drivers/nfc/pn533.c

   1 /*
   2  * Copyright (C) 2011 Instituto Nokia de Tecnologia
   3  *
   4  * Authors:
   5  *    Lauro Ramos Venancio <lauro.venancio@openbossa.org>
   6  *    Aloisio Almeida Jr <aloisio.almeida@openbossa.org>
   7  *
   8  * This program is free software; you can redistribute it and/or modify
   9  * it under the terms of the GNU General Public License as published by
  10  * the Free Software Foundation; either version 2 of the License, or
  11  * (at your option) any later version.
  12  *
  13  * This program is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  16  * GNU General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License
  19  * along with this program; if not, write to the
  20  * Free Software Foundation, Inc.,
  21  * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
  22  */
  23
  24 #include <linux/device.h>
  25 #include <linux/kernel.h>
  26 #include <linux/module.h>
  27 #include <linux/slab.h>
  28 #include <linux/usb.h>
  29 #include <linux/nfc.h>
  30 #include <linux/netdevice.h>
  31 #include <net/nfc/nfc.h>
  32
  33 #define VERSION "0.1"
  34
  35 #define PN533_VENDOR_ID 0x4CC
  36 #define PN533_PRODUCT_ID 0x2533
  37
  38 #define SCM_VENDOR_ID 0x4E6
  39 #define SCL3711_PRODUCT_ID 0x5591
  40
  41 #define SONY_VENDOR_ID         0x054c
  42 #define PASORI_PRODUCT_ID      0x02e1
  43
  44 #define PN533_DEVICE_STD    0x1
  45 #define PN533_DEVICE_PASORI 0x2
  46
  47 #define PN533_ALL_PROTOCOLS (NFC_PROTO_JEWEL_MASK | NFC_PROTO_MIFARE_MASK |\
  48                              NFC_PROTO_FELICA_MASK | NFC_PROTO_ISO14443_MASK |\
  49                              NFC_PROTO_NFC_DEP_MASK |\
  50                              NFC_PROTO_ISO14443_B_MASK)
  51
  52 #define PN533_NO_TYPE_B_PROTOCOLS (NFC_PROTO_JEWEL_MASK | \
  53                                    NFC_PROTO_MIFARE_MASK | \
  54                                    NFC_PROTO_FELICA_MASK | \
  55                                    NFC_PROTO_ISO14443_MASK | \
  56                                    NFC_PROTO_NFC_DEP_MASK)
  57
  58 static const struct usb_device_id pn533_table[] = {
  59         { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE,
  60           .idVendor             = PN533_VENDOR_ID,
  61           .idProduct            = PN533_PRODUCT_ID,
  62           .driver_info          = PN533_DEVICE_STD,
  63         },
  64         { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE,
  65           .idVendor             = SCM_VENDOR_ID,
  66           .idProduct            = SCL3711_PRODUCT_ID,
  67           .driver_info          = PN533_DEVICE_STD,
  68         },
  69         { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE,
  70           .idVendor             = SONY_VENDOR_ID,
  71           .idProduct            = PASORI_PRODUCT_ID,
  72           .driver_info          = PN533_DEVICE_PASORI,
  73         },
  74         { }
  75 };
  76 MODULE_DEVICE_TABLE(usb, pn533_table);
  77
  78 /* How much time we spend listening for initiators */
  79 #define PN533_LISTEN_TIME 2
  80
  81 /* frame definitions */
  82 #define PN533_NORMAL_FRAME_MAX_LEN 262  /* 6   (PREAMBLE, SOF, LEN, LCS, TFI)
  83                                            254 (DATA)
  84                                            2   (DCS, postamble) */
  85 #define PN533_FRAME_HEADER_LEN (sizeof(struct pn533_frame) \
  86                                         + 2) /* data[0] TFI, data[1] CC */
  87 #define PN533_FRAME_TAIL_LEN 2 /* data[len] DCS, data[len + 1] postamble*/
  88
  89 /*
  90  * Max extended frame payload len, excluding TFI and CC
  91  * which are already in PN533_FRAME_HEADER_LEN.
