1742
1743 error:
1744         pn533_send_ack(dev, GFP_KERNEL);
1745         queue_work(dev->wq, &dev->cmd_work);
1746 }
1747
1748 static void pn533_wq_tg_get_data(struct work_struct *work)
1749 {
1750         struct pn533 *dev = container_of(work, struct pn533, tg_work);
1751         struct sk_buff *skb;
1752         int rc;
1753
1754         dev_dbg(&dev->interface->dev, "%s\n", __func__);
1755
1756         skb = pn533_alloc_skb(dev, 0);
1757         if (!skb)
1758                 return;
1759
1760         rc = pn533_send_data_async(dev, PN533_CMD_TG_GET_DATA, skb,
1761                                    pn533_tm_get_data_complete, NULL);
1762
1763         if (rc < 0)
1764                 dev_kfree_skb(skb);
1765
1766         return;
1767 }
1768
1769 #define ATR_REQ_GB_OFFSET 17
1770 static int pn533_init_target_complete(struct pn533 *dev, struct sk_buff *resp)
1771 {
1772         u8 mode, *cmd, comm_mode = NFC_COMM_PASSIVE, *gb;
1773         size_t gb_len;
1774         int rc;
1775
1776         dev_dbg(&dev->interface->dev, "%s\n", __func__);
1777
1778         if (resp->len < ATR_REQ_GB_OFFSET + 1)
1779                 return -EINVAL;
1780
1781         mode = resp->data[0];
1782         cmd = &resp->data[1];
1783
1784         dev_dbg(&dev->interface->dev, "Target mode 0x%x len %d\n",
1785                 mode, resp->len);
1786
1787         if ((mode & PN533_INIT_TARGET_RESP_FRAME_MASK) ==
1788             PN533_INIT_TARGET_RESP_ACTIVE)
1789                 comm_mode = NFC_COMM_ACTIVE;
1790
1791         if ((mode & PN533_INIT_TARGET_RESP_DEP) == 0)  /* Only DEP supported */
1792                 return -EOPNOTSUPP;
1793
1794         gb = cmd + ATR_REQ_GB_OFFSET;
1795         gb_len = resp->len - (ATR_REQ_GB_OFFSET + 1);
1796
1797         rc = nfc_tm_activated(dev->nfc_dev, NFC_PROTO_NFC_DEP_MASK,
1798                               comm_mode, gb, gb_len);
1799         if (rc < 0) {
1800                 nfc_err(&dev->interface->dev,
1801                         "Error when signaling target activation\n");
1802                 return rc;
1803         }
1804
1805         dev->tgt_mode = 1;
1806         queue_work(dev->wq, &dev->tg_work);
1807
1808         return 0;
1809 }
1810
1811 static void pn533_listen_mode_timer(unsigned long data)
1812 {
1813         struct pn533 *dev = (struct pn533 *)data;
1814
1815         dev_dbg(&dev->interface->dev, "Listen mode timeout\n");
1816
1817         dev->cancel_listen = 1;
1818
1819         pn533_poll_next_mod(dev);
1820
1821         queue_delayed_work(dev->wq, &dev->poll_work,
1822                            msecs_to_jiffies(PN533_POLL_INTERVAL));
1823 }
1824
1825 static int pn533_rf_complete(struct pn533 *dev, void *arg,
1826                              struct sk_buff *resp)
1827 {
1828         int rc = 0;
1829
1830         dev_dbg(&dev->interface->dev, "%s\n", __func__);
1831
1832         if (IS_ERR(resp)) {
1833                 rc = PTR_ERR(resp);
1834
1835                 nfc_err(&dev->interface->dev, "RF setting error %d", rc);
1836
1837                 return rc;
1838         }
1839
1840         queue_delayed_work(dev->wq, &dev->poll_work,
1841                            msecs_to_jiffies(PN533_POLL_INTERVAL));
1842
1843         dev_kfree_skb(resp);
1844         return rc;
1845 }
1846
1847 static void pn533_wq_rf(struct work_struct *work)
1848 {
1849         struct pn533 *dev = container_of(work, struct pn533, rf_work);
1850         struct sk_buff *skb;
1851         int rc;
1852
1853         dev_dbg(&dev->interface->dev, "%s\n", __func__);
1854
1855         skb = pn533_alloc_skb(dev, 2);
1856         if (!skb)
1857                 return;
1858
1859         *skb_put(skb, 1) = PN533_CFGITEM_RF_FIELD;
1860         *skb_put(skb, 1) = PN533_CFGITEM_RF_FIELD_AUTO_RFCA;
1861
1862         rc = pn533_send_cmd_async(dev, PN533_CMD_RF_CONFIGURATION, skb,
1863                                   pn533_rf_complete, NULL);
1864         if (rc < 0) {
1865                 dev_kfree_skb(skb);
1866                 nfc_err(&dev->interface->dev, "RF setting error %d\n", rc);
1867         }
1868
1869         return;
1870 }
1871
1872 static int pn533_poll_dep_complete(struct pn533 *dev, void *arg,
1873                                    struct sk_buff *resp)
1874 {
1875         struct pn533_cmd_jump_dep_response *rsp;
1876         struct nfc_target nfc_target;
1877         u8 target_gt_len;
1878         int rc;
1879
1880         if (IS_ERR(resp))
1881                 return PTR_ERR(resp);
1882
1883         rsp = (struct pn533_cmd_jump_dep_response *)resp->data;
1884
1885         rc = rsp->status & PN533_CMD_RET_MASK;
1886         if (rc != PN533_CMD_RET_SUCCESS) {
1887                 /* Not target found, turn radio off */
1888                 queue_work(dev->wq, &dev->rf_work);
1889
1890                 dev_kfree_skb(resp);
1891                 return 0;
1892         }
1893
1894         dev_dbg(&dev->interface->dev, "Creating new target");
1895
1896         nfc_target.supported_protocols = NFC_PROTO_NFC_DEP_MASK;
1897         nfc_target.nfcid1_len = 10;
1898         memcpy(nfc_target.nfcid1, rsp->nfcid3t, nfc_target.nfcid1_len);
1899         rc = nfc_targets_found(dev->nfc_dev, &nfc_target, 1);
1900         if (rc)
1901                 goto error;
1902
1903         dev->tgt_available_prots = 0;
1904         dev->tgt_active_prot = NFC_PROTO_NFC_DEP;
1905
1906         /* ATR_RES general bytes are located at offset 17 */
1907         target_gt_len = resp->len - 17;
1908         rc = nfc_set_remote_general_bytes(dev->nfc_dev,
1909                                           rsp->gt, target_gt_len);
1910         if (!rc) {
1911                 rc = nfc_dep_link_is_up(dev->nfc_dev,
1912                                         dev->nfc_dev->targets[0].idx,
1913                                         0, NFC_RF_INITIATOR);
1914
1915                 if (!rc)
1916                         pn533_poll_reset_mod_list(dev);
1917         }
1918 error:
1919         dev_kfree_skb(resp);
1920         return rc;
1921 }
1922
1923 #define PASSIVE_DATA_LEN 5
1924 static int pn533_poll_dep(struct nfc_dev *nfc_dev)
1925 {
1926         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
1927         struct sk_buff *skb;
1928         int rc, skb_len;
1929         u8 *next, nfcid3[NFC_NFCID3_MAXSIZE];
1930         u8 passive_data[PASSIVE_DATA_LEN] = {0x00, 0xff, 0xff, 0x00, 0x3};
1931
1932         dev_dbg(&dev->interface->dev, "%s", __func__);
1933
1934         if (!dev->gb) {
1935                 dev->gb = nfc_get_local_general_bytes(nfc_dev, &dev->gb_len);
1936
1937                 if (!dev->gb || !dev->gb_len) {
1938                         dev->poll_dep = 0;
1939                         queue_work(dev->wq, &dev->rf_work);
1940                 }
1941         }
1942
1943         skb_len = 3 + dev->gb_len; /* ActPass + BR + Next */
1944         skb_len += PASSIVE_DATA_LEN;
1945
1946         /* NFCID3 */
