drivers/nfc/pn533.c

   1 /*
   2  * Copyright (C) 2011 Instituto Nokia de Tecnologia
   3  * Copyright (C) 2012-2013 Tieto Poland
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License as published by
   7  * the Free Software Foundation; either version 2 of the License, or
   8  * (at your option) any later version.
   9  *
  10  * This program is distributed in the hope that it will be useful,
  11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  13  * GNU General Public License for more details.
  14  *
  15  * You should have received a copy of the GNU General Public License
  16  * along with this program; if not, write to the
  17  * Free Software Foundation, Inc.,
  18  * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
  19  */
  20
  21 #include <linux/device.h>
  22 #include <linux/kernel.h>
  23 #include <linux/module.h>
  24 #include <linux/slab.h>
  25 #include <linux/usb.h>
  26 #include <linux/nfc.h>
  27 #include <linux/netdevice.h>
  28 #include <net/nfc/nfc.h>
  29
  30 #define VERSION "0.2"
  31
  32 #define PN533_VENDOR_ID 0x4CC
  33 #define PN533_PRODUCT_ID 0x2533
  34
  35 #define SCM_VENDOR_ID 0x4E6
  36 #define SCL3711_PRODUCT_ID 0x5591
  37
  38 #define SONY_VENDOR_ID         0x054c
  39 #define PASORI_PRODUCT_ID      0x02e1
  40
  41 #define ACS_VENDOR_ID 0x072f
  42 #define ACR122U_PRODUCT_ID 0x2200
  43
  44 #define PN533_DEVICE_STD     0x1
  45 #define PN533_DEVICE_PASORI  0x2
  46 #define PN533_DEVICE_ACR122U 0x3
  47
  48 #define PN533_ALL_PROTOCOLS (NFC_PROTO_JEWEL_MASK | NFC_PROTO_MIFARE_MASK |\
  49                              NFC_PROTO_FELICA_MASK | NFC_PROTO_ISO14443_MASK |\
  50                              NFC_PROTO_NFC_DEP_MASK |\
  51                              NFC_PROTO_ISO14443_B_MASK)
  52
  53 #define PN533_NO_TYPE_B_PROTOCOLS (NFC_PROTO_JEWEL_MASK | \
  54                                    NFC_PROTO_MIFARE_MASK | \
  55                                    NFC_PROTO_FELICA_MASK | \
  56                                    NFC_PROTO_ISO14443_MASK | \
  57                                    NFC_PROTO_NFC_DEP_MASK)
  58
  59 static const struct usb_device_id pn533_table[] = {
  60         { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE,
  61           .idVendor             = PN533_VENDOR_ID,
  62           .idProduct            = PN533_PRODUCT_ID,
  63           .driver_info          = PN533_DEVICE_STD,
  64         },
  65         { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE,
  66           .idVendor             = SCM_VENDOR_ID,
  67           .idProduct            = SCL3711_PRODUCT_ID,
  68           .driver_info          = PN533_DEVICE_STD,
  69         },
  70         { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE,
  71           .idVendor             = SONY_VENDOR_ID,
  72           .idProduct            = PASORI_PRODUCT_ID,
  73           .driver_info          = PN533_DEVICE_PASORI,
  74         },
  75         { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE,
  76           .idVendor             = ACS_VENDOR_ID,
  77           .idProduct            = ACR122U_PRODUCT_ID,
  78           .driver_info          = PN533_DEVICE_ACR122U,
  79         },
  80         { }
  81 };
  82 MODULE_DEVICE_TABLE(usb, pn533_table);
  83
  84 /* How much time we spend listening for initiators */
  85 #define PN533_LISTEN_TIME 2
  86 /* Delay between each poll frame (ms) */
  87 #define PN533_POLL_INTERVAL 10
  88
  89 /* Standard pn533 frame definitions (standard and extended)*/
  90 #define PN533_STD_FRAME_HEADER_LEN (sizeof(struct pn533_std_frame) \
  91                                         + 2) /* data[0] TFI, data[1] CC */
  92 #define PN533_STD_FRAME_TAIL_LEN 2 /* data[len] DCS, data[len + 1] postamble*/
  93
  94 #define PN533_EXT_FRAME_HEADER_LEN (sizeof(struct pn533_ext_frame) \
  95                                         + 2) /* data[0] TFI, data[1] CC */
  96
  97 #define PN533_CMD_DATAEXCH_DATA_MAXLEN  262
  98 #define PN533_CMD_DATAFRAME_MAXLEN      240     /* max data length (send) */
  99
 100 /*
 101  * Max extended frame payload len, excluding TFI and CC
 102  * which are already in PN533_FRAME_HEADER_LEN.
 103  */
 104 #define PN533_STD_FRAME_MAX_PAYLOAD_LEN 263
 105
 106 #define PN533_STD_FRAME_ACK_SIZE 6 /* Preamble (1), SoPC (2), ACK Code (2),
 107                                   Postamble (1) */
 108 #define PN533_STD_FRAME_CHECKSUM(f) (f->data[f->datalen])
 109 #define PN533_STD_FRAME_POSTAMBLE(f) (f->data[f->datalen + 1])
 110 /* Half start code (3), LEN (4) should be 0xffff for extended frame */
 111 #define PN533_STD_IS_EXTENDED(hdr) ((hdr)->datalen == 0xFF \
 112                                         && (hdr)->datalen_checksum == 0xFF)
 113 #define PN533_EXT_FRAME_CHECKSUM(f) (f->data[be16_to_cpu(f->datalen)])
 114
 115 /* start of frame */
 116 #define PN533_STD_FRAME_SOF 0x00FF
 117
 118 /* standard frame identifier: in/out/error */
 119 #define PN533_STD_FRAME_IDENTIFIER(f) (f->data[0]) /* TFI */
 120 #define PN533_STD_FRAME_DIR_OUT 0xD4
 121 #define PN533_STD_FRAME_DIR_IN 0xD5
 122
 123 /* ACS ACR122 pn533 frame definitions */
 124 #define PN533_ACR122_TX_FRAME_HEADER_LEN (sizeof(struct pn533_acr122_tx_frame) \
 125                                           + 2)
 126 #define PN533_ACR122_TX_FRAME_TAIL_LEN 0
 127 #define PN533_ACR122_RX_FRAME_HEADER_LEN (sizeof(struct pn533_acr122_rx_frame) \
 128                                           + 2)
 129 #define PN533_ACR122_RX_FRAME_TAIL_LEN 2
 130 #define PN533_ACR122_FRAME_MAX_PAYLOAD_LEN PN533_STD_FRAME_MAX_PAYLOAD_LEN
 131
 132 /* CCID messages types */
 133 #define PN533_ACR122_PC_TO_RDR_ICCPOWERON 0x62
 134 #define PN533_ACR122_PC_TO_RDR_ESCAPE 0x6B
 135
 136 #define PN533_ACR122_RDR_TO_PC_ESCAPE 0x83
 137
 138 /* PN533 Commands */
 139 #define PN533_FRAME_CMD(f) (f->data[1])
 140
 141 #define PN533_CMD_GET_FIRMWARE_VERSION 0x02
 142 #define PN533_CMD_RF_CONFIGURATION 0x32
 143 #define PN533_CMD_IN_DATA_EXCHANGE 0x40
 144 #define PN533_CMD_IN_COMM_THRU     0x42
 145 #define PN533_CMD_IN_LIST_PASSIVE_TARGET 0x4A
 146 #define PN533_CMD_IN_ATR 0x50
 147 #define PN533_CMD_IN_RELEASE 0x52
 148 #define PN533_CMD_IN_JUMP_FOR_DEP 0x56
 149
 150 #define PN533_CMD_TG_INIT_AS_TARGET 0x8c
 151 #define PN533_CMD_TG_GET_DATA 0x86
 152 #define PN533_CMD_TG_SET_DATA 0x8e
 153 #define PN533_CMD_TG_SET_META_DATA 0x94
 154 #define PN533_CMD_UNDEF 0xff
 155
 156 #define PN533_CMD_RESPONSE(cmd) (cmd + 1)
 157
 158 /* PN533 Return codes */
 159 #define PN533_CMD_RET_MASK 0x3F
 160 #define PN533_CMD_MI_MASK 0x40
 161 #define PN533_CMD_RET_SUCCESS 0x00
 162
 163 struct pn533;
 164
 165 typedef int (*pn533_send_async_complete_t) (struct pn533 *dev, void *arg,
 166                                         struct sk_buff *resp);
 167
 168 /* structs for pn533 commands */
 169
 170 /* PN533_CMD_GET_FIRMWARE_VERSION */
 171 struct pn533_fw_version {
 172         u8 ic;
 173         u8 ver;
 174         u8 rev;
 175         u8 support;
 176 };
 177
 178 /* PN533_CMD_RF_CONFIGURATION */
 179 #define PN533_CFGITEM_RF_FIELD    0x01
 180 #define PN533_CFGITEM_TIMING      0x02
 181 #define PN533_CFGITEM_MAX_RETRIES 0x05
 182 #define PN533_CFGITEM_PASORI      0x82
 183
 184 #define PN533_CFGITEM_RF_FIELD_AUTO_RFCA 0x2
 185 #define PN533_CFGITEM_RF_FIELD_ON        0x1
 186 #define PN533_CFGITEM_RF_FIELD_OFF       0x0
 187
 188 #define PN533_CONFIG_TIMING_102 0xb
 189 #define PN533_CONFIG_TIMING_204 0xc
 190 #define PN533_CONFIG_TIMING_409 0xd
 191 #define PN533_CONFIG_TIMING_819 0xe
 192
 193 #define PN533_CONFIG_MAX_RETRIES_NO_RETRY 0x00
 194 #define PN533_CONFIG_MAX_RETRIES_ENDLESS 0xFF
 195
 196 struct pn533_config_max_retries {
 197         u8 mx_rty_atr;
 198         u8 mx_rty_psl;
 199         u8 mx_rty_passive_act;
 200 } __packed;
 201
 202 struct pn533_config_timing {
 203         u8 rfu;
 204         u8 atr_res_timeout;
 205         u8 dep_timeout;
 206 } __packed;
 207
 208 /* PN533_CMD_IN_LIST_PASSIVE_TARGET */
 209
 210 /* felica commands opcode */
 211 #define PN533_FELICA_OPC_SENSF_REQ 0
 212 #define PN533_FELICA_OPC_SENSF_RES 1
 213 /* felica SENSF_REQ parameters */
 214 #define PN533_FELICA_SENSF_SC_ALL 0xFFFF
 215 #define PN533_FELICA_SENSF_RC_NO_SYSTEM_CODE 0
 216 #define PN533_FELICA_SENSF_RC_SYSTEM_CODE 1
 217 #define PN533_FELICA_SENSF_RC_ADVANCED_PROTOCOL 2
 218
 219 /* type B initiator_data values */
 220 #define PN533_TYPE_B_AFI_ALL_FAMILIES 0
 221 #define PN533_TYPE_B_POLL_METHOD_TIMESLOT 0
 222 #define PN533_TYPE_B_POLL_METHOD_PROBABILISTIC 1
 223
 224 union pn533_cmd_poll_initdata {
 225         struct {
 226                 u8 afi;
 227                 u8 polling_method;
 228         } __packed type_b;
 229         struct {
 230                 u8 opcode;
 231                 __be16 sc;
 232                 u8 rc;
 233                 u8 tsn;
 234         } __packed felica;
 235 };
 236
 237 /* Poll modulations */
 238 enum {
 239         PN533_POLL_MOD_106KBPS_A,
 240         PN533_POLL_MOD_212KBPS_FELICA,
 241         PN533_POLL_MOD_424KBPS_FELICA,
 242         PN533_POLL_MOD_106KBPS_JEWEL,
 243         PN533_POLL_MOD_847KBPS_B,
 244         PN533_LISTEN_MOD,
 245
 246         __PN533_POLL_MOD_AFTER_LAST,
 247 };
 248 #define PN533_POLL_MOD_MAX (__PN533_POLL_MOD_AFTER_LAST - 1)
 249
 250 struct pn533_poll_modulations {
 251         struct {
 252                 u8 maxtg;
 253                 u8 brty;
 254                 union pn533_cmd_poll_initdata initiator_data;
 255         } __packed data;
 256         u8 len;
 257 };
 258
 259 static const struct pn533_poll_modulations poll_mod[] = {
 260         [PN533_POLL_MOD_106KBPS_A] = {
 261                 .data = {
 262                         .maxtg = 1,
 263                         .brty = 0,
 264                 },
 265                 .len = 2,
 266         },
 267         [PN533_POLL_MOD_212KBPS_FELICA] = {
 268                 .data = {
 269                         .maxtg = 1,
 270                         .brty = 1,
 271                         .initiator_data.felica = {
 272                                 .opcode = PN533_FELICA_OPC_SENSF_REQ,
 273                                 .sc = PN533_FELICA_SENSF_SC_ALL,
 274                                 .rc = PN533_FELICA_SENSF_RC_SYSTEM_CODE,
 275                                 .tsn = 0x03,
 276                         },
 277                 },
 278                 .len = 7,
 279         },
 280         [PN533_POLL_MOD_424KBPS_FELICA] = {
 281                 .data = {
 282                         .maxtg = 1,
 283                         .brty = 2,
 284                         .initiator_data.felica = {
 285                                 .opcode = PN533_FELICA_OPC_SENSF_REQ,
 286                                 .sc = PN533_FELICA_SENSF_SC_ALL,
 287                                 .rc = PN533_FELICA_SENSF_RC_SYSTEM_CODE,
 288                                 .tsn = 0x03,
 289                         },
 290                  },
 291                 .len = 7,
 292         },
 293         [PN533_POLL_MOD_106KBPS_JEWEL] = {
 294                 .data = {
 295                         .maxtg = 1,
 296                         .brty = 4,
 297                 },
 298                 .len = 2,
 299         },
 300         [PN533_POLL_MOD_847KBPS_B] = {
 301                 .data = {
 302                         .maxtg = 1,
 303                         .brty = 8,
 304                         .initiator_data.type_b = {
 305                                 .afi = PN533_TYPE_B_AFI_ALL_FAMILIES,
 306                                 .polling_method =
 307                                         PN533_TYPE_B_POLL_METHOD_TIMESLOT,
 308                         },
 309                 },
 310                 .len = 3,
 311         },
 312         [PN533_LISTEN_MOD] = {
 313                 .len = 0,
 314         },
 315 };
 316
 317 /* PN533_CMD_IN_ATR */
 318
 319 struct pn533_cmd_activate_response {
 320         u8 status;
 321         u8 nfcid3t[10];
 322         u8 didt;
 323         u8 bst;
 324         u8 brt;
 325         u8 to;
 326         u8 ppt;
 327         /* optional */
 328         u8 gt[];
 329 } __packed;
 330
 331 struct pn533_cmd_jump_dep_response {
 332         u8 status;
 333         u8 tg;
 334         u8 nfcid3t[10];
 335         u8 didt;
 336         u8 bst;
 337         u8 brt;
 338         u8 to;
 339         u8 ppt;
 340         /* optional */
 341         u8 gt[];
 342 } __packed;
 343
 344
 345 /* PN533_TG_INIT_AS_TARGET */
 346 #define PN533_INIT_TARGET_PASSIVE 0x1
 347 #define PN533_INIT_TARGET_DEP 0x2
 348
 349 #define PN533_INIT_TARGET_RESP_FRAME_MASK 0x3
 350 #define PN533_INIT_TARGET_RESP_ACTIVE     0x1
 351 #define PN533_INIT_TARGET_RESP_DEP        0x4
 352
 353 enum  pn533_protocol_type {
 354         PN533_PROTO_REQ_ACK_RESP = 0,
 355         PN533_PROTO_REQ_RESP
 356 };
 357
 358 struct pn533 {
 359         struct usb_device *udev;
 360         struct usb_interface *interface;
 361         struct nfc_dev *nfc_dev;
 362         u32 device_type;
 363         enum pn533_protocol_type protocol_type;
 364
 365         struct urb *out_urb;
 366         struct urb *in_urb;
 367
 368         struct sk_buff_head resp_q;
 369         struct sk_buff_head fragment_skb;
 370
 371         struct workqueue_struct *wq;
 372         struct work_struct cmd_work;
 373         struct work_struct cmd_complete_work;
 374         struct delayed_work poll_work;
 375         struct work_struct mi_rx_work;
 376         struct work_struct mi_tx_work;
 377         struct work_struct mi_tm_rx_work;
 378         struct work_struct mi_tm_tx_work;
 379         struct work_struct tg_work;
 380         struct work_struct rf_work;
 381
 382         struct list_head cmd_queue;
 383         struct pn533_cmd *cmd;
 384         u8 cmd_pending;