  92  */
  93 #define PN533_FRAME_MAX_PAYLOAD_LEN 263
  94
  95 #define PN533_FRAME_SIZE(f) (sizeof(struct pn533_frame) + f->datalen + \
  96                                 PN533_FRAME_TAIL_LEN)
  97 #define PN533_FRAME_ACK_SIZE (sizeof(struct pn533_frame) + 1)
  98 #define PN533_FRAME_CHECKSUM(f) (f->data[f->datalen])
  99 #define PN533_FRAME_POSTAMBLE(f) (f->data[f->datalen + 1])
 100
 101 /* start of frame */
 102 #define PN533_SOF 0x00FF
 103
 104 /* frame identifier: in/out/error */
 105 #define PN533_FRAME_IDENTIFIER(f) (f->data[0])
 106 #define PN533_DIR_OUT 0xD4
 107 #define PN533_DIR_IN 0xD5
 108
 109 /* PN533 Commands */
 110 #define PN533_FRAME_CMD(f) (f->data[1])
 111 #define PN533_FRAME_CMD_PARAMS_PTR(f) (&f->data[2])
 112 #define PN533_FRAME_CMD_PARAMS_LEN(f) (f->datalen - 2)
 113
 114 #define PN533_CMD_GET_FIRMWARE_VERSION 0x02
 115 #define PN533_CMD_RF_CONFIGURATION 0x32
 116 #define PN533_CMD_IN_DATA_EXCHANGE 0x40
 117 #define PN533_CMD_IN_COMM_THRU     0x42
 118 #define PN533_CMD_IN_LIST_PASSIVE_TARGET 0x4A
 119 #define PN533_CMD_IN_ATR 0x50
 120 #define PN533_CMD_IN_RELEASE 0x52
 121 #define PN533_CMD_IN_JUMP_FOR_DEP 0x56
 122
 123 #define PN533_CMD_TG_INIT_AS_TARGET 0x8c
 124 #define PN533_CMD_TG_GET_DATA 0x86
 125 #define PN533_CMD_TG_SET_DATA 0x8e
 126 #define PN533_CMD_UNDEF 0xff
 127
 128 #define PN533_CMD_RESPONSE(cmd) (cmd + 1)
 129
 130 /* PN533 Return codes */
 131 #define PN533_CMD_RET_MASK 0x3F
 132 #define PN533_CMD_MI_MASK 0x40
 133 #define PN533_CMD_RET_SUCCESS 0x00
 134
 135 struct pn533;
 136
 137 typedef int (*pn533_cmd_complete_t) (struct pn533 *dev, void *arg,
 138                                         u8 *params, int params_len);
 139
 140 typedef int (*pn533_send_async_complete_t) (struct pn533 *dev, void *arg,
 141                                         struct sk_buff *resp);
 142
 143 /* structs for pn533 commands */
 144
 145 /* PN533_CMD_GET_FIRMWARE_VERSION */
 146 struct pn533_fw_version {
 147         u8 ic;
 148         u8 ver;
 149         u8 rev;
 150         u8 support;
 151 };
 152
 153 /* PN533_CMD_RF_CONFIGURATION */
 154 #define PN533_CFGITEM_TIMING 0x02
 155 #define PN533_CFGITEM_MAX_RETRIES 0x05
 156 #define PN533_CFGITEM_PASORI 0x82
 157
 158 #define PN533_CONFIG_TIMING_102 0xb
 159 #define PN533_CONFIG_TIMING_204 0xc
 160 #define PN533_CONFIG_TIMING_409 0xd
 161 #define PN533_CONFIG_TIMING_819 0xe
 162
 163 #define PN533_CONFIG_MAX_RETRIES_NO_RETRY 0x00
 164 #define PN533_CONFIG_MAX_RETRIES_ENDLESS 0xFF
 165
 166 struct pn533_config_max_retries {
 167         u8 mx_rty_atr;
 168         u8 mx_rty_psl;
 169         u8 mx_rty_passive_act;
 170 } __packed;
 171
 172 struct pn533_config_timing {
 173         u8 rfu;
 174         u8 atr_res_timeout;
 175         u8 dep_timeout;
 176 } __packed;
 177
 178 /* PN533_CMD_IN_LIST_PASSIVE_TARGET */
 179
 180 /* felica commands opcode */
 181 #define PN533_FELICA_OPC_SENSF_REQ 0
 182 #define PN533_FELICA_OPC_SENSF_RES 1
 183 /* felica SENSF_REQ parameters */
 184 #define PN533_FELICA_SENSF_SC_ALL 0xFFFF
 185 #define PN533_FELICA_SENSF_RC_NO_SYSTEM_CODE 0
 186 #define PN533_FELICA_SENSF_RC_SYSTEM_CODE 1
 187 #define PN533_FELICA_SENSF_RC_ADVANCED_PROTOCOL 2
 188
 189 /* type B initiator_data values */
 190 #define PN533_TYPE_B_AFI_ALL_FAMILIES 0
 191 #define PN533_TYPE_B_POLL_METHOD_TIMESLOT 0
 192 #define PN533_TYPE_B_POLL_METHOD_PROBABILISTIC 1
 193
 194 union pn533_cmd_poll_initdata {
 195         struct {
 196                 u8 afi;
 197                 u8 polling_method;
 198         } __packed type_b;
 199         struct {
 200                 u8 opcode;
 201                 __be16 sc;
 202                 u8 rc;
 203                 u8 tsn;
 204         } __packed felica;
 205 };
 206
 207 /* Poll modulations */
 208 enum {
 209         PN533_POLL_MOD_106KBPS_A,
 210         PN533_POLL_MOD_212KBPS_FELICA,
 211         PN533_POLL_MOD_424KBPS_FELICA,
 212         PN533_POLL_MOD_106KBPS_JEWEL,
 213         PN533_POLL_MOD_847KBPS_B,
 214         PN533_LISTEN_MOD,
 215
 216         __PN533_POLL_MOD_AFTER_LAST,
 217 };