1947         skb_len += NFC_NFCID3_MAXSIZE;
1948         nfcid3[0] = 0x1;
1949         nfcid3[1] = 0xfe;
1950         get_random_bytes(nfcid3 + 2, 6);
1951
1952         skb = pn533_alloc_skb(dev, skb_len);
1953         if (!skb)
1954                 return -ENOMEM;
1955
1956         *skb_put(skb, 1) = 0x01;  /* Active */
1957         *skb_put(skb, 1) = 0x02;  /* 424 kbps */
1958
1959         next = skb_put(skb, 1);  /* Next */
1960         *next = 0;
1961
1962         /* Copy passive data */
1963         memcpy(skb_put(skb, PASSIVE_DATA_LEN), passive_data, PASSIVE_DATA_LEN);
1964         *next |= 1;
1965
1966         /* Copy NFCID3 (which is NFCID2 from SENSF_RES) */
1967         memcpy(skb_put(skb, NFC_NFCID3_MAXSIZE), nfcid3,
1968                NFC_NFCID3_MAXSIZE);
1969         *next |= 2;
1970
1971         memcpy(skb_put(skb, dev->gb_len), dev->gb, dev->gb_len);
1972         *next |= 4; /* We have some Gi */
1973
1974         rc = pn533_send_cmd_async(dev, PN533_CMD_IN_JUMP_FOR_DEP, skb,
1975                                   pn533_poll_dep_complete, NULL);
1976
1977         if (rc < 0)
1978                 dev_kfree_skb(skb);
1979
1980         return rc;
1981 }
1982
1983 static int pn533_poll_complete(struct pn533 *dev, void *arg,
1984                                struct sk_buff *resp)
1985 {
1986         struct pn533_poll_modulations *cur_mod;
1987         int rc;
1988
1989         dev_dbg(&dev->interface->dev, "%s\n", __func__);
1990
1991         if (IS_ERR(resp)) {
1992                 rc = PTR_ERR(resp);
1993
1994                 nfc_err(&dev->interface->dev, "%s  Poll complete error %d\n",
1995                         __func__, rc);
1996
1997                 if (rc == -ENOENT) {
1998                         if (dev->poll_mod_count != 0)
1999                                 return rc;
2000                         else
2001                                 goto stop_poll;
2002                 } else if (rc < 0) {
2003                         nfc_err(&dev->interface->dev,
2004                                 "Error %d when running poll\n", rc);
2005                         goto stop_poll;
2006                 }
2007         }
2008
2009         cur_mod = dev->poll_mod_active[dev->poll_mod_curr];
2010
2011         if (cur_mod->len == 0) { /* Target mode */
2012                 del_timer(&dev->listen_timer);
2013                 rc = pn533_init_target_complete(dev, resp);
2014                 goto done;
2015         }
2016
2017         /* Initiator mode */
2018         rc = pn533_start_poll_complete(dev, resp);
2019         if (!rc)
2020                 goto done;
2021
2022         if (!dev->poll_mod_count) {
2023                 dev_dbg(&dev->interface->dev, "Polling has been stopped\n");
2024                 goto done;
2025         }
2026
2027         pn533_poll_next_mod(dev);
2028         /* Not target found, turn radio off */
2029         queue_work(dev->wq, &dev->rf_work);
2030
2031 done:
2032         dev_kfree_skb(resp);
2033         return rc;
2034
2035 stop_poll:
2036         nfc_err(&dev->interface->dev, "Polling operation has been stopped\n");
2037
2038         pn533_poll_reset_mod_list(dev);
2039         dev->poll_protocols = 0;
2040         return rc;
2041 }
2042
2043 static struct sk_buff *pn533_alloc_poll_in_frame(struct pn533 *dev,
2044                                         struct pn533_poll_modulations *mod)
2045 {
2046         struct sk_buff *skb;
2047
2048         skb = pn533_alloc_skb(dev, mod->len);
2049         if (!skb)
2050                 return NULL;
2051
2052         memcpy(skb_put(skb, mod->len), &mod->data, mod->len);
2053
2054         return skb;
2055 }
2056
2057 static int pn533_send_poll_frame(struct pn533 *dev)
2058 {
2059         struct pn533_poll_modulations *mod;
2060         struct sk_buff *skb;
2061         int rc;
2062         u8 cmd_code;
2063
2064         mod = dev->poll_mod_active[dev->poll_mod_curr];
2065
2066         dev_dbg(&dev->interface->dev, "%s mod len %d\n",
2067                 __func__, mod->len);
2068
2069         if (dev->poll_dep)  {
2070                 dev->poll_dep = 0;
2071                 return pn533_poll_dep(dev->nfc_dev);
2072         }
2073
2074         if (mod->len == 0) {  /* Listen mode */
2075                 cmd_code = PN533_CMD_TG_INIT_AS_TARGET;
2076                 skb = pn533_alloc_poll_tg_frame(dev);
2077         } else {  /* Polling mode */
2078                 cmd_code =  PN533_CMD_IN_LIST_PASSIVE_TARGET;
2079                 skb = pn533_alloc_poll_in_frame(dev, mod);
2080         }
2081
2082         if (!skb) {
2083                 nfc_err(&dev->interface->dev, "Failed to allocate skb\n");
2084                 return -ENOMEM;
2085         }
2086
2087         rc = pn533_send_cmd_async(dev, cmd_code, skb, pn533_poll_complete,
2088                                   NULL);
2089         if (rc < 0) {
2090                 dev_kfree_skb(skb);
2091                 nfc_err(&dev->interface->dev, "Polling loop error %d\n", rc);
2092         }
2093
2094         return rc;
2095 }
2096
2097 static void pn533_wq_poll(struct work_struct *work)
2098 {
2099         struct pn533 *dev = container_of(work, struct pn533, poll_work.work);
2100         struct pn533_poll_modulations *cur_mod;
2101         int rc;
2102
2103         cur_mod = dev->poll_mod_active[dev->poll_mod_curr];
2104
2105         dev_dbg(&dev->interface->dev,
2106                 "%s cancel_listen %d modulation len %d\n",
2107                 __func__, dev->cancel_listen, cur_mod->len);
2108
2109         if (dev->cancel_listen == 1) {
2110                 dev->cancel_listen = 0;
2111                 pn533_abort_cmd(dev, GFP_ATOMIC);
2112         }
2113
2114         rc = pn533_send_poll_frame(dev);
2115         if (rc)
2116                 return;
2117
2118         if (cur_mod->len == 0 && dev->poll_mod_count > 1)
2119                 mod_timer(&dev->listen_timer, jiffies + PN533_LISTEN_TIME * HZ);
2120
2121         return;
2122 }
2123
2124 static int pn533_start_poll(struct nfc_dev *nfc_dev,
2125                             u32 im_protocols, u32 tm_protocols)
2126 {
2127         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2128         struct pn533_poll_modulations *cur_mod;
2129         u8 rand_mod;
2130         int rc;
2131
2132         dev_dbg(&dev->interface->dev,
2133                 "%s: im protocols 0x%x tm protocols 0x%x\n",
2134                 __func__, im_protocols, tm_protocols);
2135
2136         if (dev->tgt_active_prot) {
2137                 nfc_err(&dev->interface->dev,
2138                         "Cannot poll with a target already activated\n");
2139                 return -EBUSY;
2140         }
2141
2142         if (dev->tgt_mode) {
2143                 nfc_err(&dev->interface->dev,
2144                         "Cannot poll while already being activated\n");
2145                 return -EBUSY;
2146         }
2147
2148         if (tm_protocols) {