 385         struct mutex cmd_lock;  /* protects cmd queue */
 386
 387         void *cmd_complete_mi_arg;
 388         void *cmd_complete_dep_arg;
 389
 390         struct pn533_poll_modulations *poll_mod_active[PN533_POLL_MOD_MAX + 1];
 391         u8 poll_mod_count;
 392         u8 poll_mod_curr;
 393         u8 poll_dep;
 394         u32 poll_protocols;
 395         u32 listen_protocols;
 396         struct timer_list listen_timer;
 397         int cancel_listen;
 398
 399         u8 *gb;
 400         size_t gb_len;
 401
 402         u8 tgt_available_prots;
 403         u8 tgt_active_prot;
 404         u8 tgt_mode;
 405
 406         struct pn533_frame_ops *ops;
 407 };
 408
 409 struct pn533_cmd {
 410         struct list_head queue;
 411         u8 code;
 412         int status;
 413         struct sk_buff *req;
 414         struct sk_buff *resp;
 415         int resp_len;
 416         pn533_send_async_complete_t  complete_cb;
 417         void *complete_cb_context;
 418 };
 419
 420 struct pn533_std_frame {
 421         u8 preamble;
 422         __be16 start_frame;
 423         u8 datalen;
 424         u8 datalen_checksum;
 425         u8 data[];
 426 } __packed;
 427
 428 struct pn533_ext_frame {        /* Extended Information frame */
 429         u8 preamble;
 430         __be16 start_frame;
 431         __be16 eif_flag;        /* fixed to 0xFFFF */
 432         __be16 datalen;
 433         u8 datalen_checksum;
 434         u8 data[];
 435 } __packed;
 436
 437 struct pn533_frame_ops {
 438         void (*tx_frame_init)(void *frame, u8 cmd_code);
 439         void (*tx_frame_finish)(void *frame);
 440         void (*tx_update_payload_len)(void *frame, int len);
 441         int tx_header_len;
 442         int tx_tail_len;
 443
 444         bool (*rx_is_frame_valid)(void *frame, struct pn533 *dev);
 445         int (*rx_frame_size)(void *frame);
 446         int rx_header_len;
 447         int rx_tail_len;
 448
 449         int max_payload_len;
 450         u8 (*get_cmd_code)(void *frame);
 451 };
 452
 453 struct pn533_acr122_ccid_hdr {
 454         u8 type;
 455         u32 datalen;
 456         u8 slot;
 457         u8 seq;
 458         u8 params[3]; /* 3 msg specific bytes or status, error and 1 specific
 459                          byte for reposnse msg */
 460         u8 data[]; /* payload */
 461 } __packed;
 462
 463 struct pn533_acr122_apdu_hdr {
 464         u8 class;
 465         u8 ins;
 466         u8 p1;
 467         u8 p2;
 468 } __packed;
 469
 470 struct pn533_acr122_tx_frame {
 471         struct pn533_acr122_ccid_hdr ccid;
 472         struct pn533_acr122_apdu_hdr apdu;
 473         u8 datalen;
 474         u8 data[]; /* pn533 frame: TFI ... */
 475 } __packed;
 476
 477 struct pn533_acr122_rx_frame {
 478         struct pn533_acr122_ccid_hdr ccid;
 479         u8 data[]; /* pn533 frame : TFI ... */
 480 } __packed;
 481
 482 static void pn533_acr122_tx_frame_init(void *_frame, u8 cmd_code)
 483 {
 484         struct pn533_acr122_tx_frame *frame = _frame;
 485
 486         frame->ccid.type = PN533_ACR122_PC_TO_RDR_ESCAPE;
 487         frame->ccid.datalen = sizeof(frame->apdu) + 1; /* sizeof(apdu_hdr) +
 488                                                           sizeof(datalen) */
 489         frame->ccid.slot = 0;
 490         frame->ccid.seq = 0;
 491         frame->ccid.params[0] = 0;
 492         frame->ccid.params[1] = 0;
 493         frame->ccid.params[2] = 0;
 494
 495         frame->data[0] = PN533_STD_FRAME_DIR_OUT;
 496         frame->data[1] = cmd_code;
 497         frame->datalen = 2;  /* data[0] + data[1] */
 498
 499         frame->apdu.class = 0xFF;
 500         frame->apdu.ins = 0;
 501         frame->apdu.p1 = 0;
 502         frame->apdu.p2 = 0;
 503 }
 504
 505 static void pn533_acr122_tx_frame_finish(void *_frame)
 506 {
 507         struct pn533_acr122_tx_frame *frame = _frame;
 508
 509         frame->ccid.datalen += frame->datalen;
 510 }
 511
 512 static void pn533_acr122_tx_update_payload_len(void *_frame, int len)
 513 {
 514         struct pn533_acr122_tx_frame *frame = _frame;
 515
 516         frame->datalen += len;
 517 }
 518
 519 static bool pn533_acr122_is_rx_frame_valid(void *_frame, struct pn533 *dev)
 520 {
 521         struct pn533_acr122_rx_frame *frame = _frame;
 522
 523         if (frame->ccid.type != 0x83)
 524                 return false;
 525
 526         if (frame->data[frame->ccid.datalen - 2] == 0x63)
 527                 return false;
 528
 529         return true;
 530 }
 531
 532 static int pn533_acr122_rx_frame_size(void *frame)
 533 {
 534         struct pn533_acr122_rx_frame *f = frame;
 535
 536         /* f->ccid.datalen already includes tail length */
 537         return sizeof(struct pn533_acr122_rx_frame) + f->ccid.datalen;
 538 }
 539
 540 static u8 pn533_acr122_get_cmd_code(void *frame)
 541 {
 542         struct pn533_acr122_rx_frame *f = frame;
 543
 544         return PN533_FRAME_CMD(f);
 545 }
 546
 547 static struct pn533_frame_ops pn533_acr122_frame_ops = {
 548         .tx_frame_init = pn533_acr122_tx_frame_init,
 549         .tx_frame_finish = pn533_acr122_tx_frame_finish,
 550         .tx_update_payload_len = pn533_acr122_tx_update_payload_len,
 551         .tx_header_len = PN533_ACR122_TX_FRAME_HEADER_LEN,
 552         .tx_tail_len = PN533_ACR122_TX_FRAME_TAIL_LEN,
 553
 554         .rx_is_frame_valid = pn533_acr122_is_rx_frame_valid,
 555         .rx_header_len = PN533_ACR122_RX_FRAME_HEADER_LEN,
 556         .rx_tail_len = PN533_ACR122_RX_FRAME_TAIL_LEN,
 557         .rx_frame_size = pn533_acr122_rx_frame_size,
 558
 559         .max_payload_len = PN533_ACR122_FRAME_MAX_PAYLOAD_LEN,
 560         .get_cmd_code = pn533_acr122_get_cmd_code,
 561 };
 562
 563 /* The rule: value(high byte) + value(low byte) + checksum = 0 */
 564 static inline u8 pn533_ext_checksum(u16 value)
 565 {
 566         return ~(u8)(((value & 0xFF00) >> 8) + (u8)(value & 0xFF)) + 1;
 567 }
 568
 569 /* The rule: value + checksum = 0 */
 570 static inline u8 pn533_std_checksum(u8 value)
 571 {
 572         return ~value + 1;
 573 }
 574
 575 /* The rule: sum(data elements) + checksum = 0 */
 576 static u8 pn533_std_data_checksum(u8 *data, int datalen)
 577 {
 578         u8 sum = 0;
 579         int i;
 580
 581         for (i = 0; i < datalen; i++)
 582                 sum += data[i];
 583
 584         return pn533_std_checksum(sum);
 585 }
 586
 587 static void pn533_std_tx_frame_init(void *_frame, u8 cmd_code)
 588 {
 589         struct pn533_std_frame *frame = _frame;
 590
 591         frame->preamble = 0;
 592         frame->start_frame = cpu_to_be16(PN533_STD_FRAME_SOF);
 593         PN533_STD_FRAME_IDENTIFIER(frame) = PN533_STD_FRAME_DIR_OUT;
 594         PN533_FRAME_CMD(frame) = cmd_code;
 595         frame->datalen = 2;
 596 }
 597
 598 static void pn533_std_tx_frame_finish(void *_frame)
 599 {
 600         struct pn533_std_frame *frame = _frame;
 601
 602         frame->datalen_checksum = pn533_std_checksum(frame->datalen);
 603
 604         PN533_STD_FRAME_CHECKSUM(frame) =
 605                 pn533_std_data_checksum(frame->data, frame->datalen);
 606
 607         PN533_STD_FRAME_POSTAMBLE(frame) = 0;
 608 }
 609
 610 static void pn533_std_tx_update_payload_len(void *_frame, int len)
 611 {
 612         struct pn533_std_frame *frame = _frame;
 613
 614         frame->datalen += len;
 615 }
 616
 617 static bool pn533_std_rx_frame_is_valid(void *_frame, struct pn533 *dev)
 618 {
 619         u8 checksum;
 620         struct pn533_std_frame *stdf = _frame;
 621
 622         if (stdf->start_frame != cpu_to_be16(PN533_STD_FRAME_SOF))
 623                 return false;
 624
 625         if (likely(!PN533_STD_IS_EXTENDED(stdf))) {
 626                 /* Standard frame code */
 627                 dev->ops->rx_header_len = PN533_STD_FRAME_HEADER_LEN;
 628
 629                 checksum = pn533_std_checksum(stdf->datalen);
 630                 if (checksum != stdf->datalen_checksum)
 631                         return false;
 632
 633                 checksum = pn533_std_data_checksum(stdf->data, stdf->datalen);
 634                 if (checksum != PN533_STD_FRAME_CHECKSUM(stdf))
 635                         return false;
 636         } else {
 637                 /* Extended */
 638                 struct pn533_ext_frame *eif = _frame;
 639
 640                 dev->ops->rx_header_len = PN533_EXT_FRAME_HEADER_LEN;
 641
 642                 checksum = pn533_ext_checksum(be16_to_cpu(eif->datalen));
 643                 if (checksum != eif->datalen_checksum)
 644                         return false;
 645
 646                 /* check data checksum */
 647                 checksum = pn533_std_data_checksum(eif->data,
 648                                                    be16_to_cpu(eif->datalen));
 649                 if (checksum != PN533_EXT_FRAME_CHECKSUM(eif))
 650                         return false;
 651         }
 652
 653         return true;
 654 }
 655
 656 static bool pn533_std_rx_frame_is_ack(struct pn533_std_frame *frame)
 657 {
 658         if (frame->start_frame != cpu_to_be16(PN533_STD_FRAME_SOF))
 659                 return false;
 660
 661         if (frame->datalen != 0 || frame->datalen_checksum != 0xFF)
 662                 return false;
 663
 664         return true;
 665 }
 666
 667 static inline int pn533_std_rx_frame_size(void *frame)
 668 {
 669         struct pn533_std_frame *f = frame;
 670
 671         /* check for Extended Information frame */
 672         if (PN533_STD_IS_EXTENDED(f)) {
 673                 struct pn533_ext_frame *eif = frame;
 674
 675                 return sizeof(struct pn533_ext_frame)
 676                         + be16_to_cpu(eif->datalen) + PN533_STD_FRAME_TAIL_LEN;
 677         }
 678
 679         return sizeof(struct pn533_std_frame) + f->datalen +
 680                PN533_STD_FRAME_TAIL_LEN;
 681 }
 682
 683 static u8 pn533_std_get_cmd_code(void *frame)
 684 {
 685         struct pn533_std_frame *f = frame;
 686         struct pn533_ext_frame *eif = frame;
 687
 688         if (PN533_STD_IS_EXTENDED(f))
 689                 return PN533_FRAME_CMD(eif);
 690         else
 691                 return PN533_FRAME_CMD(f);
 692 }
 693
 694 static struct pn533_frame_ops pn533_std_frame_ops = {
 695         .tx_frame_init = pn533_std_tx_frame_init,
 696         .tx_frame_finish = pn533_std_tx_frame_finish,
 697         .tx_update_payload_len = pn533_std_tx_update_payload_len,
 698         .tx_header_len = PN533_STD_FRAME_HEADER_LEN,
 699         .tx_tail_len = PN533_STD_FRAME_TAIL_LEN,
 700
 701         .rx_is_frame_valid = pn533_std_rx_frame_is_valid,
 702         .rx_frame_size = pn533_std_rx_frame_size,
 703         .rx_header_len = PN533_STD_FRAME_HEADER_LEN,
 704         .rx_tail_len = PN533_STD_FRAME_TAIL_LEN,
 705
 706         .max_payload_len =  PN533_STD_FRAME_MAX_PAYLOAD_LEN,
 707         .get_cmd_code = pn533_std_get_cmd_code,
 708 };
 709
 710 static bool pn533_rx_frame_is_cmd_response(struct pn533 *dev, void *frame)
 711 {
 712         return (dev->ops->get_cmd_code(frame) ==
 713                                 PN533_CMD_RESPONSE(dev->cmd->code));
 714 }
 715
 716 static void pn533_recv_response(struct urb *urb)
 717 {
 718         struct pn533 *dev = urb->context;
 719         struct pn533_cmd *cmd = dev->cmd;
 720         u8 *in_frame;
 721
 722         cmd->status = urb->status;
 723
 724         switch (urb->status) {
 725         case 0:
 726                 break; /* success */
 727         case -ECONNRESET:
 728         case -ENOENT:
 729                 dev_dbg(&dev->interface->dev,
 730                         "The urb has been canceled (status %d)\n",
 731                         urb->status);
 732                 goto sched_wq;
 733         case -ESHUTDOWN:
 734         default:
 735                 nfc_err(&dev->interface->dev,
 736                         "Urb failure (status %d)\n", urb->status);
 737                 goto sched_wq;
 738         }
 739
 740         in_frame = dev->in_urb->transfer_buffer;
 741
 742         dev_dbg(&dev->interface->dev, "Received a frame\n");
 743         print_hex_dump_debug("PN533 RX: ", DUMP_PREFIX_NONE, 16, 1, in_frame,
 744                              dev->ops->rx_frame_size(in_frame), false);
 745
 746         if (!dev->ops->rx_is_frame_valid(in_frame, dev)) {
 747                 nfc_err(&dev->interface->dev, "Received an invalid frame\n");
 748                 cmd->status = -EIO;
 749                 goto sched_wq;
 750         }
 751
 752         if (!pn533_rx_frame_is_cmd_response(dev, in_frame)) {
 753                 nfc_err(&dev->interface->dev,
 754                         "It it not the response to the last command\n");
 755                 cmd->status = -EIO;
 756                 goto sched_wq;
 757         }
 758
 759 sched_wq:
 760         queue_work(dev->wq, &dev->cmd_complete_work);
 761 }
 762
 763 static int pn533_submit_urb_for_response(struct pn533 *dev, gfp_t flags)
 764 {
 765         dev->in_urb->complete = pn533_recv_response;
 766
 767         return usb_submit_urb(dev->in_urb, flags);
 768 }
 769
 770 static void pn533_recv_ack(struct urb *urb)
 771 {
 772         struct pn533 *dev = urb->context;
 773         struct pn533_cmd *cmd = dev->cmd;
 774         struct pn533_std_frame *in_frame;
 775         int rc;
 776
 777         cmd->status = urb->status;
 778
 779         switch (urb->status) {
 780         case 0:
 781                 break; /* success */
 782         case -ECONNRESET:
 783         case -ENOENT:
 784                 dev_dbg(&dev->interface->dev,
 785                         "The urb has been stopped (status %d)\n",
 786                         urb->status);
 787                 goto sched_wq;
 788         case -ESHUTDOWN:
 789         default:
 790                 nfc_err(&dev->interface->dev,
 791                         "Urb failure (status %d)\n", urb->status);
 792                 goto sched_wq;
 793         }
 794
 795         in_frame = dev->in_urb->transfer_buffer;
 796
 797         if (!pn533_std_rx_frame_is_ack(in_frame)) {
 798                 nfc_err(&dev->interface->dev, "Received an invalid ack\n");
 799                 cmd->status = -EIO;
 800                 goto sched_wq;
 801         }
 802
 803         rc = pn533_submit_urb_for_response(dev, GFP_ATOMIC);
 804         if (rc) {
 805                 nfc_err(&dev->interface->dev,
 806                         "usb_submit_urb failed with result %d\n", rc);
 807                 cmd->status = rc;
 808                 goto sched_wq;
 809         }
 810
 811         return;
 812
 813 sched_wq:
 814         queue_work(dev->wq, &dev->cmd_complete_work);
 815 }
 816
 817 static int pn533_submit_urb_for_ack(struct pn533 *dev, gfp_t flags)
 818 {
 819         dev->in_urb->complete = pn533_recv_ack;
 820
 821         return usb_submit_urb(dev->in_urb, flags);
 822 }
 823
 824 static int pn533_send_ack(struct pn533 *dev, gfp_t flags)
 825 {
 826         u8 ack[PN533_STD_FRAME_ACK_SIZE] = {0x00, 0x00, 0xff, 0x00, 0xff, 0x00};
 827         /* spec 7.1.1.3:  Preamble, SoPC (2), ACK Code (2), Postamble */
 828         int rc;
 829
 830         dev->out_urb->transfer_buffer = ack;
 831         dev->out_urb->transfer_buffer_length = sizeof(ack);
 832         rc = usb_submit_urb(dev->out_urb, flags);
 833
 834         return rc;
 835 }
 836
 837 static int __pn533_send_frame_async(struct pn533 *dev,
 838                                         struct sk_buff *out,
 839                                         struct sk_buff *in,
 840                                         int in_len)
 841 {
 842         int rc;
 843
 844         dev->out_urb->transfer_buffer = out->data;
 845         dev->out_urb->transfer_buffer_length = out->len;
 846
 847         dev->in_urb->transfer_buffer = in->data;
 848         dev->in_urb->transfer_buffer_length = in_len;
 849
 850         print_hex_dump_debug("PN533 TX: ", DUMP_PREFIX_NONE, 16, 1,
 851                              out->data, out->len, false);
 852
 853         rc = usb_submit_urb(dev->out_urb, GFP_KERNEL);
 854         if (rc)
 855                 return rc;
 856
 857         if (dev->protocol_type == PN533_PROTO_REQ_RESP) {
 858                 /* request for response for sent packet directly */
 859                 rc = pn533_submit_urb_for_response(dev, GFP_ATOMIC);
 860                 if (rc)
 861                         goto error;
 862         } else if (dev->protocol_type == PN533_PROTO_REQ_ACK_RESP) {
 863                 /* request for ACK if that's the case */
 864                 rc = pn533_submit_urb_for_ack(dev, GFP_KERNEL);
 865                 if (rc)
 866                         goto error;
 867         }
 868
 869         return 0;
 870
 871 error:
 872         usb_unlink_urb(dev->out_urb);
 873         return rc;
 874 }
 875
 876 static void pn533_build_cmd_frame(struct pn533 *dev, u8 cmd_code,
 877                                   struct sk_buff *skb)
 878 {
 879         /* payload is already there, just update datalen */
 880         int payload_len = skb->len;
 881         struct pn533_frame_ops *ops = dev->ops;
 882
 883
 884         skb_push(skb, ops->tx_header_len);
 885         skb_put(skb, ops->tx_tail_len);
 886
 887         ops->tx_frame_init(skb->data, cmd_code);
 888         ops->tx_update_payload_len(skb->data, payload_len);
 889         ops->tx_frame_finish(skb->data);
 890 }
 891
 892 static int pn533_send_async_complete(struct pn533 *dev)
 893 {
 894         struct pn533_cmd *cmd = dev->cmd;
 895         int status = cmd->status;
 896
 897         struct sk_buff *req = cmd->req;
 898         struct sk_buff *resp = cmd->resp;
 899
 900         int rc;
 901
 902         dev_kfree_skb(req);
 903
 904         if (status < 0) {
 905                 rc = cmd->complete_cb(dev, cmd->complete_cb_context,
 906                                       ERR_PTR(status));
 907                 dev_kfree_skb(resp);
 908                 goto done;
 909         }
 910
 911         skb_put(resp, dev->ops->rx_frame_size(resp->data));
 912         skb_pull(resp, dev->ops->rx_header_len);
 913         skb_trim(resp, resp->len - dev->ops->rx_tail_len);
 914
 915         rc = cmd->complete_cb(dev, cmd->complete_cb_context, resp);
 916
 917 done:
 918         kfree(cmd);
 919         dev->cmd = NULL;
 920         return rc;
 921 }
 922
 923 static int __pn533_send_async(struct pn533 *dev, u8 cmd_code,
 924                               struct sk_buff *req, struct sk_buff *resp,
 925                               int resp_len,
 926                               pn533_send_async_complete_t complete_cb,
 927                               void *complete_cb_context)
 928 {
 929         struct pn533_cmd *cmd;
 930         int rc = 0;
 931
 932         dev_dbg(&dev->interface->dev, "Sending command 0x%x\n", cmd_code);
 933
 934         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
 935         if (!cmd)
 936                 return -ENOMEM;
 937
 938         cmd->code = cmd_code;
 939         cmd->req = req;
 940         cmd->resp = resp;
 941         cmd->resp_len = resp_len;
 942         cmd->complete_cb = complete_cb;
 943         cmd->complete_cb_context = complete_cb_context;
 944
 945         pn533_build_cmd_frame(dev, cmd_code, req);
 946
 947         mutex_lock(&dev->cmd_lock);
 948
 949         if (!dev->cmd_pending) {
 950                 rc = __pn533_send_frame_async(dev, req, resp, resp_len);
 951                 if (rc)
 952                         goto error;
 953
 954                 dev->cmd_pending = 1;
 955                 dev->cmd = cmd;
 956                 goto unlock;
 957         }
 958
 959         dev_dbg(&dev->interface->dev, "%s Queueing command 0x%x\n",
 960                 __func__, cmd_code);
 961
 962         INIT_LIST_HEAD(&cmd->queue);
 963         list_add_tail(&cmd->queue, &dev->cmd_queue);
 964
 965         goto unlock;
 966
 967 error:
 968         kfree(cmd);
 969 unlock:
 970         mutex_unlock(&dev->cmd_lock);
 971         return rc;
 972 }
 973
 974 static int pn533_send_data_async(struct pn533 *dev, u8 cmd_code,
 975                                  struct sk_buff *req,
 976                                  pn533_send_async_complete_t complete_cb,
 977                                  void *complete_cb_context)
 978 {
 979         struct sk_buff *resp;
 980         int rc;
 981         int  resp_len = dev->ops->rx_header_len +
 982                         dev->ops->max_payload_len +
 983                         dev->ops->rx_tail_len;
 984
 985         resp = nfc_alloc_recv_skb(resp_len, GFP_KERNEL);
 986         if (!resp)
 987                 return -ENOMEM;
 988
 989         rc = __pn533_send_async(dev, cmd_code, req, resp, resp_len, complete_cb,
 990                                 complete_cb_context);
 991         if (rc)
 992                 dev_kfree_skb(resp);
 993
 994         return rc;
 995 }
 996
 997 static int pn533_send_cmd_async(struct pn533 *dev, u8 cmd_code,
 998                                 struct sk_buff *req,
 999                                 pn533_send_async_complete_t complete_cb,
1000                                 void *complete_cb_context)
1001 {
1002         struct sk_buff *resp;
1003         int rc;
1004         int  resp_len = dev->ops->rx_header_len +
1005                         dev->ops->max_payload_len +
1006                         dev->ops->rx_tail_len;
1007
1008         resp = alloc_skb(resp_len, GFP_KERNEL);
1009         if (!resp)
1010                 return -ENOMEM;
1011
1012         rc = __pn533_send_async(dev, cmd_code, req, resp, resp_len, complete_cb,
1013                                 complete_cb_context);
1014         if (rc)
1015                 dev_kfree_skb(resp);
1016
1017         return rc;
1018 }
1019
1020 /*
1021  * pn533_send_cmd_direct_async
1022  *
1023  * The function sends a piority cmd directly to the chip omiting the cmd
1024  * queue. It's intended to be used by chaining mechanism of received responses
1025  * where the host has to request every single chunk of data before scheduling
1026  * next cmd from the queue.
1027  */
1028 static int pn533_send_cmd_direct_async(struct pn533 *dev, u8 cmd_code,
1029                                        struct sk_buff *req,
1030                                        pn533_send_async_complete_t complete_cb,
1031                                        void *complete_cb_context)
1032 {
1033         struct sk_buff *resp;
1034         struct pn533_cmd *cmd;
1035         int rc;
1036         int resp_len = dev->ops->rx_header_len +
1037                        dev->ops->max_payload_len +
1038                        dev->ops->rx_tail_len;
1039
1040         resp = alloc_skb(resp_len, GFP_KERNEL);
1041         if (!resp)
1042                 return -ENOMEM;
1043
1044         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
1045         if (!cmd) {
1046                 dev_kfree_skb(resp);
1047                 return -ENOMEM;
1048         }
1049
1050         cmd->code = cmd_code;
1051         cmd->req = req;
1052         cmd->resp = resp;
1053         cmd->resp_len = resp_len;
1054         cmd->complete_cb = complete_cb;
1055         cmd->complete_cb_context = complete_cb_context;
1056
1057         pn533_build_cmd_frame(dev, cmd_code, req);
1058
1059         rc = __pn533_send_frame_async(dev, req, resp, resp_len);
1060         if (rc < 0) {
1061                 dev_kfree_skb(resp);
1062                 kfree(cmd);
1063         } else {
1064                 dev->cmd = cmd;
1065         }
1066
1067         return rc;
1068 }
1069
1070 static void pn533_wq_cmd_complete(struct work_struct *work)
1071 {
1072         struct pn533 *dev = container_of(work, struct pn533, cmd_complete_work);
1073         int rc;
1074
1075         rc = pn533_send_async_complete(dev);
1076         if (rc != -EINPROGRESS)
1077                 queue_work(dev->wq, &dev->cmd_work);
1078 }
1079
1080 static void pn533_wq_cmd(struct work_struct *work)
1081 {
1082         struct pn533 *dev = container_of(work, struct pn533, cmd_work);
1083         struct pn533_cmd *cmd;
1084         int rc;
1085
1086         mutex_lock(&dev->cmd_lock);
1087
1088         if (list_empty(&dev->cmd_queue)) {
1089                 dev->cmd_pending = 0;
1090                 mutex_unlock(&dev->cmd_lock);
1091                 return;
1092         }
1093
1094         cmd = list_first_entry(&dev->cmd_queue, struct pn533_cmd, queue);
1095
1096         list_del(&cmd->queue);
1097
1098         mutex_unlock(&dev->cmd_lock);
1099
1100         rc = __pn533_send_frame_async(dev, cmd->req, cmd->resp, cmd->resp_len);
1101         if (rc < 0) {
1102                 dev_kfree_skb(cmd->req);
1103                 dev_kfree_skb(cmd->resp);
1104                 kfree(cmd);
1105                 return;
1106         }
1107
1108         dev->cmd = cmd;
1109 }
1110
1111 struct pn533_sync_cmd_response {
1112         struct sk_buff *resp;
1113         struct completion done;
1114 };
1115
1116 static int pn533_send_sync_complete(struct pn533 *dev, void *_arg,
1117                                     struct sk_buff *resp)
1118 {
1119         struct pn533_sync_cmd_response *arg = _arg;
1120
1121         arg->resp = resp;
1122         complete(&arg->done);
1123
1124         return 0;
1125 }
1126
1127 /*  pn533_send_cmd_sync
1128  *
1129  *  Please note the req parameter is freed inside the function to
1130  *  limit a number of return value interpretations by the caller.
1131  *
1132  *  1. negative in case of error during TX path -> req should be freed
1133  *
1134  *  2. negative in case of error during RX path -> req should not be freed
1135  *     as it's been already freed at the begining of RX path by
1136  *     async_complete_cb.
1137  *
1138  *  3. valid pointer in case of succesfult RX path
1139  *
1140  *  A caller has to check a return value with IS_ERR macro. If the test pass,
1141  *  the returned pointer is valid.
1142  *
1143  * */
1144 static struct sk_buff *pn533_send_cmd_sync(struct pn533 *dev, u8 cmd_code,
1145                                                struct sk_buff *req)
1146 {
1147         int rc;
1148         struct pn533_sync_cmd_response arg;
1149
1150         init_completion(&arg.done);
1151
1152         rc = pn533_send_cmd_async(dev, cmd_code, req,
1153                                   pn533_send_sync_complete, &arg);
1154         if (rc) {
1155                 dev_kfree_skb(req);
1156                 return ERR_PTR(rc);
1157         }
1158
1159         wait_for_completion(&arg.done);
1160
1161         return arg.resp;
1162 }
1163
1164 static void pn533_send_complete(struct urb *urb)
1165 {
1166         struct pn533 *dev = urb->context;
1167
1168         switch (urb->status) {
1169         case 0:
1170                 break; /* success */
1171         case -ECONNRESET:
1172         case -ENOENT:
1173                 dev_dbg(&dev->interface->dev,
1174                         "The urb has been stopped (status %d)\n",
1175                         urb->status);
1176                 break;
1177         case -ESHUTDOWN:
1178         default:
1179                 nfc_err(&dev->interface->dev, "Urb failure (status %d)\n",
1180                         urb->status);
1181         }
1182 }
1183
1184 static void pn533_abort_cmd(struct pn533 *dev, gfp_t flags)
1185 {
1186         /* ACR122U does not support any command which aborts last
1187          * issued command i.e. as ACK for standard PN533. Additionally,
1188          * it behaves stange, sending broken or incorrect responses,
1189          * when we cancel urb before the chip will send response.