 218 #define PN533_POLL_MOD_MAX (__PN533_POLL_MOD_AFTER_LAST - 1)
 219
 220 struct pn533_poll_modulations {
 221         struct {
 222                 u8 maxtg;
 223                 u8 brty;
 224                 union pn533_cmd_poll_initdata initiator_data;
 225         } __packed data;
 226         u8 len;
 227 };
 228
 229 const struct pn533_poll_modulations poll_mod[] = {
 230         [PN533_POLL_MOD_106KBPS_A] = {
 231                 .data = {
 232                         .maxtg = 1,
 233                         .brty = 0,
 234                 },
 235                 .len = 2,
 236         },
 237         [PN533_POLL_MOD_212KBPS_FELICA] = {
 238                 .data = {
 239                         .maxtg = 1,
 240                         .brty = 1,
 241                         .initiator_data.felica = {
 242                                 .opcode = PN533_FELICA_OPC_SENSF_REQ,
 243                                 .sc = PN533_FELICA_SENSF_SC_ALL,
 244                                 .rc = PN533_FELICA_SENSF_RC_NO_SYSTEM_CODE,
 245                                 .tsn = 0,
 246                         },
 247                 },
 248                 .len = 7,
 249         },
 250         [PN533_POLL_MOD_424KBPS_FELICA] = {
 251                 .data = {
 252                         .maxtg = 1,
 253                         .brty = 2,
 254                         .initiator_data.felica = {
 255                                 .opcode = PN533_FELICA_OPC_SENSF_REQ,
 256                                 .sc = PN533_FELICA_SENSF_SC_ALL,
 257                                 .rc = PN533_FELICA_SENSF_RC_NO_SYSTEM_CODE,
 258                                 .tsn = 0,
 259                         },
 260                  },
 261                 .len = 7,
 262         },
 263         [PN533_POLL_MOD_106KBPS_JEWEL] = {
 264                 .data = {
 265                         .maxtg = 1,
 266                         .brty = 4,
 267                 },
 268                 .len = 2,
 269         },
 270         [PN533_POLL_MOD_847KBPS_B] = {
 271                 .data = {
 272                         .maxtg = 1,
 273                         .brty = 8,
 274                         .initiator_data.type_b = {
 275                                 .afi = PN533_TYPE_B_AFI_ALL_FAMILIES,
 276                                 .polling_method =
 277                                         PN533_TYPE_B_POLL_METHOD_TIMESLOT,
 278                         },
 279                 },
 280                 .len = 3,
 281         },
 282         [PN533_LISTEN_MOD] = {
 283                 .len = 0,
 284         },
 285 };
 286
 287 /* PN533_CMD_IN_ATR */
 288
 289 struct pn533_cmd_activate_response {
 290         u8 status;
 291         u8 nfcid3t[10];
 292         u8 didt;
 293         u8 bst;
 294         u8 brt;
 295         u8 to;
 296         u8 ppt;
 297         /* optional */
 298         u8 gt[];
 299 } __packed;
 300
 301 struct pn533_cmd_jump_dep_response {
 302         u8 status;
 303         u8 tg;
 304         u8 nfcid3t[10];
 305         u8 didt;
 306         u8 bst;
 307         u8 brt;
 308         u8 to;
 309         u8 ppt;
 310         /* optional */
 311         u8 gt[];
 312 } __packed;
 313
 314
 315 /* PN533_TG_INIT_AS_TARGET */
 316 #define PN533_INIT_TARGET_PASSIVE 0x1
 317 #define PN533_INIT_TARGET_DEP 0x2
 318
 319 #define PN533_INIT_TARGET_RESP_FRAME_MASK 0x3
 320 #define PN533_INIT_TARGET_RESP_ACTIVE     0x1
 321 #define PN533_INIT_TARGET_RESP_DEP        0x4
 322
 323 struct pn533_cmd_init_target {
 324         u8 mode;
 325         u8 mifare[6];
 326         u8 felica[18];
 327         u8 nfcid3[10];
 328         u8 gb_len;
 329         u8 gb[];
 330 } __packed;
 331
 332 struct pn533_cmd_init_target_response {
 333         u8 mode;
 334         u8 cmd[];
 335 } __packed;
 336
 337 struct pn533 {
 338         struct usb_device *udev;
 339         struct usb_interface *interface;
 340         struct nfc_dev *nfc_dev;
 341
 342         struct urb *out_urb;
 343         struct pn533_frame *out_frame;
 344
 345         struct urb *in_urb;