2149                 dev->gb = nfc_get_local_general_bytes(nfc_dev, &dev->gb_len);
2150                 if (dev->gb == NULL)
2151                         tm_protocols = 0;
2152         }
2153
2154         pn533_poll_create_mod_list(dev, im_protocols, tm_protocols);
2155         dev->poll_protocols = im_protocols;
2156         dev->listen_protocols = tm_protocols;
2157
2158         /* Do not always start polling from the same modulation */
2159         get_random_bytes(&rand_mod, sizeof(rand_mod));
2160         rand_mod %= dev->poll_mod_count;
2161         dev->poll_mod_curr = rand_mod;
2162
2163         cur_mod = dev->poll_mod_active[dev->poll_mod_curr];
2164
2165         rc = pn533_send_poll_frame(dev);
2166
2167         /* Start listen timer */
2168         if (!rc && cur_mod->len == 0 && dev->poll_mod_count > 1)
2169                 mod_timer(&dev->listen_timer, jiffies + PN533_LISTEN_TIME * HZ);
2170
2171         return rc;
2172 }
2173
2174 static void pn533_stop_poll(struct nfc_dev *nfc_dev)
2175 {
2176         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2177
2178         del_timer(&dev->listen_timer);
2179
2180         if (!dev->poll_mod_count) {
2181                 dev_dbg(&dev->interface->dev,
2182                         "Polling operation was not running\n");
2183                 return;
2184         }
2185
2186         pn533_abort_cmd(dev, GFP_KERNEL);
2187         flush_delayed_work(&dev->poll_work);
2188         pn533_poll_reset_mod_list(dev);
2189 }
2190
2191 static int pn533_activate_target_nfcdep(struct pn533 *dev)
2192 {
2193         struct pn533_cmd_activate_response *rsp;
2194         u16 gt_len;
2195         int rc;
2196         struct sk_buff *skb;
2197         struct sk_buff *resp;
2198
2199         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2200
2201         skb = pn533_alloc_skb(dev, sizeof(u8) * 2); /*TG + Next*/
2202         if (!skb)
2203                 return -ENOMEM;
2204
2205         *skb_put(skb, sizeof(u8)) = 1; /* TG */
2206         *skb_put(skb, sizeof(u8)) = 0; /* Next */
2207
2208         resp = pn533_send_cmd_sync(dev, PN533_CMD_IN_ATR, skb);
2209         if (IS_ERR(resp))
2210                 return PTR_ERR(resp);
2211
2212         rsp = (struct pn533_cmd_activate_response *)resp->data;
2213         rc = rsp->status & PN533_CMD_RET_MASK;
2214         if (rc != PN533_CMD_RET_SUCCESS) {
2215                 nfc_err(&dev->interface->dev,
2216                         "Target activation failed (error 0x%x)\n", rc);
2217                 dev_kfree_skb(resp);
2218                 return -EIO;
2219         }
2220
2221         /* ATR_RES general bytes are located at offset 16 */
2222         gt_len = resp->len - 16;
2223         rc = nfc_set_remote_general_bytes(dev->nfc_dev, rsp->gt, gt_len);
2224
2225         dev_kfree_skb(resp);
2226         return rc;
2227 }
2228
2229 static int pn533_activate_target(struct nfc_dev *nfc_dev,
2230                                  struct nfc_target *target, u32 protocol)
2231 {
2232         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2233         int rc;
2234
2235         dev_dbg(&dev->interface->dev, "%s: protocol=%u\n", __func__, protocol);
2236
2237         if (dev->poll_mod_count) {
2238                 nfc_err(&dev->interface->dev,
2239                         "Cannot activate while polling\n");
2240                 return -EBUSY;
2241         }
2242
2243         if (dev->tgt_active_prot) {
2244                 nfc_err(&dev->interface->dev,
2245                         "There is already an active target\n");
2246                 return -EBUSY;
2247         }
2248
2249         if (!dev->tgt_available_prots) {
2250                 nfc_err(&dev->interface->dev,
2251                         "There is no available target to activate\n");
2252                 return -EINVAL;
2253         }
2254
2255         if (!(dev->tgt_available_prots & (1 << protocol))) {
2256                 nfc_err(&dev->interface->dev,
2257                         "Target doesn't support requested proto %u\n",
2258                         protocol);
2259                 return -EINVAL;
2260         }
2261
2262         if (protocol == NFC_PROTO_NFC_DEP) {
2263                 rc = pn533_activate_target_nfcdep(dev);
2264                 if (rc) {
2265                         nfc_err(&dev->interface->dev,
2266                                 "Activating target with DEP failed %d\n", rc);
2267                         return rc;
2268                 }
2269         }
2270
2271         dev->tgt_active_prot = protocol;
2272         dev->tgt_available_prots = 0;
2273
2274         return 0;
2275 }
2276
2277 static void pn533_deactivate_target(struct nfc_dev *nfc_dev,
2278                                     struct nfc_target *target)
2279 {
2280         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2281         struct sk_buff *skb;
2282         struct sk_buff *resp;
2283         int rc;
2284
2285         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2286
2287         if (!dev->tgt_active_prot) {
2288                 nfc_err(&dev->interface->dev, "There is no active target\n");
2289                 return;
2290         }
2291
2292         dev->tgt_active_prot = 0;
2293         skb_queue_purge(&dev->resp_q);
2294
2295         skb = pn533_alloc_skb(dev, sizeof(u8));
2296         if (!skb)
2297                 return;
2298
2299         *skb_put(skb, 1) = 1; /* TG*/
2300
2301         resp = pn533_send_cmd_sync(dev, PN533_CMD_IN_RELEASE, skb);
2302         if (IS_ERR(resp))
2303                 return;
2304
2305         rc = resp->data[0] & PN533_CMD_RET_MASK;
2306         if (rc != PN533_CMD_RET_SUCCESS)
2307                 nfc_err(&dev->interface->dev,
2308                         "Error 0x%x when releasing the target\n", rc);
2309
2310         dev_kfree_skb(resp);
2311         return;
2312 }
2313
2314
2315 static int pn533_in_dep_link_up_complete(struct pn533 *dev, void *arg,
2316                                          struct sk_buff *resp)
2317 {
2318         struct pn533_cmd_jump_dep_response *rsp;
2319         u8 target_gt_len;
2320         int rc;
2321         u8 active = *(u8 *)arg;
2322
2323         kfree(arg);
2324
2325         if (IS_ERR(resp))
2326                 return PTR_ERR(resp);
2327
2328         if (dev->tgt_available_prots &&
2329             !(dev->tgt_available_prots & (1 << NFC_PROTO_NFC_DEP))) {
2330                 nfc_err(&dev->interface->dev,
2331                         "The target does not support DEP\n");
2332                 rc =  -EINVAL;
2333                 goto error;
2334         }
2335
2336         rsp = (struct pn533_cmd_jump_dep_response *)resp->data;
2337
2338         rc = rsp->status & PN533_CMD_RET_MASK;
2339         if (rc != PN533_CMD_RET_SUCCESS) {
2340                 nfc_err(&dev->interface->dev,
2341                         "Bringing DEP link up failed (error 0x%x)\n", rc);