1190          */
1191         if (dev->device_type == PN533_DEVICE_ACR122U)
1192                 return;
1193
1194         /* An ack will cancel the last issued command */
1195         pn533_send_ack(dev, flags);
1196
1197         /* cancel the urb request */
1198         usb_kill_urb(dev->in_urb);
1199 }
1200
1201 static struct sk_buff *pn533_alloc_skb(struct pn533 *dev, unsigned int size)
1202 {
1203         struct sk_buff *skb;
1204
1205         skb = alloc_skb(dev->ops->tx_header_len +
1206                         size +
1207                         dev->ops->tx_tail_len, GFP_KERNEL);
1208
1209         if (skb)
1210                 skb_reserve(skb, dev->ops->tx_header_len);
1211
1212         return skb;
1213 }
1214
1215 struct pn533_target_type_a {
1216         __be16 sens_res;
1217         u8 sel_res;
1218         u8 nfcid_len;
1219         u8 nfcid_data[];
1220 } __packed;
1221
1222
1223 #define PN533_TYPE_A_SENS_RES_NFCID1(x) ((u8)((be16_to_cpu(x) & 0x00C0) >> 6))
1224 #define PN533_TYPE_A_SENS_RES_SSD(x) ((u8)((be16_to_cpu(x) & 0x001F) >> 0))
1225 #define PN533_TYPE_A_SENS_RES_PLATCONF(x) ((u8)((be16_to_cpu(x) & 0x0F00) >> 8))
1226
1227 #define PN533_TYPE_A_SENS_RES_SSD_JEWEL 0x00
1228 #define PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL 0x0C
1229
1230 #define PN533_TYPE_A_SEL_PROT(x) (((x) & 0x60) >> 5)
1231 #define PN533_TYPE_A_SEL_CASCADE(x) (((x) & 0x04) >> 2)
1232
1233 #define PN533_TYPE_A_SEL_PROT_MIFARE 0
1234 #define PN533_TYPE_A_SEL_PROT_ISO14443 1
1235 #define PN533_TYPE_A_SEL_PROT_DEP 2
1236 #define PN533_TYPE_A_SEL_PROT_ISO14443_DEP 3
1237
1238 static bool pn533_target_type_a_is_valid(struct pn533_target_type_a *type_a,
1239                                                         int target_data_len)
1240 {
1241         u8 ssd;
1242         u8 platconf;
1243
1244         if (target_data_len < sizeof(struct pn533_target_type_a))
1245                 return false;
1246
1247         /* The lenght check of nfcid[] and ats[] are not being performed because
1248            the values are not being used */
1249
1250         /* Requirement 4.6.3.3 from NFC Forum Digital Spec */
1251         ssd = PN533_TYPE_A_SENS_RES_SSD(type_a->sens_res);
1252         platconf = PN533_TYPE_A_SENS_RES_PLATCONF(type_a->sens_res);
1253
1254         if ((ssd == PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
1255              platconf != PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL) ||
1256             (ssd != PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
1257              platconf == PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL))
1258                 return false;
1259
1260         /* Requirements 4.8.2.1, 4.8.2.3, 4.8.2.5 and 4.8.2.7 from NFC Forum */
1261         if (PN533_TYPE_A_SEL_CASCADE(type_a->sel_res) != 0)
1262                 return false;
1263
1264         return true;
1265 }
1266
1267 static int pn533_target_found_type_a(struct nfc_target *nfc_tgt, u8 *tgt_data,
1268                                                         int tgt_data_len)
1269 {
1270         struct pn533_target_type_a *tgt_type_a;
1271
1272         tgt_type_a = (struct pn533_target_type_a *)tgt_data;
1273
1274         if (!pn533_target_type_a_is_valid(tgt_type_a, tgt_data_len))
1275                 return -EPROTO;
1276
1277         switch (PN533_TYPE_A_SEL_PROT(tgt_type_a->sel_res)) {
1278         case PN533_TYPE_A_SEL_PROT_MIFARE:
1279                 nfc_tgt->supported_protocols = NFC_PROTO_MIFARE_MASK;
1280                 break;
1281         case PN533_TYPE_A_SEL_PROT_ISO14443:
1282                 nfc_tgt->supported_protocols = NFC_PROTO_ISO14443_MASK;
1283                 break;
1284         case PN533_TYPE_A_SEL_PROT_DEP:
1285                 nfc_tgt->supported_protocols = NFC_PROTO_NFC_DEP_MASK;
1286                 break;
1287         case PN533_TYPE_A_SEL_PROT_ISO14443_DEP:
1288                 nfc_tgt->supported_protocols = NFC_PROTO_ISO14443_MASK |
1289                                                         NFC_PROTO_NFC_DEP_MASK;
1290                 break;
1291         }
1292
1293         nfc_tgt->sens_res = be16_to_cpu(tgt_type_a->sens_res);
1294         nfc_tgt->sel_res = tgt_type_a->sel_res;
1295         nfc_tgt->nfcid1_len = tgt_type_a->nfcid_len;
1296         memcpy(nfc_tgt->nfcid1, tgt_type_a->nfcid_data, nfc_tgt->nfcid1_len);
1297
1298         return 0;
1299 }
1300
1301 struct pn533_target_felica {
1302         u8 pol_res;
1303         u8 opcode;
1304         u8 nfcid2[NFC_NFCID2_MAXSIZE];
1305         u8 pad[8];
1306         /* optional */
1307         u8 syst_code[];
1308 } __packed;
1309
1310 #define PN533_FELICA_SENSF_NFCID2_DEP_B1 0x01
1311 #define PN533_FELICA_SENSF_NFCID2_DEP_B2 0xFE
1312
1313 static bool pn533_target_felica_is_valid(struct pn533_target_felica *felica,
1314                                                         int target_data_len)
1315 {
1316         if (target_data_len < sizeof(struct pn533_target_felica))
1317                 return false;
1318
1319         if (felica->opcode != PN533_FELICA_OPC_SENSF_RES)
1320                 return false;
1321
1322         return true;
1323 }
1324
1325 static int pn533_target_found_felica(struct nfc_target *nfc_tgt, u8 *tgt_data,
1326                                                         int tgt_data_len)
1327 {
1328         struct pn533_target_felica *tgt_felica;
1329
1330         tgt_felica = (struct pn533_target_felica *)tgt_data;
1331
1332         if (!pn533_target_felica_is_valid(tgt_felica, tgt_data_len))
1333                 return -EPROTO;
1334
1335         if ((tgt_felica->nfcid2[0] == PN533_FELICA_SENSF_NFCID2_DEP_B1) &&
1336             (tgt_felica->nfcid2[1] == PN533_FELICA_SENSF_NFCID2_DEP_B2))
1337                 nfc_tgt->supported_protocols = NFC_PROTO_NFC_DEP_MASK;
1338         else
1339                 nfc_tgt->supported_protocols = NFC_PROTO_FELICA_MASK;
1340
1341         memcpy(nfc_tgt->sensf_res, &tgt_felica->opcode, 9);
1342         nfc_tgt->sensf_res_len = 9;
1343
1344         memcpy(nfc_tgt->nfcid2, tgt_felica->nfcid2, NFC_NFCID2_MAXSIZE);
1345         nfc_tgt->nfcid2_len = NFC_NFCID2_MAXSIZE;
1346
1347         return 0;
1348 }
1349
1350 struct pn533_target_jewel {
1351         __be16 sens_res;
1352         u8 jewelid[4];
1353 } __packed;
1354
1355 static bool pn533_target_jewel_is_valid(struct pn533_target_jewel *jewel,
1356                                                         int target_data_len)
1357 {
1358         u8 ssd;
1359         u8 platconf;
1360
1361         if (target_data_len < sizeof(struct pn533_target_jewel))
1362                 return false;
1363
1364         /* Requirement 4.6.3.3 from NFC Forum Digital Spec */
1365         ssd = PN533_TYPE_A_SENS_RES_SSD(jewel->sens_res);
1366         platconf = PN533_TYPE_A_SENS_RES_PLATCONF(jewel->sens_res);
1367
1368         if ((ssd == PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
1369              platconf != PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL) ||
1370             (ssd != PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
1371              platconf == PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL))
1372                 return false;
1373
1374         return true;
1375 }
1376
1377 static int pn533_target_found_jewel(struct nfc_target *nfc_tgt, u8 *tgt_data,
1378                                                         int tgt_data_len)
1379 {
1380         struct pn533_target_jewel *tgt_jewel;
1381
1382         tgt_jewel = (struct pn533_target_jewel *)tgt_data;
1383
1384         if (!pn533_target_jewel_is_valid(tgt_jewel, tgt_data_len))
1385                 return -EPROTO;
1386
1387         nfc_tgt->supported_protocols = NFC_PROTO_JEWEL_MASK;
1388         nfc_tgt->sens_res = be16_to_cpu(tgt_jewel->sens_res);
1389         nfc_tgt->nfcid1_len = 4;
1390         memcpy(nfc_tgt->nfcid1, tgt_jewel->jewelid, nfc_tgt->nfcid1_len);
1391
1392         return 0;
1393 }
1394
1395 struct pn533_type_b_prot_info {
1396         u8 bitrate;
1397         u8 fsci_type;
1398         u8 fwi_adc_fo;
1399 } __packed;
1400
1401 #define PN533_TYPE_B_PROT_FCSI(x) (((x) & 0xF0) >> 4)
1402 #define PN533_TYPE_B_PROT_TYPE(x) (((x) & 0x0F) >> 0)
1403 #define PN533_TYPE_B_PROT_TYPE_RFU_MASK 0x8
1404
1405 struct pn533_type_b_sens_res {
1406         u8 opcode;
1407         u8 nfcid[4];
1408         u8 appdata[4];
1409         struct pn533_type_b_prot_info prot_info;
1410 } __packed;
1411
1412 #define PN533_TYPE_B_OPC_SENSB_RES 0x50
1413
1414 struct pn533_target_type_b {
1415         struct pn533_type_b_sens_res sensb_res;
1416         u8 attrib_res_len;
1417         u8 attrib_res[];
1418 } __packed;
1419
1420 static bool pn533_target_type_b_is_valid(struct pn533_target_type_b *type_b,
1421                                                         int target_data_len)
1422 {
1423         if (target_data_len < sizeof(struct pn533_target_type_b))
1424                 return false;
1425
1426         if (type_b->sensb_res.opcode != PN533_TYPE_B_OPC_SENSB_RES)
1427                 return false;
1428
1429         if (PN533_TYPE_B_PROT_TYPE(type_b->sensb_res.prot_info.fsci_type) &
1430                                                 PN533_TYPE_B_PROT_TYPE_RFU_MASK)
1431                 return false;
1432
1433         return true;
1434 }
1435
1436 static int pn533_target_found_type_b(struct nfc_target *nfc_tgt, u8 *tgt_data,
1437                                                         int tgt_data_len)
1438 {
1439         struct pn533_target_type_b *tgt_type_b;
1440
1441         tgt_type_b = (struct pn533_target_type_b *)tgt_data;
1442
1443         if (!pn533_target_type_b_is_valid(tgt_type_b, tgt_data_len))
1444                 return -EPROTO;
1445
1446         nfc_tgt->supported_protocols = NFC_PROTO_ISO14443_B_MASK;
1447
1448         return 0;
1449 }
1450
1451 static int pn533_target_found(struct pn533 *dev, u8 tg, u8 *tgdata,
1452                               int tgdata_len)
1453 {
1454         struct nfc_target nfc_tgt;
1455         int rc;
1456
1457         dev_dbg(&dev->interface->dev, "%s: modulation=%d\n",
1458                 __func__, dev->poll_mod_curr);
1459
1460         if (tg != 1)
1461                 return -EPROTO;
1462
1463         memset(&nfc_tgt, 0, sizeof(struct nfc_target));
1464
1465         switch (dev->poll_mod_curr) {
1466         case PN533_POLL_MOD_106KBPS_A:
1467                 rc = pn533_target_found_type_a(&nfc_tgt, tgdata, tgdata_len);
1468                 break;
1469         case PN533_POLL_MOD_212KBPS_FELICA:
1470         case PN533_POLL_MOD_424KBPS_FELICA:
1471                 rc = pn533_target_found_felica(&nfc_tgt, tgdata, tgdata_len);
1472                 break;
1473         case PN533_POLL_MOD_106KBPS_JEWEL:
1474                 rc = pn533_target_found_jewel(&nfc_tgt, tgdata, tgdata_len);
1475                 break;
1476         case PN533_POLL_MOD_847KBPS_B:
1477                 rc = pn533_target_found_type_b(&nfc_tgt, tgdata, tgdata_len);
1478                 break;
1479         default:
1480                 nfc_err(&dev->interface->dev,
1481                         "Unknown current poll modulation\n");
1482                 return -EPROTO;
1483         }
1484
1485         if (rc)
1486                 return rc;
1487
1488         if (!(nfc_tgt.supported_protocols & dev->poll_protocols)) {
1489                 dev_dbg(&dev->interface->dev,
1490                         "The Tg found doesn't have the desired protocol\n");
1491                 return -EAGAIN;
1492         }
1493
1494         dev_dbg(&dev->interface->dev,
1495                 "Target found - supported protocols: 0x%x\n",
1496                 nfc_tgt.supported_protocols);
1497
1498         dev->tgt_available_prots = nfc_tgt.supported_protocols;
1499
1500         nfc_targets_found(dev->nfc_dev, &nfc_tgt, 1);
1501
1502         return 0;
1503 }
1504
1505 static inline void pn533_poll_next_mod(struct pn533 *dev)
1506 {
1507         dev->poll_mod_curr = (dev->poll_mod_curr + 1) % dev->poll_mod_count;
1508 }
1509
1510 static void pn533_poll_reset_mod_list(struct pn533 *dev)
1511 {
1512         dev->poll_mod_count = 0;
1513 }
1514
1515 static void pn533_poll_add_mod(struct pn533 *dev, u8 mod_index)
1516 {
1517         dev->poll_mod_active[dev->poll_mod_count] =
1518                 (struct pn533_poll_modulations *)&poll_mod[mod_index];
1519         dev->poll_mod_count++;
1520 }
1521
1522 static void pn533_poll_create_mod_list(struct pn533 *dev,
1523                                        u32 im_protocols, u32 tm_protocols)
1524 {
1525         pn533_poll_reset_mod_list(dev);
1526
1527         if ((im_protocols & NFC_PROTO_MIFARE_MASK) ||
1528             (im_protocols & NFC_PROTO_ISO14443_MASK) ||
1529             (im_protocols & NFC_PROTO_NFC_DEP_MASK))
1530                 pn533_poll_add_mod(dev, PN533_POLL_MOD_106KBPS_A);
1531
1532         if (im_protocols & NFC_PROTO_FELICA_MASK ||
1533             im_protocols & NFC_PROTO_NFC_DEP_MASK) {
1534                 pn533_poll_add_mod(dev, PN533_POLL_MOD_212KBPS_FELICA);
1535                 pn533_poll_add_mod(dev, PN533_POLL_MOD_424KBPS_FELICA);
1536         }
1537
1538         if (im_protocols & NFC_PROTO_JEWEL_MASK)
1539                 pn533_poll_add_mod(dev, PN533_POLL_MOD_106KBPS_JEWEL);
1540
1541         if (im_protocols & NFC_PROTO_ISO14443_B_MASK)
1542                 pn533_poll_add_mod(dev, PN533_POLL_MOD_847KBPS_B);
1543
1544         if (tm_protocols)
1545                 pn533_poll_add_mod(dev, PN533_LISTEN_MOD);
1546 }
1547
1548 static int pn533_start_poll_complete(struct pn533 *dev, struct sk_buff *resp)
1549 {
1550         u8 nbtg, tg, *tgdata;
1551         int rc, tgdata_len;
1552
1553         /* Toggle the DEP polling */
1554         dev->poll_dep = 1;
1555
1556         nbtg = resp->data[0];
1557         tg = resp->data[1];
1558         tgdata = &resp->data[2];
1559         tgdata_len = resp->len - 2;  /* nbtg + tg */
1560
1561         if (nbtg) {
1562                 rc = pn533_target_found(dev, tg, tgdata, tgdata_len);
1563
1564                 /* We must stop the poll after a valid target found */
1565                 if (rc == 0) {
1566                         pn533_poll_reset_mod_list(dev);
1567                         return 0;
1568                 }
1569         }
1570
1571         return -EAGAIN;
1572 }
1573
1574 static struct sk_buff *pn533_alloc_poll_tg_frame(struct pn533 *dev)
1575 {
1576         struct sk_buff *skb;
1577         u8 *felica, *nfcid3, *gb;
1578
1579         u8 *gbytes = dev->gb;
1580         size_t gbytes_len = dev->gb_len;
1581
1582         u8 felica_params[18] = {0x1, 0xfe, /* DEP */
1583                                 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, /* random */
1584                                 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
1585                                 0xff, 0xff}; /* System code */
1586
1587         u8 mifare_params[6] = {0x1, 0x1, /* SENS_RES */
1588                                0x0, 0x0, 0x0,
1589                                0x40}; /* SEL_RES for DEP */
1590
1591         unsigned int skb_len = 36 + /* mode (1), mifare (6),
1592                                        felica (18), nfcid3 (10), gb_len (1) */
1593                                gbytes_len +
1594                                1;  /* len Tk*/
1595
1596         skb = pn533_alloc_skb(dev, skb_len);
1597         if (!skb)
1598                 return NULL;
1599
1600         /* DEP support only */
1601         *skb_put(skb, 1) = PN533_INIT_TARGET_DEP;
1602
1603         /* MIFARE params */
1604         memcpy(skb_put(skb, 6), mifare_params, 6);
1605
1606         /* Felica params */
1607         felica = skb_put(skb, 18);
1608         memcpy(felica, felica_params, 18);
1609         get_random_bytes(felica + 2, 6);
1610
1611         /* NFCID3 */
1612         nfcid3 = skb_put(skb, 10);
1613         memset(nfcid3, 0, 10);
1614         memcpy(nfcid3, felica, 8);
1615
1616         /* General bytes */
1617         *skb_put(skb, 1) = gbytes_len;
1618
1619         gb = skb_put(skb, gbytes_len);
1620         memcpy(gb, gbytes, gbytes_len);
1621
1622         /* Len Tk */
1623         *skb_put(skb, 1) = 0;
1624
1625         return skb;
1626 }
1627
1628 #define PN533_CMD_DATAEXCH_HEAD_LEN 1
1629 #define PN533_CMD_DATAEXCH_DATA_MAXLEN 262
1630 static void pn533_wq_tm_mi_recv(struct work_struct *work);
1631 static struct sk_buff *pn533_build_response(struct pn533 *dev);
1632
1633 static int pn533_tm_get_data_complete(struct pn533 *dev, void *arg,
1634                                       struct sk_buff *resp)
1635 {
1636         struct sk_buff *skb;
1637         u8 status, ret, mi;
1638         int rc;
1639
1640         dev_dbg(&dev->interface->dev, "%s\n", __func__);
1641
1642         if (IS_ERR(resp)) {
1643                 skb_queue_purge(&dev->resp_q);
1644                 return PTR_ERR(resp);
1645         }
1646
1647         status = resp->data[0];
1648
1649         ret = status & PN533_CMD_RET_MASK;
1650         mi = status & PN533_CMD_MI_MASK;
1651
1652         skb_pull(resp, sizeof(status));
1653
1654         if (ret != PN533_CMD_RET_SUCCESS) {
1655                 rc = -EIO;
1656                 goto error;
1657         }
1658
1659         skb_queue_tail(&dev->resp_q, resp);
1660
1661         if (mi) {
1662                 queue_work(dev->wq, &dev->mi_tm_rx_work);
1663                 return -EINPROGRESS;
1664         }
1665
1666         skb = pn533_build_response(dev);
1667         if (!skb) {
1668                 rc = -EIO;
1669                 goto error;
1670         }
1671
1672         return nfc_tm_data_received(dev->nfc_dev, skb);
1673
1674 error:
1675         nfc_tm_deactivated(dev->nfc_dev);
1676         dev->tgt_mode = 0;
1677         skb_queue_purge(&dev->resp_q);
1678         dev_kfree_skb(resp);
1679
1680         return rc;
1681 }
1682
1683 static void pn533_wq_tm_mi_recv(struct work_struct *work)
1684 {
1685         struct pn533 *dev = container_of(work, struct pn533, mi_tm_rx_work);
1686         struct sk_buff *skb;
1687         int rc;
1688
1689         dev_dbg(&dev->interface->dev, "%s\n", __func__);
1690
1691         skb = pn533_alloc_skb(dev, 0);
1692         if (!skb)
1693                 return;
1694
1695         rc = pn533_send_cmd_direct_async(dev,
1696                                         PN533_CMD_TG_GET_DATA,
1697                                         skb,
1698                                         pn533_tm_get_data_complete,
1699                                         NULL);
1700
1701         if (rc < 0)
1702                 dev_kfree_skb(skb);
1703
1704         return;
1705 }
1706
1707 static int pn533_tm_send_complete(struct pn533 *dev, void *arg,
1708                                   struct sk_buff *resp);
1709 static void pn533_wq_tm_mi_send(struct work_struct *work)
1710 {
1711         struct pn533 *dev = container_of(work, struct pn533, mi_tm_tx_work);
1712         struct sk_buff *skb;
1713         int rc;
1714
1715         dev_dbg(&dev->interface->dev, "%s\n", __func__);
1716
1717         /* Grab the first skb in the queue */
1718         skb = skb_dequeue(&dev->fragment_skb);
1719         if (skb == NULL) {      /* No more data */
1720                 /* Reset the queue for future use */
1721                 skb_queue_head_init(&dev->fragment_skb);
1722                 goto error;
1723         }
1724
1725         /* last entry - remove MI bit */
1726         if (skb_queue_len(&dev->fragment_skb) == 0) {
1727                 rc = pn533_send_cmd_direct_async(dev, PN533_CMD_TG_SET_DATA,
1728                                         skb, pn533_tm_send_complete, NULL);
1729         } else
1730                 rc = pn533_send_cmd_direct_async(dev,
1731                                         PN533_CMD_TG_SET_META_DATA,
1732                                         skb, pn533_tm_send_complete, NULL);
1733
1734         if (rc == 0) /* success */
1735                 return;
1736
1737         dev_err(&dev->interface->dev,
1738                 "Error %d when trying to perform set meta data_exchange", rc);
1739
1740         dev_kfree_skb(skb);
1741
1742 error:
1743         pn533_send_ack(dev, GFP_KERNEL);
1744         queue_work(dev->wq, &dev->cmd_work);
1745 }
1746
1747 static void pn533_wq_tg_get_data(struct work_struct *work)
1748 {
1749         struct pn533 *dev = container_of(work, struct pn533, tg_work);
1750         struct sk_buff *skb;
1751         int rc;
1752
1753         dev_dbg(&dev->interface->dev, "%s\n", __func__);
1754
1755         skb = pn533_alloc_skb(dev, 0);
1756         if (!skb)
1757                 return;
1758
1759         rc = pn533_send_data_async(dev, PN533_CMD_TG_GET_DATA, skb,
1760                                    pn533_tm_get_data_complete, NULL);
1761
1762         if (rc < 0)
1763                 dev_kfree_skb(skb);
1764
1765         return;
1766 }
1767
1768 #define ATR_REQ_GB_OFFSET 17
1769 static int pn533_init_target_complete(struct pn533 *dev, struct sk_buff *resp)
1770 {
1771         u8 mode, *cmd, comm_mode = NFC_COMM_PASSIVE, *gb;
1772         size_t gb_len;
1773         int rc;
1774
1775         dev_dbg(&dev->interface->dev, "%s\n", __func__);
1776
1777         if (resp->len < ATR_REQ_GB_OFFSET + 1)
1778                 return -EINVAL;
1779
1780         mode = resp->data[0];
1781         cmd = &resp->data[1];
1782
1783         dev_dbg(&dev->interface->dev, "Target mode 0x%x len %d\n",
1784                 mode, resp->len);
1785
1786         if ((mode & PN533_INIT_TARGET_RESP_FRAME_MASK) ==
1787             PN533_INIT_TARGET_RESP_ACTIVE)
1788                 comm_mode = NFC_COMM_ACTIVE;
1789
1790         if ((mode & PN533_INIT_TARGET_RESP_DEP) == 0)  /* Only DEP supported */
1791                 return -EOPNOTSUPP;
1792
1793         gb = cmd + ATR_REQ_GB_OFFSET;
1794         gb_len = resp->len - (ATR_REQ_GB_OFFSET + 1);
1795
1796         rc = nfc_tm_activated(dev->nfc_dev, NFC_PROTO_NFC_DEP_MASK,
1797                               comm_mode, gb, gb_len);
1798         if (rc < 0) {
1799                 nfc_err(&dev->interface->dev,
1800                         "Error when signaling target activation\n");
1801                 return rc;
1802         }
1803
1804         dev->tgt_mode = 1;
1805         queue_work(dev->wq, &dev->tg_work);
1806
1807         return 0;
1808 }
1809
1810 static void pn533_listen_mode_timer(unsigned long data)
1811 {
1812         struct pn533 *dev = (struct pn533 *)data;
1813
1814         dev_dbg(&dev->interface->dev, "Listen mode timeout\n");
1815
1816         dev->cancel_listen = 1;
1817
1818         pn533_poll_next_mod(dev);
1819
1820         queue_delayed_work(dev->wq, &dev->poll_work,
1821                            msecs_to_jiffies(PN533_POLL_INTERVAL));
1822 }
1823
1824 static int pn533_rf_complete(struct pn533 *dev, void *arg,
1825                              struct sk_buff *resp)
1826 {
1827         int rc = 0;
1828
1829         dev_dbg(&dev->interface->dev, "%s\n", __func__);
1830
1831         if (IS_ERR(resp)) {
1832                 rc = PTR_ERR(resp);
1833
1834                 nfc_err(&dev->interface->dev, "RF setting error %d", rc);
1835
1836                 return rc;
1837         }
1838
1839         queue_delayed_work(dev->wq, &dev->poll_work,
1840                            msecs_to_jiffies(PN533_POLL_INTERVAL));
1841
1842         dev_kfree_skb(resp);
1843         return rc;
1844 }
1845
1846 static void pn533_wq_rf(struct work_struct *work)
1847 {
1848         struct pn533 *dev = container_of(work, struct pn533, rf_work);
1849         struct sk_buff *skb;
1850         int rc;
1851
1852         dev_dbg(&dev->interface->dev, "%s\n", __func__);
1853
1854         skb = pn533_alloc_skb(dev, 2);
1855         if (!skb)
1856                 return;
1857
1858         *skb_put(skb, 1) = PN533_CFGITEM_RF_FIELD;
1859         *skb_put(skb, 1) = PN533_CFGITEM_RF_FIELD_AUTO_RFCA;
1860
1861         rc = pn533_send_cmd_async(dev, PN533_CMD_RF_CONFIGURATION, skb,
1862                                   pn533_rf_complete, NULL);
1863         if (rc < 0) {
1864                 dev_kfree_skb(skb);
1865                 nfc_err(&dev->interface->dev, "RF setting error %d\n", rc);
1866         }
1867
1868         return;
1869 }
1870
1871 static int pn533_poll_dep_complete(struct pn533 *dev, void *arg,
1872                                    struct sk_buff *resp)
1873 {
1874         struct pn533_cmd_jump_dep_response *rsp;
1875         struct nfc_target nfc_target;
1876         u8 target_gt_len;
1877         int rc;
1878
1879         if (IS_ERR(resp))
1880                 return PTR_ERR(resp);
1881
1882         rsp = (struct pn533_cmd_jump_dep_response *)resp->data;
1883
1884         rc = rsp->status & PN533_CMD_RET_MASK;
1885         if (rc != PN533_CMD_RET_SUCCESS) {
1886                 /* Not target found, turn radio off */
1887                 queue_work(dev->wq, &dev->rf_work);
1888
1889                 dev_kfree_skb(resp);
1890                 return 0;
1891         }
1892
1893         dev_dbg(&dev->interface->dev, "Creating new target");
1894
1895         nfc_target.supported_protocols = NFC_PROTO_NFC_DEP_MASK;
1896         nfc_target.nfcid1_len = 10;
1897         memcpy(nfc_target.nfcid1, rsp->nfcid3t, nfc_target.nfcid1_len);
1898         rc = nfc_targets_found(dev->nfc_dev, &nfc_target, 1);
1899         if (rc)
1900                 goto error;
1901
1902         dev->tgt_available_prots = 0;
1903         dev->tgt_active_prot = NFC_PROTO_NFC_DEP;
1904
1905         /* ATR_RES general bytes are located at offset 17 */
1906         target_gt_len = resp->len - 17;
1907         rc = nfc_set_remote_general_bytes(dev->nfc_dev,
1908                                           rsp->gt, target_gt_len);
1909         if (!rc) {
1910                 rc = nfc_dep_link_is_up(dev->nfc_dev,
1911                                         dev->nfc_dev->targets[0].idx,
1912                                         0, NFC_RF_INITIATOR);
1913
1914                 if (!rc)
1915                         pn533_poll_reset_mod_list(dev);
1916         }
1917 error:
1918         dev_kfree_skb(resp);
1919         return rc;
1920 }
1921
1922 #define PASSIVE_DATA_LEN 5
1923 static int pn533_poll_dep(struct nfc_dev *nfc_dev)
1924 {
1925         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
1926         struct sk_buff *skb;
1927         int rc, skb_len;
1928         u8 *next, nfcid3[NFC_NFCID3_MAXSIZE];
1929         u8 passive_data[PASSIVE_DATA_LEN] = {0x00, 0xff, 0xff, 0x00, 0x3};
1930
1931         dev_dbg(&dev->interface->dev, "%s", __func__);
1932
1933         if (!dev->gb) {
1934                 dev->gb = nfc_get_local_general_bytes(nfc_dev, &dev->gb_len);
1935
1936                 if (!dev->gb || !dev->gb_len) {
1937                         dev->poll_dep = 0;
1938                         queue_work(dev->wq, &dev->rf_work);
1939                 }
1940         }
1941
1942         skb_len = 3 + dev->gb_len; /* ActPass + BR + Next */
1943         skb_len += PASSIVE_DATA_LEN;
1944
1945         /* NFCID3 */
1946         skb_len += NFC_NFCID3_MAXSIZE;
1947         nfcid3[0] = 0x1;
1948         nfcid3[1] = 0xfe;
1949         get_random_bytes(nfcid3 + 2, 6);
1950
1951         skb = pn533_alloc_skb(dev, skb_len);
1952         if (!skb)
1953                 return -ENOMEM;
1954
1955         *skb_put(skb, 1) = 0x01;  /* Active */
1956         *skb_put(skb, 1) = 0x02;  /* 424 kbps */
1957
1958         next = skb_put(skb, 1);  /* Next */
1959         *next = 0;
1960
1961         /* Copy passive data */
1962         memcpy(skb_put(skb, PASSIVE_DATA_LEN), passive_data, PASSIVE_DATA_LEN);
1963         *next |= 1;
1964
1965         /* Copy NFCID3 (which is NFCID2 from SENSF_RES) */
1966         memcpy(skb_put(skb, NFC_NFCID3_MAXSIZE), nfcid3,
1967                NFC_NFCID3_MAXSIZE);
1968         *next |= 2;
1969
1970         memcpy(skb_put(skb, dev->gb_len), dev->gb, dev->gb_len);
1971         *next |= 4; /* We have some Gi */
1972
1973         rc = pn533_send_cmd_async(dev, PN533_CMD_IN_JUMP_FOR_DEP, skb,
1974                                   pn533_poll_dep_complete, NULL);
1975
1976         if (rc < 0)
1977                 dev_kfree_skb(skb);
1978
1979         return rc;
1980 }
1981
1982 static int pn533_poll_complete(struct pn533 *dev, void *arg,
1983                                struct sk_buff *resp)
1984 {
1985         struct pn533_poll_modulations *cur_mod;
1986         int rc;
1987
1988         dev_dbg(&dev->interface->dev, "%s\n", __func__);
1989
1990         if (IS_ERR(resp)) {
1991                 rc = PTR_ERR(resp);
1992
1993                 nfc_err(&dev->interface->dev, "%s  Poll complete error %d\n",
1994                         __func__, rc);
1995
1996                 if (rc == -ENOENT) {
1997                         if (dev->poll_mod_count != 0)
1998                                 return rc;
1999                         else
2000                                 goto stop_poll;
2001                 } else if (rc < 0) {
2002                         nfc_err(&dev->interface->dev,
2003                                 "Error %d when running poll\n", rc);
2004                         goto stop_poll;
2005                 }
2006         }
2007
2008         cur_mod = dev->poll_mod_active[dev->poll_mod_curr];
2009
2010         if (cur_mod->len == 0) { /* Target mode */
2011                 del_timer(&dev->listen_timer);
2012                 rc = pn533_init_target_complete(dev, resp);
2013                 goto done;
2014         }
2015
2016         /* Initiator mode */
2017         rc = pn533_start_poll_complete(dev, resp);
2018         if (!rc)
2019                 goto done;
2020
2021         if (!dev->poll_mod_count) {
2022                 dev_dbg(&dev->interface->dev, "Polling has been stopped\n");
2023                 goto done;
2024         }
2025
2026         pn533_poll_next_mod(dev);
2027         /* Not target found, turn radio off */
2028         queue_work(dev->wq, &dev->rf_work);
2029
2030 done:
2031         dev_kfree_skb(resp);
2032         return rc;
2033
2034 stop_poll:
2035         nfc_err(&dev->interface->dev, "Polling operation has been stopped\n");
2036