2342                 goto error;
2343         }
2344
2345         if (!dev->tgt_available_prots) {
2346                 struct nfc_target nfc_target;
2347
2348                 dev_dbg(&dev->interface->dev, "Creating new target\n");
2349
2350                 nfc_target.supported_protocols = NFC_PROTO_NFC_DEP_MASK;
2351                 nfc_target.nfcid1_len = 10;
2352                 memcpy(nfc_target.nfcid1, rsp->nfcid3t, nfc_target.nfcid1_len);
2353                 rc = nfc_targets_found(dev->nfc_dev, &nfc_target, 1);
2354                 if (rc)
2355                         goto error;
2356
2357                 dev->tgt_available_prots = 0;
2358         }
2359
2360         dev->tgt_active_prot = NFC_PROTO_NFC_DEP;
2361
2362         /* ATR_RES general bytes are located at offset 17 */
2363         target_gt_len = resp->len - 17;
2364         rc = nfc_set_remote_general_bytes(dev->nfc_dev,
2365                                           rsp->gt, target_gt_len);
2366         if (rc == 0)
2367                 rc = nfc_dep_link_is_up(dev->nfc_dev,
2368                                         dev->nfc_dev->targets[0].idx,
2369                                         !active, NFC_RF_INITIATOR);
2370
2371 error:
2372         dev_kfree_skb(resp);
2373         return rc;
2374 }
2375
2376 static int pn533_rf_field(struct nfc_dev *nfc_dev, u8 rf);
2377 static int pn533_dep_link_up(struct nfc_dev *nfc_dev, struct nfc_target *target,
2378                              u8 comm_mode, u8 *gb, size_t gb_len)
2379 {
2380         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2381         struct sk_buff *skb;
2382         int rc, skb_len;
2383         u8 *next, *arg, nfcid3[NFC_NFCID3_MAXSIZE];
2384         u8 passive_data[PASSIVE_DATA_LEN] = {0x00, 0xff, 0xff, 0x00, 0x3};
2385
2386         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2387
2388         if (dev->poll_mod_count) {
2389                 nfc_err(&dev->interface->dev,
2390                         "Cannot bring the DEP link up while polling\n");
2391                 return -EBUSY;
2392         }
2393
2394         if (dev->tgt_active_prot) {
2395                 nfc_err(&dev->interface->dev,
2396                         "There is already an active target\n");
2397                 return -EBUSY;
2398         }
2399
2400         skb_len = 3 + gb_len; /* ActPass + BR + Next */
2401         skb_len += PASSIVE_DATA_LEN;
2402
2403         /* NFCID3 */
2404         skb_len += NFC_NFCID3_MAXSIZE;
2405         if (target && !target->nfcid2_len) {
2406                 nfcid3[0] = 0x1;
2407                 nfcid3[1] = 0xfe;
2408                 get_random_bytes(nfcid3 + 2, 6);
2409         }
2410
2411         skb = pn533_alloc_skb(dev, skb_len);
2412         if (!skb)
2413                 return -ENOMEM;
2414
2415         *skb_put(skb, 1) = !comm_mode;  /* ActPass */
2416         *skb_put(skb, 1) = 0x02;  /* 424 kbps */
2417
2418         next = skb_put(skb, 1);  /* Next */
2419         *next = 0;
2420
2421         /* Copy passive data */
2422         memcpy(skb_put(skb, PASSIVE_DATA_LEN), passive_data, PASSIVE_DATA_LEN);
2423         *next |= 1;
2424
2425         /* Copy NFCID3 (which is NFCID2 from SENSF_RES) */
2426         if (target && target->nfcid2_len)
2427                 memcpy(skb_put(skb, NFC_NFCID3_MAXSIZE), target->nfcid2,
2428                        target->nfcid2_len);
2429         else
2430                 memcpy(skb_put(skb, NFC_NFCID3_MAXSIZE), nfcid3,
2431                        NFC_NFCID3_MAXSIZE);
2432         *next |= 2;
2433
2434         if (gb != NULL && gb_len > 0) {
2435                 memcpy(skb_put(skb, gb_len), gb, gb_len);
2436                 *next |= 4; /* We have some Gi */
2437         } else {
2438                 *next = 0;
2439         }
2440
2441         arg = kmalloc(sizeof(*arg), GFP_KERNEL);
2442         if (!arg) {
2443                 dev_kfree_skb(skb);
2444                 return -ENOMEM;
2445         }
2446
2447         *arg = !comm_mode;
2448
2449         pn533_rf_field(dev->nfc_dev, 0);
2450
2451         rc = pn533_send_cmd_async(dev, PN533_CMD_IN_JUMP_FOR_DEP, skb,
2452                                   pn533_in_dep_link_up_complete, arg);
2453
2454         if (rc < 0) {
2455                 dev_kfree_skb(skb);
2456                 kfree(arg);
2457         }
2458
2459         return rc;
2460 }
2461
2462 static int pn533_dep_link_down(struct nfc_dev *nfc_dev)
2463 {
2464         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2465
2466         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2467
2468         pn533_poll_reset_mod_list(dev);
2469
2470         if (dev->tgt_mode || dev->tgt_active_prot)
2471                 pn533_abort_cmd(dev, GFP_KERNEL);
2472
2473         dev->tgt_active_prot = 0;
2474         dev->tgt_mode = 0;
2475
2476         skb_queue_purge(&dev->resp_q);
2477
2478         return 0;
2479 }
2480
2481 struct pn533_data_exchange_arg {
2482         data_exchange_cb_t cb;
2483         void *cb_context;
2484 };
2485
2486 static struct sk_buff *pn533_build_response(struct pn533 *dev)
2487 {
2488         struct sk_buff *skb, *tmp, *t;
2489         unsigned int skb_len = 0, tmp_len = 0;
2490
2491         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2492
2493         if (skb_queue_empty(&dev->resp_q))
2494                 return NULL;
2495
2496         if (skb_queue_len(&dev->resp_q) == 1) {
2497                 skb = skb_dequeue(&dev->resp_q);
2498                 goto out;
2499         }
2500
2501         skb_queue_walk_safe(&dev->resp_q, tmp, t)
2502                 skb_len += tmp->len;
2503
2504         dev_dbg(&dev->interface->dev, "%s total length %d\n",
2505                 __func__, skb_len);
2506
2507         skb = alloc_skb(skb_len, GFP_KERNEL);
2508         if (skb == NULL)
2509                 goto out;
2510
2511         skb_put(skb, skb_len);
2512
2513         skb_queue_walk_safe(&dev->resp_q, tmp, t) {
2514                 memcpy(skb->data + tmp_len, tmp->data, tmp->len);
2515                 tmp_len += tmp->len;
2516         }
2517
2518 out:
2519         skb_queue_purge(&dev->resp_q);
2520
2521         return skb;
2522 }
2523
2524 static int pn533_data_exchange_complete(struct pn533 *dev, void *_arg,
2525                                         struct sk_buff *resp)
2526 {
2527         struct pn533_data_exchange_arg *arg = _arg;
2528         struct sk_buff *skb;
2529         int rc = 0;
2530         u8 status, ret, mi;
2531
2532         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2533
2534         if (IS_ERR(resp)) {
2535                 rc = PTR_ERR(resp);
2536                 goto _error;
2537         }
2538
2539         status = resp->data[0];
2540         ret = status & PN533_CMD_RET_MASK;
2541         mi = status & PN533_CMD_MI_MASK;
2542
2543         skb_pull(resp, sizeof(status));
2544
2545         if (ret != PN533_CMD_RET_SUCCESS) {