2037         pn533_poll_reset_mod_list(dev);
2038         dev->poll_protocols = 0;
2039         return rc;
2040 }
2041
2042 static struct sk_buff *pn533_alloc_poll_in_frame(struct pn533 *dev,
2043                                         struct pn533_poll_modulations *mod)
2044 {
2045         struct sk_buff *skb;
2046
2047         skb = pn533_alloc_skb(dev, mod->len);
2048         if (!skb)
2049                 return NULL;
2050
2051         memcpy(skb_put(skb, mod->len), &mod->data, mod->len);
2052
2053         return skb;
2054 }
2055
2056 static int pn533_send_poll_frame(struct pn533 *dev)
2057 {
2058         struct pn533_poll_modulations *mod;
2059         struct sk_buff *skb;
2060         int rc;
2061         u8 cmd_code;
2062
2063         mod = dev->poll_mod_active[dev->poll_mod_curr];
2064
2065         dev_dbg(&dev->interface->dev, "%s mod len %d\n",
2066                 __func__, mod->len);
2067
2068         if (dev->poll_dep)  {
2069                 dev->poll_dep = 0;
2070                 return pn533_poll_dep(dev->nfc_dev);
2071         }
2072
2073         if (mod->len == 0) {  /* Listen mode */
2074                 cmd_code = PN533_CMD_TG_INIT_AS_TARGET;
2075                 skb = pn533_alloc_poll_tg_frame(dev);
2076         } else {  /* Polling mode */
2077                 cmd_code =  PN533_CMD_IN_LIST_PASSIVE_TARGET;
2078                 skb = pn533_alloc_poll_in_frame(dev, mod);
2079         }
2080
2081         if (!skb) {
2082                 nfc_err(&dev->interface->dev, "Failed to allocate skb\n");
2083                 return -ENOMEM;
2084         }
2085
2086         rc = pn533_send_cmd_async(dev, cmd_code, skb, pn533_poll_complete,
2087                                   NULL);
2088         if (rc < 0) {
2089                 dev_kfree_skb(skb);
2090                 nfc_err(&dev->interface->dev, "Polling loop error %d\n", rc);
2091         }
2092
2093         return rc;
2094 }
2095
2096 static void pn533_wq_poll(struct work_struct *work)
2097 {
2098         struct pn533 *dev = container_of(work, struct pn533, poll_work.work);
2099         struct pn533_poll_modulations *cur_mod;
2100         int rc;
2101
2102         cur_mod = dev->poll_mod_active[dev->poll_mod_curr];
2103
2104         dev_dbg(&dev->interface->dev,
2105                 "%s cancel_listen %d modulation len %d\n",
2106                 __func__, dev->cancel_listen, cur_mod->len);
2107
2108         if (dev->cancel_listen == 1) {
2109                 dev->cancel_listen = 0;
2110                 pn533_abort_cmd(dev, GFP_ATOMIC);
2111         }
2112
2113         rc = pn533_send_poll_frame(dev);
2114         if (rc)
2115                 return;
2116
2117         if (cur_mod->len == 0 && dev->poll_mod_count > 1)
2118                 mod_timer(&dev->listen_timer, jiffies + PN533_LISTEN_TIME * HZ);
2119
2120         return;
2121 }
2122
2123 static int pn533_start_poll(struct nfc_dev *nfc_dev,
2124                             u32 im_protocols, u32 tm_protocols)
2125 {
2126         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2127         struct pn533_poll_modulations *cur_mod;
2128         u8 rand_mod;
2129         int rc;
2130
2131         dev_dbg(&dev->interface->dev,
2132                 "%s: im protocols 0x%x tm protocols 0x%x\n",
2133                 __func__, im_protocols, tm_protocols);
2134
2135         if (dev->tgt_active_prot) {
2136                 nfc_err(&dev->interface->dev,
2137                         "Cannot poll with a target already activated\n");
2138                 return -EBUSY;
2139         }
2140
2141         if (dev->tgt_mode) {
2142                 nfc_err(&dev->interface->dev,
2143                         "Cannot poll while already being activated\n");
2144                 return -EBUSY;
2145         }
2146
2147         if (tm_protocols) {
2148                 dev->gb = nfc_get_local_general_bytes(nfc_dev, &dev->gb_len);
2149                 if (dev->gb == NULL)
2150                         tm_protocols = 0;
2151         }
2152
2153         pn533_poll_create_mod_list(dev, im_protocols, tm_protocols);
2154         dev->poll_protocols = im_protocols;
2155         dev->listen_protocols = tm_protocols;
2156
2157         /* Do not always start polling from the same modulation */
2158         get_random_bytes(&rand_mod, sizeof(rand_mod));
2159         rand_mod %= dev->poll_mod_count;
2160         dev->poll_mod_curr = rand_mod;
2161
2162         cur_mod = dev->poll_mod_active[dev->poll_mod_curr];
2163
2164         rc = pn533_send_poll_frame(dev);
2165
2166         /* Start listen timer */
2167         if (!rc && cur_mod->len == 0 && dev->poll_mod_count > 1)
2168                 mod_timer(&dev->listen_timer, jiffies + PN533_LISTEN_TIME * HZ);
2169
2170         return rc;
2171 }
2172
2173 static void pn533_stop_poll(struct nfc_dev *nfc_dev)
2174 {
2175         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2176
2177         del_timer(&dev->listen_timer);
2178
2179         if (!dev->poll_mod_count) {
2180                 dev_dbg(&dev->interface->dev,
2181                         "Polling operation was not running\n");
2182                 return;
2183         }
2184
2185         pn533_abort_cmd(dev, GFP_KERNEL);
2186         flush_delayed_work(&dev->poll_work);
2187         pn533_poll_reset_mod_list(dev);
2188 }
2189
2190 static int pn533_activate_target_nfcdep(struct pn533 *dev)
2191 {
2192         struct pn533_cmd_activate_response *rsp;
2193         u16 gt_len;
2194         int rc;
2195         struct sk_buff *skb;
2196         struct sk_buff *resp;
2197
2198         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2199
2200         skb = pn533_alloc_skb(dev, sizeof(u8) * 2); /*TG + Next*/
2201         if (!skb)
2202                 return -ENOMEM;
2203
2204         *skb_put(skb, sizeof(u8)) = 1; /* TG */
2205         *skb_put(skb, sizeof(u8)) = 0; /* Next */
2206
2207         resp = pn533_send_cmd_sync(dev, PN533_CMD_IN_ATR, skb);
2208         if (IS_ERR(resp))
2209                 return PTR_ERR(resp);
2210
2211         rsp = (struct pn533_cmd_activate_response *)resp->data;
2212         rc = rsp->status & PN533_CMD_RET_MASK;
2213         if (rc != PN533_CMD_RET_SUCCESS) {
2214                 nfc_err(&dev->interface->dev,
2215                         "Target activation failed (error 0x%x)\n", rc);
2216                 dev_kfree_skb(resp);
2217                 return -EIO;
2218         }
2219
2220         /* ATR_RES general bytes are located at offset 16 */
2221         gt_len = resp->len - 16;
2222         rc = nfc_set_remote_general_bytes(dev->nfc_dev, rsp->gt, gt_len);
2223
2224         dev_kfree_skb(resp);
2225         return rc;
2226 }
2227
2228 static int pn533_activate_target(struct nfc_dev *nfc_dev,
2229                                  struct nfc_target *target, u32 protocol)
2230 {
2231         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2232         int rc;
2233
2234         dev_dbg(&dev->interface->dev, "%s: protocol=%u\n", __func__, protocol);
2235
2236         if (dev->poll_mod_count) {
2237                 nfc_err(&dev->interface->dev,
2238                         "Cannot activate while polling\n");
2239                 return -EBUSY;
2240         }
2241
2242         if (dev->tgt_active_prot) {
2243                 nfc_err(&dev->interface->dev,
2244                         "There is already an active target\n");
2245                 return -EBUSY;
2246         }
2247
2248         if (!dev->tgt_available_prots) {
2249                 nfc_err(&dev->interface->dev,
2250                         "There is no available target to activate\n");
2251                 return -EINVAL;
2252         }
2253
2254         if (!(dev->tgt_available_prots & (1 << protocol))) {
2255                 nfc_err(&dev->interface->dev,
2256                         "Target doesn't support requested proto %u\n",
2257                         protocol);
2258                 return -EINVAL;
2259         }
2260
2261         if (protocol == NFC_PROTO_NFC_DEP) {
2262                 rc = pn533_activate_target_nfcdep(dev);
2263                 if (rc) {
2264                         nfc_err(&dev->interface->dev,
2265                                 "Activating target with DEP failed %d\n", rc);
2266                         return rc;
2267                 }
2268         }
2269
2270         dev->tgt_active_prot = protocol;
2271         dev->tgt_available_prots = 0;
2272
2273         return 0;
2274 }
2275
2276 static void pn533_deactivate_target(struct nfc_dev *nfc_dev,
2277                                     struct nfc_target *target)
2278 {
2279         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2280         struct sk_buff *skb;
2281         struct sk_buff *resp;
2282         int rc;
2283
2284         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2285
2286         if (!dev->tgt_active_prot) {
2287                 nfc_err(&dev->interface->dev, "There is no active target\n");
2288                 return;
2289         }
2290
2291         dev->tgt_active_prot = 0;
2292         skb_queue_purge(&dev->resp_q);
2293
2294         skb = pn533_alloc_skb(dev, sizeof(u8));
2295         if (!skb)
2296                 return;
2297
2298         *skb_put(skb, 1) = 1; /* TG*/
2299
2300         resp = pn533_send_cmd_sync(dev, PN533_CMD_IN_RELEASE, skb);
2301         if (IS_ERR(resp))
2302                 return;
2303
2304         rc = resp->data[0] & PN533_CMD_RET_MASK;
2305         if (rc != PN533_CMD_RET_SUCCESS)
2306                 nfc_err(&dev->interface->dev,
2307                         "Error 0x%x when releasing the target\n", rc);
2308
2309         dev_kfree_skb(resp);
2310         return;
2311 }
2312
2313
2314 static int pn533_in_dep_link_up_complete(struct pn533 *dev, void *arg,
2315                                          struct sk_buff *resp)
2316 {
2317         struct pn533_cmd_jump_dep_response *rsp;
2318         u8 target_gt_len;
2319         int rc;
2320         u8 active = *(u8 *)arg;
2321
2322         kfree(arg);
2323
2324         if (IS_ERR(resp))
2325                 return PTR_ERR(resp);
2326
2327         if (dev->tgt_available_prots &&
2328             !(dev->tgt_available_prots & (1 << NFC_PROTO_NFC_DEP))) {
2329                 nfc_err(&dev->interface->dev,
2330                         "The target does not support DEP\n");
2331                 rc =  -EINVAL;
2332                 goto error;
2333         }
2334
2335         rsp = (struct pn533_cmd_jump_dep_response *)resp->data;
2336
2337         rc = rsp->status & PN533_CMD_RET_MASK;
2338         if (rc != PN533_CMD_RET_SUCCESS) {
2339                 nfc_err(&dev->interface->dev,
2340                         "Bringing DEP link up failed (error 0x%x)\n", rc);
2341                 goto error;
2342         }
2343
2344         if (!dev->tgt_available_prots) {
2345                 struct nfc_target nfc_target;
2346
2347                 dev_dbg(&dev->interface->dev, "Creating new target\n");
2348
2349                 nfc_target.supported_protocols = NFC_PROTO_NFC_DEP_MASK;
2350                 nfc_target.nfcid1_len = 10;
2351                 memcpy(nfc_target.nfcid1, rsp->nfcid3t, nfc_target.nfcid1_len);
2352                 rc = nfc_targets_found(dev->nfc_dev, &nfc_target, 1);
2353                 if (rc)
2354                         goto error;
2355
2356                 dev->tgt_available_prots = 0;
2357         }
2358
2359         dev->tgt_active_prot = NFC_PROTO_NFC_DEP;
2360
2361         /* ATR_RES general bytes are located at offset 17 */
2362         target_gt_len = resp->len - 17;
2363         rc = nfc_set_remote_general_bytes(dev->nfc_dev,
2364                                           rsp->gt, target_gt_len);
2365         if (rc == 0)
2366                 rc = nfc_dep_link_is_up(dev->nfc_dev,
2367                                         dev->nfc_dev->targets[0].idx,
2368                                         !active, NFC_RF_INITIATOR);
2369
2370 error:
2371         dev_kfree_skb(resp);
2372         return rc;
2373 }
2374
2375 static int pn533_rf_field(struct nfc_dev *nfc_dev, u8 rf);
2376 static int pn533_dep_link_up(struct nfc_dev *nfc_dev, struct nfc_target *target,
2377                              u8 comm_mode, u8 *gb, size_t gb_len)
2378 {
2379         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2380         struct sk_buff *skb;
2381         int rc, skb_len;
2382         u8 *next, *arg, nfcid3[NFC_NFCID3_MAXSIZE];
2383         u8 passive_data[PASSIVE_DATA_LEN] = {0x00, 0xff, 0xff, 0x00, 0x3};
2384
2385         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2386
2387         if (dev->poll_mod_count) {
2388                 nfc_err(&dev->interface->dev,
2389                         "Cannot bring the DEP link up while polling\n");
2390                 return -EBUSY;
2391         }
2392
2393         if (dev->tgt_active_prot) {
2394                 nfc_err(&dev->interface->dev,
2395                         "There is already an active target\n");
2396                 return -EBUSY;
2397         }
2398
2399         skb_len = 3 + gb_len; /* ActPass + BR + Next */
2400         skb_len += PASSIVE_DATA_LEN;
2401
2402         /* NFCID3 */
2403         skb_len += NFC_NFCID3_MAXSIZE;
2404         if (target && !target->nfcid2_len) {
2405                 nfcid3[0] = 0x1;
2406                 nfcid3[1] = 0xfe;
2407                 get_random_bytes(nfcid3 + 2, 6);
2408         }
2409
2410         skb = pn533_alloc_skb(dev, skb_len);
2411         if (!skb)
2412                 return -ENOMEM;
2413
2414         *skb_put(skb, 1) = !comm_mode;  /* ActPass */
2415         *skb_put(skb, 1) = 0x02;  /* 424 kbps */
2416
2417         next = skb_put(skb, 1);  /* Next */
2418         *next = 0;
2419
2420         /* Copy passive data */
2421         memcpy(skb_put(skb, PASSIVE_DATA_LEN), passive_data, PASSIVE_DATA_LEN);
2422         *next |= 1;
2423
2424         /* Copy NFCID3 (which is NFCID2 from SENSF_RES) */
2425         if (target && target->nfcid2_len)
2426                 memcpy(skb_put(skb, NFC_NFCID3_MAXSIZE), target->nfcid2,
2427                        target->nfcid2_len);
2428         else
2429                 memcpy(skb_put(skb, NFC_NFCID3_MAXSIZE), nfcid3,
2430                        NFC_NFCID3_MAXSIZE);
2431         *next |= 2;
2432
2433         if (gb != NULL && gb_len > 0) {
2434                 memcpy(skb_put(skb, gb_len), gb, gb_len);
2435                 *next |= 4; /* We have some Gi */
2436         } else {
2437                 *next = 0;
2438         }
2439
2440         arg = kmalloc(sizeof(*arg), GFP_KERNEL);
2441         if (!arg) {
2442                 dev_kfree_skb(skb);
2443                 return -ENOMEM;
2444         }
2445
2446         *arg = !comm_mode;
2447
2448         pn533_rf_field(dev->nfc_dev, 0);
2449
2450         rc = pn533_send_cmd_async(dev, PN533_CMD_IN_JUMP_FOR_DEP, skb,
2451                                   pn533_in_dep_link_up_complete, arg);
2452
2453         if (rc < 0) {
2454                 dev_kfree_skb(skb);
2455                 kfree(arg);
2456         }
2457
2458         return rc;
2459 }
2460
2461 static int pn533_dep_link_down(struct nfc_dev *nfc_dev)
2462 {
2463         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2464
2465         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2466
2467         pn533_poll_reset_mod_list(dev);
2468
2469         if (dev->tgt_mode || dev->tgt_active_prot)
2470                 pn533_abort_cmd(dev, GFP_KERNEL);
2471
2472         dev->tgt_active_prot = 0;
2473         dev->tgt_mode = 0;
2474
2475         skb_queue_purge(&dev->resp_q);
2476
2477         return 0;
2478 }
2479
2480 struct pn533_data_exchange_arg {
2481         data_exchange_cb_t cb;
2482         void *cb_context;
2483 };
2484
2485 static struct sk_buff *pn533_build_response(struct pn533 *dev)
2486 {
2487         struct sk_buff *skb, *tmp, *t;
2488         unsigned int skb_len = 0, tmp_len = 0;
2489
2490         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2491
2492         if (skb_queue_empty(&dev->resp_q))
2493                 return NULL;
2494
2495         if (skb_queue_len(&dev->resp_q) == 1) {
2496                 skb = skb_dequeue(&dev->resp_q);
2497                 goto out;
2498         }
2499
2500         skb_queue_walk_safe(&dev->resp_q, tmp, t)
2501                 skb_len += tmp->len;
2502
2503         dev_dbg(&dev->interface->dev, "%s total length %d\n",
2504                 __func__, skb_len);
2505
2506         skb = alloc_skb(skb_len, GFP_KERNEL);
2507         if (skb == NULL)
2508                 goto out;
2509
2510         skb_put(skb, skb_len);
2511
2512         skb_queue_walk_safe(&dev->resp_q, tmp, t) {
2513                 memcpy(skb->data + tmp_len, tmp->data, tmp->len);
2514                 tmp_len += tmp->len;
2515         }
2516
2517 out:
2518         skb_queue_purge(&dev->resp_q);
2519
2520         return skb;
2521 }
2522
2523 static int pn533_data_exchange_complete(struct pn533 *dev, void *_arg,
2524                                         struct sk_buff *resp)
2525 {
2526         struct pn533_data_exchange_arg *arg = _arg;
2527         struct sk_buff *skb;
2528         int rc = 0;
2529         u8 status, ret, mi;
2530
2531         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2532
2533         if (IS_ERR(resp)) {
2534                 rc = PTR_ERR(resp);
2535                 goto _error;
2536         }
2537
2538         status = resp->data[0];
2539         ret = status & PN533_CMD_RET_MASK;
2540         mi = status & PN533_CMD_MI_MASK;
2541
2542         skb_pull(resp, sizeof(status));
2543
2544         if (ret != PN533_CMD_RET_SUCCESS) {
2545                 nfc_err(&dev->interface->dev,
2546                         "Exchanging data failed (error 0x%x)\n", ret);
2547                 rc = -EIO;
2548                 goto error;
2549         }
2550
2551         skb_queue_tail(&dev->resp_q, resp);
2552
2553         if (mi) {
2554                 dev->cmd_complete_mi_arg = arg;
2555                 queue_work(dev->wq, &dev->mi_rx_work);
2556                 return -EINPROGRESS;
2557         }
2558
2559         /* Prepare for the next round */
2560         if (skb_queue_len(&dev->fragment_skb) > 0) {
2561                 dev->cmd_complete_dep_arg = arg;
2562                 queue_work(dev->wq, &dev->mi_tx_work);
2563
2564                 return -EINPROGRESS;
2565         }
2566
2567         skb = pn533_build_response(dev);
2568         if (!skb)
2569                 goto error;
2570
2571         arg->cb(arg->cb_context, skb, 0);
2572         kfree(arg);
2573         return 0;
2574
2575 error:
2576         dev_kfree_skb(resp);
2577 _error:
2578         skb_queue_purge(&dev->resp_q);
2579         arg->cb(arg->cb_context, NULL, rc);
2580         kfree(arg);
2581         return rc;
2582 }
2583
2584 /* Split the Tx skb into small chunks */
2585 static int pn533_fill_fragment_skbs(struct pn533 *dev, struct sk_buff *skb)
2586 {
2587         struct sk_buff *frag;
2588         int  frag_size;
2589
2590         do {
2591                 /* Remaining size */
2592                 if (skb->len > PN533_CMD_DATAFRAME_MAXLEN)
2593                         frag_size = PN533_CMD_DATAFRAME_MAXLEN;
2594                 else
2595                         frag_size = skb->len;
2596
2597                 /* Allocate and reserve */
2598                 frag = pn533_alloc_skb(dev, frag_size);
2599                 if (!frag) {
2600                         skb_queue_purge(&dev->fragment_skb);
2601                         break;
2602                 }
2603
2604                 if (!dev->tgt_mode) {
2605                         /* Reserve the TG/MI byte */
2606                         skb_reserve(frag, 1);
2607
2608                         /* MI + TG */
2609                         if (frag_size  == PN533_CMD_DATAFRAME_MAXLEN)
2610                                 *skb_push(frag, sizeof(u8)) =
2611                                                         (PN533_CMD_MI_MASK | 1);
2612                         else
2613                                 *skb_push(frag, sizeof(u8)) =  1; /* TG */
2614                 }
2615
2616                 memcpy(skb_put(frag, frag_size), skb->data, frag_size);
2617
2618                 /* Reduce the size of incoming buffer */
2619                 skb_pull(skb, frag_size);
2620
2621                 /* Add this to skb_queue */
2622                 skb_queue_tail(&dev->fragment_skb, frag);
2623
2624         } while (skb->len > 0);
2625
2626         dev_kfree_skb(skb);
2627
2628         return skb_queue_len(&dev->fragment_skb);
2629 }
2630
2631 static int pn533_transceive(struct nfc_dev *nfc_dev,
2632                             struct nfc_target *target, struct sk_buff *skb,
2633                             data_exchange_cb_t cb, void *cb_context)
2634 {
2635         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2636         struct pn533_data_exchange_arg *arg = NULL;
2637         int rc;
2638
2639         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2640
2641         if (!dev->tgt_active_prot) {
2642                 nfc_err(&dev->interface->dev,
2643                         "Can't exchange data if there is no active target\n");
2644                 rc = -EINVAL;
2645                 goto error;
2646         }
2647
2648         arg = kmalloc(sizeof(*arg), GFP_KERNEL);
2649         if (!arg) {
2650                 rc = -ENOMEM;
2651                 goto error;
2652         }
2653
2654         arg->cb = cb;
2655         arg->cb_context = cb_context;
2656
2657         switch (dev->device_type) {
2658         case PN533_DEVICE_PASORI:
2659                 if (dev->tgt_active_prot == NFC_PROTO_FELICA) {
2660                         rc = pn533_send_data_async(dev, PN533_CMD_IN_COMM_THRU,
2661                                                    skb,
2662                                                    pn533_data_exchange_complete,
2663                                                    arg);
2664
2665                         break;
2666                 }
2667         default:
2668                 /* jumbo frame ? */
2669                 if (skb->len > PN533_CMD_DATAEXCH_DATA_MAXLEN) {
2670                         rc = pn533_fill_fragment_skbs(dev, skb);
2671                         if (rc <= 0)
2672                                 goto error;
2673
2674                         skb = skb_dequeue(&dev->fragment_skb);
2675                         if (!skb) {
2676                                 rc = -EIO;
2677                                 goto error;
2678                         }
2679                 } else {
2680                         *skb_push(skb, sizeof(u8)) =  1; /* TG */
2681                 }
2682
2683                 rc = pn533_send_data_async(dev, PN533_CMD_IN_DATA_EXCHANGE,
2684                                            skb, pn533_data_exchange_complete,
2685                                            arg);
2686
2687                 break;
2688         }
2689
2690         if (rc < 0) /* rc from send_async */
2691                 goto error;
2692
2693         return 0;
2694
2695 error:
2696         kfree(arg);
2697         dev_kfree_skb(skb);
2698         return rc;
2699 }
2700
2701 static int pn533_tm_send_complete(struct pn533 *dev, void *arg,
2702                                   struct sk_buff *resp)
2703 {
2704         u8 status;
2705
2706         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2707
2708         if (IS_ERR(resp))
2709                 return PTR_ERR(resp);
2710
2711         status = resp->data[0];
2712
2713         /* Prepare for the next round */
2714         if (skb_queue_len(&dev->fragment_skb) > 0) {
2715                 queue_work(dev->wq, &dev->mi_tm_tx_work);
2716                 return -EINPROGRESS;
2717         }
2718         dev_kfree_skb(resp);
2719
2720         if (status != 0) {
2721                 nfc_tm_deactivated(dev->nfc_dev);
2722
2723                 dev->tgt_mode = 0;
2724
2725                 return 0;
2726         }
2727
2728         queue_work(dev->wq, &dev->tg_work);
2729
2730         return 0;
2731 }
2732
2733 static int pn533_tm_send(struct nfc_dev *nfc_dev, struct sk_buff *skb)
2734 {
2735         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2736         int rc;
2737
2738         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2739
2740         /* let's split in multiple chunks if size's too big */
2741         if (skb->len > PN533_CMD_DATAEXCH_DATA_MAXLEN) {
2742                 rc = pn533_fill_fragment_skbs(dev, skb);
2743                 if (rc <= 0)
2744                         goto error;
2745
2746                 /* get the first skb */
2747                 skb = skb_dequeue(&dev->fragment_skb);
2748                 if (!skb) {
2749                         rc = -EIO;
2750                         goto error;
2751                 }
2752
2753                 rc = pn533_send_data_async(dev, PN533_CMD_TG_SET_META_DATA, skb,
2754                                                 pn533_tm_send_complete, NULL);
2755         } else {
2756                 /* Send th skb */
2757                 rc = pn533_send_data_async(dev, PN533_CMD_TG_SET_DATA, skb,
2758                                                 pn533_tm_send_complete, NULL);
2759         }
2760
2761 error:
2762         if (rc < 0) {
2763                 dev_kfree_skb(skb);
2764                 skb_queue_purge(&dev->fragment_skb);
2765         }
2766
2767         return rc;
2768 }
2769
2770 static void pn533_wq_mi_recv(struct work_struct *work)
2771 {
2772         struct pn533 *dev = container_of(work, struct pn533, mi_rx_work);
2773         struct sk_buff *skb;
2774         int rc;
2775
2776         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2777
2778         skb = pn533_alloc_skb(dev, PN533_CMD_DATAEXCH_HEAD_LEN);
2779         if (!skb)
2780                 goto error;
2781
2782         switch (dev->device_type) {
2783         case PN533_DEVICE_PASORI:
2784                 if (dev->tgt_active_prot == NFC_PROTO_FELICA) {
2785                         rc = pn533_send_cmd_direct_async(dev,
2786                                                 PN533_CMD_IN_COMM_THRU,
2787                                                 skb,
2788                                                 pn533_data_exchange_complete,
2789                                                  dev->cmd_complete_mi_arg);
2790
2791                         break;
2792                 }
2793         default:
2794                 *skb_put(skb, sizeof(u8)) =  1; /*TG*/
2795
2796                 rc = pn533_send_cmd_direct_async(dev,
2797                                                  PN533_CMD_IN_DATA_EXCHANGE,
2798                                                  skb,
2799                                                  pn533_data_exchange_complete,
2800                                                  dev->cmd_complete_mi_arg);
2801
2802                 break;
2803         }
2804
2805         if (rc == 0) /* success */
2806                 return;
2807
2808         nfc_err(&dev->interface->dev,
2809                 "Error %d when trying to perform data_exchange\n", rc);
2810
2811         dev_kfree_skb(skb);
2812         kfree(dev->cmd_complete_mi_arg);
2813
2814 error:
2815         pn533_send_ack(dev, GFP_KERNEL);
2816         queue_work(dev->wq, &dev->cmd_work);
2817 }
2818
2819 static void pn533_wq_mi_send(struct work_struct *work)
2820 {
2821         struct pn533 *dev = container_of(work, struct pn533, mi_tx_work);
2822         struct sk_buff *skb;
2823         int rc;
2824
2825         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2826
2827         /* Grab the first skb in the queue */
2828         skb = skb_dequeue(&dev->fragment_skb);
2829
2830         if (skb == NULL) {      /* No more data */
2831                 /* Reset the queue for future use */
2832                 skb_queue_head_init(&dev->fragment_skb);
2833                 goto error;
2834         }
2835
2836         switch (dev->device_type) {
2837         case PN533_DEVICE_PASORI:
2838                 if (dev->tgt_active_prot != NFC_PROTO_FELICA) {
2839                         rc = -EIO;
2840                         break;
2841                 }
2842
2843                 rc = pn533_send_cmd_direct_async(dev, PN533_CMD_IN_COMM_THRU,
2844                                                  skb,
2845                                                  pn533_data_exchange_complete,
2846                                                  dev->cmd_complete_dep_arg);
2847
2848                 break;
2849
2850         default:
2851                 /* Still some fragments? */
2852                 rc = pn533_send_cmd_direct_async(dev,PN533_CMD_IN_DATA_EXCHANGE,
2853                                                  skb,
2854                                                  pn533_data_exchange_complete,
2855                                                  dev->cmd_complete_dep_arg);
2856
2857                 break;
2858         }
2859
2860         if (rc == 0) /* success */
2861                 return;
2862
2863         nfc_err(&dev->interface->dev,
2864                 "Error %d when trying to perform data_exchange\n", rc);
2865
2866         dev_kfree_skb(skb);
2867         kfree(dev->cmd_complete_dep_arg);
2868
2869 error:
2870         pn533_send_ack(dev, GFP_KERNEL);
2871         queue_work(dev->wq, &dev->cmd_work);
2872 }
2873
2874 static int pn533_set_configuration(struct pn533 *dev, u8 cfgitem, u8 *cfgdata,
2875                                                                 u8 cfgdata_len)
2876 {
2877         struct sk_buff *skb;
2878         struct sk_buff *resp;
2879         int skb_len;
2880
2881         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2882
2883         skb_len = sizeof(cfgitem) + cfgdata_len; /* cfgitem + cfgdata */
2884
2885         skb = pn533_alloc_skb(dev, skb_len);
2886         if (!skb)
2887                 return -ENOMEM;
2888
2889         *skb_put(skb, sizeof(cfgitem)) = cfgitem;
2890         memcpy(skb_put(skb, cfgdata_len), cfgdata, cfgdata_len);
2891
2892         resp = pn533_send_cmd_sync(dev, PN533_CMD_RF_CONFIGURATION, skb);
2893         if (IS_ERR(resp))