2546                 nfc_err(&dev->interface->dev,
2547                         "Exchanging data failed (error 0x%x)\n", ret);
2548                 rc = -EIO;
2549                 goto error;
2550         }
2551
2552         skb_queue_tail(&dev->resp_q, resp);
2553
2554         if (mi) {
2555                 dev->cmd_complete_mi_arg = arg;
2556                 queue_work(dev->wq, &dev->mi_rx_work);
2557                 return -EINPROGRESS;
2558         }
2559
2560         /* Prepare for the next round */
2561         if (skb_queue_len(&dev->fragment_skb) > 0) {
2562                 dev->cmd_complete_dep_arg = arg;
2563                 queue_work(dev->wq, &dev->mi_tx_work);
2564
2565                 return -EINPROGRESS;
2566         }
2567
2568         skb = pn533_build_response(dev);
2569         if (!skb)
2570                 goto error;
2571
2572         arg->cb(arg->cb_context, skb, 0);
2573         kfree(arg);
2574         return 0;
2575
2576 error:
2577         dev_kfree_skb(resp);
2578 _error:
2579         skb_queue_purge(&dev->resp_q);
2580         arg->cb(arg->cb_context, NULL, rc);
2581         kfree(arg);
2582         return rc;
2583 }
2584
2585 /* Split the Tx skb into small chunks */
2586 static int pn533_fill_fragment_skbs(struct pn533 *dev, struct sk_buff *skb)
2587 {
2588         struct sk_buff *frag;
2589         int  frag_size;
2590
2591         do {
2592                 /* Remaining size */
2593                 if (skb->len > PN533_CMD_DATAFRAME_MAXLEN)
2594                         frag_size = PN533_CMD_DATAFRAME_MAXLEN;
2595                 else
2596                         frag_size = skb->len;
2597
2598                 /* Allocate and reserve */
2599                 frag = pn533_alloc_skb(dev, frag_size);
2600                 if (!frag) {
2601                         skb_queue_purge(&dev->fragment_skb);
2602                         break;
2603                 }
2604
2605                 if (!dev->tgt_mode) {
2606                         /* Reserve the TG/MI byte */
2607                         skb_reserve(frag, 1);
2608
2609                         /* MI + TG */
2610                         if (frag_size  == PN533_CMD_DATAFRAME_MAXLEN)
2611                                 *skb_push(frag, sizeof(u8)) =
2612                                                         (PN533_CMD_MI_MASK | 1);
2613                         else
2614                                 *skb_push(frag, sizeof(u8)) =  1; /* TG */
2615                 }
2616
2617                 memcpy(skb_put(frag, frag_size), skb->data, frag_size);
2618
2619                 /* Reduce the size of incoming buffer */
2620                 skb_pull(skb, frag_size);
2621
2622                 /* Add this to skb_queue */
2623                 skb_queue_tail(&dev->fragment_skb, frag);
2624
2625         } while (skb->len > 0);
2626
2627         dev_kfree_skb(skb);
2628
2629         return skb_queue_len(&dev->fragment_skb);
2630 }
2631
2632 static int pn533_transceive(struct nfc_dev *nfc_dev,
2633                             struct nfc_target *target, struct sk_buff *skb,
2634                             data_exchange_cb_t cb, void *cb_context)
2635 {
2636         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2637         struct pn533_data_exchange_arg *arg = NULL;
2638         int rc;
2639
2640         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2641
2642         if (!dev->tgt_active_prot) {
2643                 nfc_err(&dev->interface->dev,
2644                         "Can't exchange data if there is no active target\n");
2645                 rc = -EINVAL;
2646                 goto error;
2647         }
2648
2649         arg = kmalloc(sizeof(*arg), GFP_KERNEL);
2650         if (!arg) {
2651                 rc = -ENOMEM;
2652                 goto error;
2653         }
2654
2655         arg->cb = cb;
2656         arg->cb_context = cb_context;
2657
2658         switch (dev->device_type) {
2659         case PN533_DEVICE_PASORI:
2660                 if (dev->tgt_active_prot == NFC_PROTO_FELICA) {
2661                         rc = pn533_send_data_async(dev, PN533_CMD_IN_COMM_THRU,
2662                                                    skb,
2663                                                    pn533_data_exchange_complete,
2664                                                    arg);
2665
2666                         break;
2667                 }
2668         default:
2669                 /* jumbo frame ? */
2670                 if (skb->len > PN533_CMD_DATAEXCH_DATA_MAXLEN) {
2671                         rc = pn533_fill_fragment_skbs(dev, skb);
2672                         if (rc <= 0)
2673                                 goto error;
2674
2675                         skb = skb_dequeue(&dev->fragment_skb);
2676                         if (!skb) {
2677                                 rc = -EIO;
2678                                 goto error;
2679                         }
2680                 } else {
2681                         *skb_push(skb, sizeof(u8)) =  1; /* TG */
2682                 }
2683
2684                 rc = pn533_send_data_async(dev, PN533_CMD_IN_DATA_EXCHANGE,
2685                                            skb, pn533_data_exchange_complete,
2686                                            arg);
2687
2688                 break;
2689         }
2690
2691         if (rc < 0) /* rc from send_async */
2692                 goto error;
2693
2694         return 0;
2695
2696 error:
2697         kfree(arg);
2698         dev_kfree_skb(skb);
2699         return rc;
2700 }
2701
2702 static int pn533_tm_send_complete(struct pn533 *dev, void *arg,
2703                                   struct sk_buff *resp)
2704 {
2705         u8 status;
2706
2707         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2708
2709         if (IS_ERR(resp))
2710                 return PTR_ERR(resp);
2711
2712         status = resp->data[0];
2713
2714         /* Prepare for the next round */
2715         if (skb_queue_len(&dev->fragment_skb) > 0) {
2716                 queue_work(dev->wq, &dev->mi_tm_tx_work);
2717                 return -EINPROGRESS;
2718         }
2719         dev_kfree_skb(resp);
2720
2721         if (status != 0) {
2722                 nfc_tm_deactivated(dev->nfc_dev);
2723
2724                 dev->tgt_mode = 0;
2725
2726                 return 0;
2727         }
2728
2729         queue_work(dev->wq, &dev->tg_work);
2730
2731         return 0;
2732 }
2733
2734 static int pn533_tm_send(struct nfc_dev *nfc_dev, struct sk_buff *skb)
2735 {
2736         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2737         int rc;
2738
2739         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2740
2741         /* let's split in multiple chunks if size's too big */
2742         if (skb->len > PN533_CMD_DATAEXCH_DATA_MAXLEN) {
2743                 rc = pn533_fill_fragment_skbs(dev, skb);
2744                 if (rc <= 0)