2894                 return PTR_ERR(resp);
2895
2896         dev_kfree_skb(resp);
2897         return 0;
2898 }
2899
2900 static int pn533_get_firmware_version(struct pn533 *dev,
2901                                       struct pn533_fw_version *fv)
2902 {
2903         struct sk_buff *skb;
2904         struct sk_buff *resp;
2905
2906         skb = pn533_alloc_skb(dev, 0);
2907         if (!skb)
2908                 return -ENOMEM;
2909
2910         resp = pn533_send_cmd_sync(dev, PN533_CMD_GET_FIRMWARE_VERSION, skb);
2911         if (IS_ERR(resp))
2912                 return PTR_ERR(resp);
2913
2914         fv->ic = resp->data[0];
2915         fv->ver = resp->data[1];
2916         fv->rev = resp->data[2];
2917         fv->support = resp->data[3];
2918
2919         dev_kfree_skb(resp);
2920         return 0;
2921 }
2922
2923 static int pn533_pasori_fw_reset(struct pn533 *dev)
2924 {
2925         struct sk_buff *skb;
2926         struct sk_buff *resp;
2927
2928         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2929
2930         skb = pn533_alloc_skb(dev, sizeof(u8));
2931         if (!skb)
2932                 return -ENOMEM;
2933
2934         *skb_put(skb, sizeof(u8)) = 0x1;
2935
2936         resp = pn533_send_cmd_sync(dev, 0x18, skb);
2937         if (IS_ERR(resp))
2938                 return PTR_ERR(resp);
2939
2940         dev_kfree_skb(resp);
2941
2942         return 0;
2943 }
2944
2945 struct pn533_acr122_poweron_rdr_arg {
2946         int rc;
2947         struct completion done;
2948 };
2949
2950 static void pn533_acr122_poweron_rdr_resp(struct urb *urb)
2951 {
2952         struct pn533_acr122_poweron_rdr_arg *arg = urb->context;
2953
2954         dev_dbg(&urb->dev->dev, "%s\n", __func__);
2955
2956         print_hex_dump_debug("ACR122 RX: ", DUMP_PREFIX_NONE, 16, 1,
2957                        urb->transfer_buffer, urb->transfer_buffer_length,
2958                        false);
2959
2960         arg->rc = urb->status;
2961         complete(&arg->done);
2962 }
2963
2964 static int pn533_acr122_poweron_rdr(struct pn533 *dev)
2965 {
2966         /* Power on th reader (CCID cmd) */
2967         u8 cmd[10] = {PN533_ACR122_PC_TO_RDR_ICCPOWERON,
2968                       0, 0, 0, 0, 0, 0, 3, 0, 0};
2969         u8 buf[255];
2970         int rc;
2971         void *cntx;
2972         struct pn533_acr122_poweron_rdr_arg arg;
2973
2974         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2975
2976         init_completion(&arg.done);
2977         cntx = dev->in_urb->context;  /* backup context */
2978
2979         dev->in_urb->transfer_buffer = buf;
2980         dev->in_urb->transfer_buffer_length = 255;
2981         dev->in_urb->complete = pn533_acr122_poweron_rdr_resp;
2982         dev->in_urb->context = &arg;
2983
2984         dev->out_urb->transfer_buffer = cmd;
2985         dev->out_urb->transfer_buffer_length = sizeof(cmd);
2986
2987         print_hex_dump_debug("ACR122 TX: ", DUMP_PREFIX_NONE, 16, 1,
2988                        cmd, sizeof(cmd), false);
2989
2990         rc = usb_submit_urb(dev->out_urb, GFP_KERNEL);
2991         if (rc) {
2992                 nfc_err(&dev->interface->dev,
2993                         "Reader power on cmd error %d\n", rc);
2994                 return rc;
2995         }
2996
2997         rc =  usb_submit_urb(dev->in_urb, GFP_KERNEL);
2998         if (rc) {
2999                 nfc_err(&dev->interface->dev,
3000                         "Can't submit reader poweron cmd response %d\n", rc);
3001                 return rc;
3002         }
3003
3004         wait_for_completion(&arg.done);
3005         dev->in_urb->context = cntx; /* restore context */
3006
3007         return arg.rc;
3008 }
3009
3010 static int pn533_rf_field(struct nfc_dev *nfc_dev, u8 rf)
3011 {
3012         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
3013         u8 rf_field = !!rf;
3014         int rc;
3015
3016         rf_field |= PN533_CFGITEM_RF_FIELD_AUTO_RFCA;
3017
3018         rc = pn533_set_configuration(dev, PN533_CFGITEM_RF_FIELD,
3019                                      (u8 *)&rf_field, 1);
3020         if (rc) {
3021                 nfc_err(&dev->interface->dev, "Error on setting RF field\n");
3022                 return rc;
3023         }
3024
3025         return rc;
3026 }
3027
3028 static int pn533_dev_up(struct nfc_dev *nfc_dev)
3029 {
3030         return pn533_rf_field(nfc_dev, 1);
3031 }
3032
3033 static int pn533_dev_down(struct nfc_dev *nfc_dev)
3034 {
3035         return pn533_rf_field(nfc_dev, 0);
3036 }
3037
3038 static struct nfc_ops pn533_nfc_ops = {
3039         .dev_up = pn533_dev_up,
3040         .dev_down = pn533_dev_down,
3041         .dep_link_up = pn533_dep_link_up,
3042         .dep_link_down = pn533_dep_link_down,
3043         .start_poll = pn533_start_poll,
3044         .stop_poll = pn533_stop_poll,
3045         .activate_target = pn533_activate_target,
3046         .deactivate_target = pn533_deactivate_target,
3047         .im_transceive = pn533_transceive,
3048         .tm_send = pn533_tm_send,
3049 };
3050
3051 static int pn533_setup(struct pn533 *dev)
3052 {
3053         struct pn533_config_max_retries max_retries;
3054         struct pn533_config_timing timing;
3055         u8 pasori_cfg[3] = {0x08, 0x01, 0x08};
3056         int rc;
3057
3058         switch (dev->device_type) {
3059         case PN533_DEVICE_STD:
3060         case PN533_DEVICE_PASORI:
3061         case PN533_DEVICE_ACR122U:
3062                 max_retries.mx_rty_atr = 0x2;
3063                 max_retries.mx_rty_psl = 0x1;
3064                 max_retries.mx_rty_passive_act =
3065                         PN533_CONFIG_MAX_RETRIES_NO_RETRY;
3066
3067                 timing.rfu = PN533_CONFIG_TIMING_102;
3068                 timing.atr_res_timeout = PN533_CONFIG_TIMING_102;
3069                 timing.dep_timeout = PN533_CONFIG_TIMING_204;
3070
3071                 break;
3072
3073         default:
3074                 nfc_err(&dev->interface->dev, "Unknown device type %d\n",
3075                         dev->device_type);
3076                 return -EINVAL;
3077         }
3078
3079         rc = pn533_set_configuration(dev, PN533_CFGITEM_MAX_RETRIES,
3080                                      (u8 *)&max_retries, sizeof(max_retries));
3081         if (rc) {
3082                 nfc_err(&dev->interface->dev,
3083                         "Error on setting MAX_RETRIES config\n");
3084                 return rc;
3085         }
3086
3087
3088         rc = pn533_set_configuration(dev, PN533_CFGITEM_TIMING,
3089                                      (u8 *)&timing, sizeof(timing));
3090         if (rc) {
3091                 nfc_err(&dev->interface->dev, "Error on setting RF timings\n");
3092                 return rc;
3093         }
3094
3095         switch (dev->device_type) {
3096         case PN533_DEVICE_STD:
3097                 break;
3098
3099         case PN533_DEVICE_PASORI:
3100                 pn533_pasori_fw_reset(dev);
3101
3102                 rc = pn533_set_configuration(dev, PN533_CFGITEM_PASORI,
3103                                              pasori_cfg, 3);
3104                 if (rc) {
3105                         nfc_err(&dev->interface->dev,
3106                                 "Error while settings PASORI config\n");
3107                         return rc;
3108                 }
3109
3110                 pn533_pasori_fw_reset(dev);
3111
3112                 break;
3113         }
3114
3115         return 0;
3116 }
3117
3118 static int pn533_probe(struct usb_interface *interface,
3119                         const struct usb_device_id *id)
3120 {
3121         struct pn533_fw_version fw_ver;
3122         struct pn533 *dev;
3123         struct usb_host_interface *iface_desc;
3124         struct usb_endpoint_descriptor *endpoint;
3125         int in_endpoint = 0;
3126         int out_endpoint = 0;
3127         int rc = -ENOMEM;
3128         int i;
3129         u32 protocols;
3130
3131         dev = kzalloc(sizeof(*dev), GFP_KERNEL);
3132         if (!dev)
3133                 return -ENOMEM;
3134
3135         dev->udev = usb_get_dev(interface_to_usbdev(interface));
3136         dev->interface = interface;
3137         mutex_init(&dev->cmd_lock);
3138
3139         iface_desc = interface->cur_altsetting;
3140         for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
3141                 endpoint = &iface_desc->endpoint[i].desc;
3142
3143                 if (!in_endpoint && usb_endpoint_is_bulk_in(endpoint))
3144                         in_endpoint = endpoint->bEndpointAddress;
3145
3146                 if (!out_endpoint && usb_endpoint_is_bulk_out(endpoint))
3147                         out_endpoint = endpoint->bEndpointAddress;
3148         }
3149
3150         if (!in_endpoint || !out_endpoint) {
3151                 nfc_err(&interface->dev,
3152                         "Could not find bulk-in or bulk-out endpoint\n");
3153                 rc = -ENODEV;
3154                 goto error;
3155         }
3156
3157         dev->in_urb = usb_alloc_urb(0, GFP_KERNEL);
3158         dev->out_urb = usb_alloc_urb(0, GFP_KERNEL);
3159
3160         if (!dev->in_urb || !dev->out_urb)
3161                 goto error;
3162
3163         usb_fill_bulk_urb(dev->in_urb, dev->udev,
3164                           usb_rcvbulkpipe(dev->udev, in_endpoint),
3165                           NULL, 0, NULL, dev);
3166         usb_fill_bulk_urb(dev->out_urb, dev->udev,
3167                           usb_sndbulkpipe(dev->udev, out_endpoint),
3168                           NULL, 0, pn533_send_complete, dev);
3169
3170         INIT_WORK(&dev->cmd_work, pn533_wq_cmd);
3171         INIT_WORK(&dev->cmd_complete_work, pn533_wq_cmd_complete);
3172         INIT_WORK(&dev->mi_rx_work, pn533_wq_mi_recv);
3173         INIT_WORK(&dev->mi_tx_work, pn533_wq_mi_send);
3174         INIT_WORK(&dev->tg_work, pn533_wq_tg_get_data);
3175         INIT_WORK(&dev->mi_tm_rx_work, pn533_wq_tm_mi_recv);
3176         INIT_WORK(&dev->mi_tm_tx_work, pn533_wq_tm_mi_send);
3177         INIT_DELAYED_WORK(&dev->poll_work, pn533_wq_poll);
3178         INIT_WORK(&dev->rf_work, pn533_wq_rf);
3179         dev->wq = alloc_ordered_workqueue("pn533", 0);
3180         if (dev->wq == NULL)
3181                 goto error;
3182
3183         init_timer(&dev->listen_timer);
3184         dev->listen_timer.data = (unsigned long) dev;
3185         dev->listen_timer.function = pn533_listen_mode_timer;
3186
3187         skb_queue_head_init(&dev->resp_q);
3188         skb_queue_head_init(&dev->fragment_skb);
3189
3190         INIT_LIST_HEAD(&dev->cmd_queue);
3191
3192         usb_set_intfdata(interface, dev);
3193
3194         dev->ops = &pn533_std_frame_ops;
3195
3196         dev->protocol_type = PN533_PROTO_REQ_ACK_RESP;
3197         dev->device_type = id->driver_info;
3198         switch (dev->device_type) {
3199         case PN533_DEVICE_STD:
3200                 protocols = PN533_ALL_PROTOCOLS;
3201                 break;
3202
3203         case PN533_DEVICE_PASORI:
3204                 protocols = PN533_NO_TYPE_B_PROTOCOLS;
3205                 break;
3206
3207         case PN533_DEVICE_ACR122U:
3208                 protocols = PN533_NO_TYPE_B_PROTOCOLS;
3209                 dev->ops = &pn533_acr122_frame_ops;
3210                 dev->protocol_type = PN533_PROTO_REQ_RESP,
3211
3212                 rc = pn533_acr122_poweron_rdr(dev);
3213                 if (rc < 0) {
3214                         nfc_err(&dev->interface->dev,
3215                                 "Couldn't poweron the reader (error %d)\n", rc);
3216                         goto destroy_wq;
3217                 }
3218                 break;
3219
3220         default:
3221                 nfc_err(&dev->interface->dev, "Unknown device type %d\n",
3222                         dev->device_type);
3223                 rc = -EINVAL;
3224                 goto destroy_wq;
3225         }
3226
3227         memset(&fw_ver, 0, sizeof(fw_ver));
3228         rc = pn533_get_firmware_version(dev, &fw_ver);
3229         if (rc < 0)
3230                 goto destroy_wq;
3231
3232         nfc_info(&dev->interface->dev,
3233                  "NXP PN5%02X firmware ver %d.%d now attached\n",
3234                  fw_ver.ic, fw_ver.ver, fw_ver.rev);
3235
3236
3237         dev->nfc_dev = nfc_allocate_device(&pn533_nfc_ops, protocols,
3238                                            dev->ops->tx_header_len +
3239                                            PN533_CMD_DATAEXCH_HEAD_LEN,
3240                                            dev->ops->tx_tail_len);
3241         if (!dev->nfc_dev) {
3242                 rc = -ENOMEM;
3243                 goto destroy_wq;
3244         }
3245
3246         nfc_set_parent_dev(dev->nfc_dev, &interface->dev);
3247         nfc_set_drvdata(dev->nfc_dev, dev);
3248
3249         rc = nfc_register_device(dev->nfc_dev);
3250         if (rc)
3251                 goto free_nfc_dev;
3252
3253         rc = pn533_setup(dev);
3254         if (rc)
3255                 goto unregister_nfc_dev;
3256
3257         return 0;
3258
3259 unregister_nfc_dev:
3260         nfc_unregister_device(dev->nfc_dev);
3261
3262 free_nfc_dev:
3263         nfc_free_device(dev->nfc_dev);
3264
3265 destroy_wq:
3266         destroy_workqueue(dev->wq);
3267 error:
3268         usb_free_urb(dev->in_urb);
3269         usb_free_urb(dev->out_urb);
3270         usb_put_dev(dev->udev);
3271         kfree(dev);
3272         return rc;
3273 }
3274
3275 static void pn533_disconnect(struct usb_interface *interface)
3276 {
3277         struct pn533 *dev;
3278         struct pn533_cmd *cmd, *n;
3279
3280         dev = usb_get_intfdata(interface);
3281         usb_set_intfdata(interface, NULL);
3282
3283         nfc_unregister_device(dev->nfc_dev);
3284         nfc_free_device(dev->nfc_dev);
3285
3286         usb_kill_urb(dev->in_urb);
3287         usb_kill_urb(dev->out_urb);
3288
3289         flush_delayed_work(&dev->poll_work);
3290         destroy_workqueue(dev->wq);
3291
3292         skb_queue_purge(&dev->resp_q);
3293
3294         del_timer(&dev->listen_timer);
3295
3296         list_for_each_entry_safe(cmd, n, &dev->cmd_queue, queue) {
3297                 list_del(&cmd->queue);
3298                 kfree(cmd);
3299         }
3300
3301         usb_free_urb(dev->in_urb);
3302         usb_free_urb(dev->out_urb);
3303         kfree(dev);
3304
3305         nfc_info(&interface->dev, "NXP PN533 NFC device disconnected\n");
3306 }
3307
3308 static struct usb_driver pn533_driver = {
3309         .name =         "pn533",
3310         .probe =        pn533_probe,
3311         .disconnect =   pn533_disconnect,
3312         .id_table =     pn533_table,
3313 };
3314
3315 module_usb_driver(pn533_driver);
3316
3317 MODULE_AUTHOR("Lauro Ramos Venancio <lauro.venancio@openbossa.org>");
3318 MODULE_AUTHOR("Aloisio Almeida Jr <aloisio.almeida@openbossa.org>");
3319 MODULE_AUTHOR("Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>");
3320 MODULE_DESCRIPTION("PN533 usb driver ver " VERSION);
3321 MODULE_VERSION(VERSION);
3322 MODULE_LICENSE("GPL");