2745                         goto error;
2746
2747                 /* get the first skb */
2748                 skb = skb_dequeue(&dev->fragment_skb);
2749                 if (!skb) {
2750                         rc = -EIO;
2751                         goto error;
2752                 }
2753
2754                 rc = pn533_send_data_async(dev, PN533_CMD_TG_SET_META_DATA, skb,
2755                                                 pn533_tm_send_complete, NULL);
2756         } else {
2757                 /* Send th skb */
2758                 rc = pn533_send_data_async(dev, PN533_CMD_TG_SET_DATA, skb,
2759                                                 pn533_tm_send_complete, NULL);
2760         }
2761
2762 error:
2763         if (rc < 0) {
2764                 dev_kfree_skb(skb);
2765                 skb_queue_purge(&dev->fragment_skb);
2766         }
2767
2768         return rc;
2769 }
2770
2771 static void pn533_wq_mi_recv(struct work_struct *work)
2772 {
2773         struct pn533 *dev = container_of(work, struct pn533, mi_rx_work);
2774         struct sk_buff *skb;
2775         int rc;
2776
2777         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2778
2779         skb = pn533_alloc_skb(dev, PN533_CMD_DATAEXCH_HEAD_LEN);
2780         if (!skb)
2781                 goto error;
2782
2783         switch (dev->device_type) {
2784         case PN533_DEVICE_PASORI:
2785                 if (dev->tgt_active_prot == NFC_PROTO_FELICA) {
2786                         rc = pn533_send_cmd_direct_async(dev,
2787                                                 PN533_CMD_IN_COMM_THRU,
2788                                                 skb,
2789                                                 pn533_data_exchange_complete,
2790                                                  dev->cmd_complete_mi_arg);
2791
2792                         break;
2793                 }
2794         default:
2795                 *skb_put(skb, sizeof(u8)) =  1; /*TG*/
2796
2797                 rc = pn533_send_cmd_direct_async(dev,
2798                                                  PN533_CMD_IN_DATA_EXCHANGE,
2799                                                  skb,
2800                                                  pn533_data_exchange_complete,
2801                                                  dev->cmd_complete_mi_arg);
2802
2803                 break;
2804         }
2805
2806         if (rc == 0) /* success */
2807                 return;
2808
2809         nfc_err(&dev->interface->dev,
2810                 "Error %d when trying to perform data_exchange\n", rc);
2811
2812         dev_kfree_skb(skb);
2813         kfree(dev->cmd_complete_mi_arg);
2814
2815 error:
2816         pn533_send_ack(dev, GFP_KERNEL);
2817         queue_work(dev->wq, &dev->cmd_work);
2818 }
2819
2820 static void pn533_wq_mi_send(struct work_struct *work)
2821 {
2822         struct pn533 *dev = container_of(work, struct pn533, mi_tx_work);
2823         struct sk_buff *skb;
2824         int rc;
2825
2826         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2827
2828         /* Grab the first skb in the queue */
2829         skb = skb_dequeue(&dev->fragment_skb);
2830
2831         if (skb == NULL) {      /* No more data */
2832                 /* Reset the queue for future use */
2833                 skb_queue_head_init(&dev->fragment_skb);
2834                 goto error;
2835         }
2836
2837         switch (dev->device_type) {
2838         case PN533_DEVICE_PASORI:
2839                 if (dev->tgt_active_prot != NFC_PROTO_FELICA) {
2840                         rc = -EIO;
2841                         break;
2842                 }
2843
2844                 rc = pn533_send_cmd_direct_async(dev, PN533_CMD_IN_COMM_THRU,
2845                                                  skb,
2846                                                  pn533_data_exchange_complete,
2847                                                  dev->cmd_complete_dep_arg);
2848
2849                 break;
2850
2851         default:
2852                 /* Still some fragments? */
2853                 rc = pn533_send_cmd_direct_async(dev,PN533_CMD_IN_DATA_EXCHANGE,
2854                                                  skb,
2855                                                  pn533_data_exchange_complete,
2856                                                  dev->cmd_complete_dep_arg);
2857
2858                 break;
2859         }
2860
2861         if (rc == 0) /* success */
2862                 return;
2863
2864         nfc_err(&dev->interface->dev,
2865                 "Error %d when trying to perform data_exchange\n", rc);
2866
2867         dev_kfree_skb(skb);
2868         kfree(dev->cmd_complete_dep_arg);
2869
2870 error:
2871         pn533_send_ack(dev, GFP_KERNEL);
2872         queue_work(dev->wq, &dev->cmd_work);
2873 }
2874
2875 static int pn533_set_configuration(struct pn533 *dev, u8 cfgitem, u8 *cfgdata,
2876                                                                 u8 cfgdata_len)
2877 {
2878         struct sk_buff *skb;
2879         struct sk_buff *resp;
2880         int skb_len;
2881
2882         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2883
2884         skb_len = sizeof(cfgitem) + cfgdata_len; /* cfgitem + cfgdata */
2885
2886         skb = pn533_alloc_skb(dev, skb_len);
2887         if (!skb)
2888                 return -ENOMEM;
2889
2890         *skb_put(skb, sizeof(cfgitem)) = cfgitem;
2891         memcpy(skb_put(skb, cfgdata_len), cfgdata, cfgdata_len);
2892
2893         resp = pn533_send_cmd_sync(dev, PN533_CMD_RF_CONFIGURATION, skb);
2894         if (IS_ERR(resp))
2895                 return PTR_ERR(resp);
2896
2897         dev_kfree_skb(resp);
2898         return 0;
2899 }
2900
2901 static int pn533_get_firmware_version(struct pn533 *dev,
2902                                       struct pn533_fw_version *fv)
2903 {
2904         struct sk_buff *skb;
2905         struct sk_buff *resp;
2906
2907         skb = pn533_alloc_skb(dev, 0);
2908         if (!skb)
2909                 return -ENOMEM;
2910
2911         resp = pn533_send_cmd_sync(dev, PN533_CMD_GET_FIRMWARE_VERSION, skb);
2912         if (IS_ERR(resp))
2913                 return PTR_ERR(resp);
2914
2915         fv->ic = resp->data[0];
2916         fv->ver = resp->data[1];
2917         fv->rev = resp->data[2];
2918         fv->support = resp->data[3];
2919
2920         dev_kfree_skb(resp);
2921         return 0;
2922 }
2923
2924 static int pn533_pasori_fw_reset(struct pn533 *dev)
2925 {
2926         struct sk_buff *skb;
2927         struct sk_buff *resp;
2928
2929         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2930
2931         skb = pn533_alloc_skb(dev, sizeof(u8));
2932         if (!skb)
2933                 return -ENOMEM;
2934
2935         *skb_put(skb, sizeof(u8)) = 0x1;
2936
2937         resp = pn533_send_cmd_sync(dev, 0x18, skb);
2938         if (IS_ERR(resp))
2939                 return PTR_ERR(resp);
2940
2941         dev_kfree_skb(resp);
2942
2943         return 0;
2944 }
2945
2946 struct pn533_acr122_poweron_rdr_arg {
2947         int rc;
2948         struct completion done;
2949 };
2950
2951 static void pn533_acr122_poweron_rdr_resp(struct urb *urb)
2952 {
2953         struct pn533_acr122_poweron_rdr_arg *arg = urb->context;
2954
2955         dev_dbg(&urb->dev->dev, "%s\n", __func__);
2956
2957         print_hex_dump_debug("ACR122 RX: ", DUMP_PREFIX_NONE, 16, 1,
2958                        urb->transfer_buffer, urb->transfer_buffer_length,
2959                        false);
2960
2961         arg->rc = urb->status;
2962         complete(&arg->done);
2963 }
2964
2965 static int pn533_acr122_poweron_rdr(struct pn533 *dev)
2966 {
2967         /* Power on th reader (CCID cmd) */
2968         u8 cmd[10] = {PN533_ACR122_PC_TO_RDR_ICCPOWERON,
2969                       0, 0, 0, 0, 0, 0, 3, 0, 0};
2970         u8 buf[255];
2971         int rc;
2972         void *cntx;
2973         struct pn533_acr122_poweron_rdr_arg arg;
2974
2975         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2976
2977         init_completion(&arg.done);
2978         cntx = dev->in_urb->context;  /* backup context */
2979
2980         dev->in_urb->transfer_buffer = buf;
2981         dev->in_urb->transfer_buffer_length = 255;
2982         dev->in_urb->complete = pn533_acr122_poweron_rdr_resp;
2983         dev->in_urb->context = &arg;
2984
2985         dev->out_urb->transfer_buffer = cmd;
2986         dev->out_urb->transfer_buffer_length = sizeof(cmd);
2987
2988         print_hex_dump_debug("ACR122 TX: ", DUMP_PREFIX_NONE, 16, 1,
2989                        cmd, sizeof(cmd), false);
2990
2991         rc = usb_submit_urb(dev->out_urb, GFP_KERNEL);
2992         if (rc) {
2993                 nfc_err(&dev->interface->dev,
2994                         "Reader power on cmd error %d\n", rc);
2995                 return rc;
2996         }
2997
2998         rc =  usb_submit_urb(dev->in_urb, GFP_KERNEL);
2999         if (rc) {
3000                 nfc_err(&dev->interface->dev,
3001                         "Can't submit reader poweron cmd response %d\n", rc);
3002                 return rc;
3003         }
3004
3005         wait_for_completion(&arg.done);
3006         dev->in_urb->context = cntx; /* restore context */
3007
3008         return arg.rc;
3009 }
3010
3011 static int pn533_rf_field(struct nfc_dev *nfc_dev, u8 rf)
3012 {
3013         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
3014         u8 rf_field = !!rf;
3015         int rc;
3016
3017         rf_field |= PN533_CFGITEM_RF_FIELD_AUTO_RFCA;
3018
3019         rc = pn533_set_configuration(dev, PN533_CFGITEM_RF_FIELD,
3020                                      (u8 *)&rf_field, 1);
3021         if (rc) {
3022                 nfc_err(&dev->interface->dev, "Error on setting RF field\n");
3023                 return rc;
3024         }
3025
3026         return rc;
3027 }
3028
3029 static int pn533_dev_up(struct nfc_dev *nfc_dev)
3030 {
3031         return pn533_rf_field(nfc_dev, 1);
3032 }
3033
3034 static int pn533_dev_down(struct nfc_dev *nfc_dev)
3035 {
3036         return pn533_rf_field(nfc_dev, 0);
3037 }
3038
3039 static struct nfc_ops pn533_nfc_ops = {
3040         .dev_up = pn533_dev_up,
3041         .dev_down = pn533_dev_down,
3042         .dep_link_up = pn533_dep_link_up,
3043         .dep_link_down = pn533_dep_link_down,
3044         .start_poll = pn533_start_poll,
3045         .stop_poll = pn533_stop_poll,
3046         .activate_target = pn533_activate_target,
3047         .deactivate_target = pn533_deactivate_target,
3048         .im_transceive = pn533_transceive,
3049         .tm_send = pn533_tm_send,
3050 };
3051
3052 static int pn533_setup(struct pn533 *dev)
3053 {
3054         struct pn533_config_max_retries max_retries;
3055         struct pn533_config_timing timing;
3056         u8 pasori_cfg[3] = {0x08, 0x01, 0x08};
3057         int rc;
3058
3059         switch (dev->device_type) {
3060         case PN533_DEVICE_STD:
3061         case PN533_DEVICE_PASORI:
3062         case PN533_DEVICE_ACR122U:
3063                 max_retries.mx_rty_atr = 0x2;
3064                 max_retries.mx_rty_psl = 0x1;
3065                 max_retries.mx_rty_passive_act =
3066                         PN533_CONFIG_MAX_RETRIES_NO_RETRY;
3067
3068                 timing.rfu = PN533_CONFIG_TIMING_102;
3069                 timing.atr_res_timeout = PN533_CONFIG_TIMING_102;
3070                 timing.dep_timeout = PN533_CONFIG_TIMING_204;
3071
3072                 break;
3073
3074         default:
3075                 nfc_err(&dev->interface->dev, "Unknown device type %d\n",
3076                         dev->device_type);
3077                 return -EINVAL;
3078         }
3079
3080         rc = pn533_set_configuration(dev, PN533_CFGITEM_MAX_RETRIES,
3081                                      (u8 *)&max_retries, sizeof(max_retries));
3082         if (rc) {
3083                 nfc_err(&dev->interface->dev,
3084                         "Error on setting MAX_RETRIES config\n");
3085                 return rc;
3086         }
3087
3088
3089         rc = pn533_set_configuration(dev, PN533_CFGITEM_TIMING,
3090                                      (u8 *)&timing, sizeof(timing));
3091         if (rc) {
3092                 nfc_err(&dev->interface->dev, "Error on setting RF timings\n");
3093                 return rc;
3094         }
3095
3096         switch (dev->device_type) {
3097         case PN533_DEVICE_STD:
3098                 break;
3099
3100         case PN533_DEVICE_PASORI:
3101                 pn533_pasori_fw_reset(dev);
3102
3103                 rc = pn533_set_configuration(dev, PN533_CFGITEM_PASORI,
3104                                              pasori_cfg, 3);
3105                 if (rc) {
3106                         nfc_err(&dev->interface->dev,
3107                                 "Error while settings PASORI config\n");
3108                         return rc;
3109                 }
3110
3111                 pn533_pasori_fw_reset(dev);
3112
3113                 break;
3114         }
3115
3116         return 0;
3117 }
3118
3119 static int pn533_probe(struct usb_interface *interface,
3120                         const struct usb_device_id *id)
3121 {
3122         struct pn533_fw_version fw_ver;
3123         struct pn533 *dev;
3124         struct usb_host_interface *iface_desc;
3125         struct usb_endpoint_descriptor *endpoint;
3126         int in_endpoint = 0;
3127         int out_endpoint = 0;
3128         int rc = -ENOMEM;
3129         int i;
3130         u32 protocols;
3131
3132         dev = kzalloc(sizeof(*dev), GFP_KERNEL);
3133         if (!dev)
3134                 return -ENOMEM;
3135
3136         dev->udev = usb_get_dev(interface_to_usbdev(interface));
3137         dev->interface = interface;
3138         mutex_init(&dev->cmd_lock);
3139
3140         iface_desc = interface->cur_altsetting;
3141         for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
3142                 endpoint = &iface_desc->endpoint[i].desc;
3143
3144                 if (!in_endpoint && usb_endpoint_is_bulk_in(endpoint))
3145                         in_endpoint = endpoint->bEndpointAddress;
3146
3147                 if (!out_endpoint && usb_endpoint_is_bulk_out(endpoint))
3148                         out_endpoint = endpoint->bEndpointAddress;
3149         }
3150
3151         if (!in_endpoint || !out_endpoint) {
3152                 nfc_err(&interface->dev,
3153                         "Could not find bulk-in or bulk-out endpoint\n");
3154                 rc = -ENODEV;
3155                 goto error;
3156         }
3157
3158         dev->in_urb = usb_alloc_urb(0, GFP_KERNEL);
3159         dev->out_urb = usb_alloc_urb(0, GFP_KERNEL);
3160
3161         if (!dev->in_urb || !dev->out_urb)
3162                 goto error;
3163
3164         usb_fill_bulk_urb(dev->in_urb, dev->udev,
3165                           usb_rcvbulkpipe(dev->udev, in_endpoint),
3166                           NULL, 0, NULL, dev);
3167         usb_fill_bulk_urb(dev->out_urb, dev->udev,
3168                           usb_sndbulkpipe(dev->udev, out_endpoint),
3169                           NULL, 0, pn533_send_complete, dev);
3170
3171         INIT_WORK(&dev->cmd_work, pn533_wq_cmd);
3172         INIT_WORK(&dev->cmd_complete_work, pn533_wq_cmd_complete);
3173         INIT_WORK(&dev->mi_rx_work, pn533_wq_mi_recv);
3174         INIT_WORK(&dev->mi_tx_work, pn533_wq_mi_send);
3175         INIT_WORK(&dev->tg_work, pn533_wq_tg_get_data);
3176         INIT_WORK(&dev->mi_tm_rx_work, pn533_wq_tm_mi_recv);
3177         INIT_WORK(&dev->mi_tm_tx_work, pn533_wq_tm_mi_send);
3178         INIT_DELAYED_WORK(&dev->poll_work, pn533_wq_poll);
3179         INIT_WORK(&dev->rf_work, pn533_wq_rf);
3180         dev->wq = alloc_ordered_workqueue("pn533", 0);
3181         if (dev->wq == NULL)
3182                 goto error;
3183
3184         init_timer(&dev->listen_timer);
3185         dev->listen_timer.data = (unsigned long) dev;
3186         dev->listen_timer.function = pn533_listen_mode_timer;
3187
3188         skb_queue_head_init(&dev->resp_q);
3189         skb_queue_head_init(&dev->fragment_skb);
3190
3191         INIT_LIST_HEAD(&dev->cmd_queue);
3192
3193         usb_set_intfdata(interface, dev);
3194
3195         dev->ops = &pn533_std_frame_ops;
3196
3197         dev->protocol_type = PN533_PROTO_REQ_ACK_RESP;
3198         dev->device_type = id->driver_info;
3199         switch (dev->device_type) {
3200         case PN533_DEVICE_STD:
3201                 protocols = PN533_ALL_PROTOCOLS;
3202                 break;
3203
3204         case PN533_DEVICE_PASORI:
3205                 protocols = PN533_NO_TYPE_B_PROTOCOLS;
3206                 break;
3207
3208         case PN533_DEVICE_ACR122U:
3209                 protocols = PN533_NO_TYPE_B_PROTOCOLS;
3210                 dev->ops = &pn533_acr122_frame_ops;
3211                 dev->protocol_type = PN533_PROTO_REQ_RESP,
3212
3213                 rc = pn533_acr122_poweron_rdr(dev);
3214                 if (rc < 0) {
3215                         nfc_err(&dev->interface->dev,
3216                                 "Couldn't poweron the reader (error %d)\n", rc);
3217                         goto destroy_wq;
3218                 }
3219                 break;
3220
3221         default:
3222                 nfc_err(&dev->interface->dev, "Unknown device type %d\n",
3223                         dev->device_type);
3224                 rc = -EINVAL;
3225                 goto destroy_wq;
3226         }
3227
3228         memset(&fw_ver, 0, sizeof(fw_ver));
3229         rc = pn533_get_firmware_version(dev, &fw_ver);
3230         if (rc < 0)
3231                 goto destroy_wq;
3232
3233         nfc_info(&dev->interface->dev,
3234                  "NXP PN5%02X firmware ver %d.%d now attached\n",
3235                  fw_ver.ic, fw_ver.ver, fw_ver.rev);
3236
3237
3238         dev->nfc_dev = nfc_allocate_device(&pn533_nfc_ops, protocols,
3239                                            dev->ops->tx_header_len +
3240                                            PN533_CMD_DATAEXCH_HEAD_LEN,
3241                                            dev->ops->tx_tail_len);
3242         if (!dev->nfc_dev) {
3243                 rc = -ENOMEM;
3244                 goto destroy_wq;
3245         }
3246
3247         nfc_set_parent_dev(dev->nfc_dev, &interface->dev);
3248         nfc_set_drvdata(dev->nfc_dev, dev);
3249
3250         rc = nfc_register_device(dev->nfc_dev);
3251         if (rc)
3252                 goto free_nfc_dev;
3253
3254         rc = pn533_setup(dev);
3255         if (rc)
3256                 goto unregister_nfc_dev;
3257
3258         return 0;
3259
3260 unregister_nfc_dev:
3261         nfc_unregister_device(dev->nfc_dev);
3262
3263 free_nfc_dev:
3264         nfc_free_device(dev->nfc_dev);
3265
3266 destroy_wq:
3267         destroy_workqueue(dev->wq);
3268 error:
3269         usb_free_urb(dev->in_urb);
3270         usb_free_urb(dev->out_urb);
3271         usb_put_dev(dev->udev);
3272         kfree(dev);
3273         return rc;
3274 }
3275
3276 static void pn533_disconnect(struct usb_interface *interface)
3277 {
3278         struct pn533 *dev;
3279         struct pn533_cmd *cmd, *n;
3280
3281         dev = usb_get_intfdata(interface);
3282         usb_set_intfdata(interface, NULL);
3283
3284         nfc_unregister_device(dev->nfc_dev);
3285         nfc_free_device(dev->nfc_dev);
3286
3287         usb_kill_urb(dev->in_urb);
3288         usb_kill_urb(dev->out_urb);
3289
3290         flush_delayed_work(&dev->poll_work);
3291         destroy_workqueue(dev->wq);
3292
3293         skb_queue_purge(&dev->resp_q);
3294
3295         del_timer(&dev->listen_timer);
3296
3297         list_for_each_entry_safe(cmd, n, &dev->cmd_queue, queue) {
3298                 list_del(&cmd->queue);
3299                 kfree(cmd);
3300         }
3301
3302         usb_free_urb(dev->in_urb);
3303         usb_free_urb(dev->out_urb);
3304         kfree(dev);
3305
3306         nfc_info(&interface->dev, "NXP PN533 NFC device disconnected\n");
3307 }
3308
3309 static struct usb_driver pn533_driver = {
3310         .name =         "pn533",
3311         .probe =        pn533_probe,
3312         .disconnect =   pn533_disconnect,
3313         .id_table =     pn533_table,
3314 };
3315
3316 module_usb_driver(pn533_driver);
3317
3318 MODULE_AUTHOR("Lauro Ramos Venancio <lauro.venancio@openbossa.org>");
3319 MODULE_AUTHOR("Aloisio Almeida Jr <aloisio.almeida@openbossa.org>");
3320 MODULE_AUTHOR("Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>");
3321 MODULE_DESCRIPTION("PN533 usb driver ver " VERSION);
3322 MODULE_VERSION(VERSION);
3323 MODULE_LICENSE("GPL");