 346         struct pn533_frame *in_frame;
 347
 348         struct sk_buff_head resp_q;
 349
 350         struct workqueue_struct *wq;
 351         struct work_struct cmd_work;
 352         struct work_struct cmd_complete_work;
 353         struct work_struct poll_work;
 354         struct work_struct mi_work;
 355         struct work_struct tg_work;
 356         struct timer_list listen_timer;
 357         struct pn533_frame *wq_in_frame;
 358         int wq_in_error;
 359         int cancel_listen;
 360
 361         pn533_cmd_complete_t cmd_complete;
 362         void *cmd_complete_arg;
 363         struct mutex cmd_lock;
 364         u8 cmd;
 365
 366         struct pn533_poll_modulations *poll_mod_active[PN533_POLL_MOD_MAX + 1];
 367         u8 poll_mod_count;
 368         u8 poll_mod_curr;
 369         u32 poll_protocols;
 370         u32 listen_protocols;
 371
 372         u8 *gb;
 373         size_t gb_len;
 374
 375         u8 tgt_available_prots;
 376         u8 tgt_active_prot;
 377         u8 tgt_mode;
 378
 379         u32 device_type;
 380
 381         struct list_head cmd_queue;
 382         u8 cmd_pending;
 383 };
 384
 385 struct pn533_cmd {
 386         struct list_head queue;
 387         struct pn533_frame *out_frame;
 388         struct pn533_frame *in_frame;
 389         int in_frame_len;
 390         u8 cmd_code;
 391         struct sk_buff *req;
 392         struct sk_buff *resp;
 393         pn533_cmd_complete_t cmd_complete;
 394         void *arg;
 395 };
 396
 397 struct pn533_frame {
 398         u8 preamble;
 399         __be16 start_frame;
 400         u8 datalen;
 401         u8 datalen_checksum;
 402         u8 data[];
 403 } __packed;
 404
 405 /* The rule: value + checksum = 0 */
 406 static inline u8 pn533_checksum(u8 value)
 407 {
 408         return ~value + 1;
 409 }
 410
 411 /* The rule: sum(data elements) + checksum = 0 */
 412 static u8 pn533_data_checksum(u8 *data, int datalen)
 413 {
 414         u8 sum = 0;
 415         int i;
 416
 417         for (i = 0; i < datalen; i++)
 418                 sum += data[i];
 419
 420         return pn533_checksum(sum);
 421 }
 422
 423 /**
 424  * pn533_tx_frame_ack - create a ack frame
 425  * @frame:      The frame to be set as ack
 426  *
 427  * Ack is different type of standard frame. As a standard frame, it has
 428  * preamble and start_frame. However the checksum of this frame must fail,
 429  * i.e. datalen + datalen_checksum must NOT be zero. When the checksum test
 430  * fails and datalen = 0 and datalen_checksum = 0xFF, the frame is a ack.
 431  * After datalen_checksum field, the postamble is placed.
 432  */
 433 static void pn533_tx_frame_ack(struct pn533_frame *frame)
 434 {
 435         frame->preamble = 0;
 436         frame->start_frame = cpu_to_be16(PN533_SOF);
 437         frame->datalen = 0;
 438         frame->datalen_checksum = 0xFF;
 439         /* data[0] is used as postamble */
 440         frame->data[0] = 0;
 441 }
 442
 443 static void pn533_tx_frame_init(struct pn533_frame *frame, u8 cmd)
 444 {
 445         frame->preamble = 0;
 446         frame->start_frame = cpu_to_be16(PN533_SOF);
 447         PN533_FRAME_IDENTIFIER(frame) = PN533_DIR_OUT;
 448         PN533_FRAME_CMD(frame) = cmd;
 449         frame->datalen = 2;
 450 }
 451
 452 static void pn533_tx_frame_finish(struct pn533_frame *frame)
 453 {
 454         frame->datalen_checksum = pn533_checksum(frame->datalen);
 455
 456         PN533_FRAME_CHECKSUM(frame) =
 457                 pn533_data_checksum(frame->data, frame->datalen);
 458
 459         PN533_FRAME_POSTAMBLE(frame) = 0;
 460 }
 461
 462 static bool pn533_rx_frame_is_valid(struct pn533_frame *frame)
 463 {
 464         u8 checksum;
 465
 466         if (frame->start_frame != cpu_to_be16(PN533_SOF))
 467                 return false;
 468
 469         checksum = pn533_checksum(frame->datalen);
 470         if (checksum != frame->datalen_checksum)
 471                 return false;
 472
 473         checksum = pn533_data_checksum(frame->data, frame->datalen);
 474         if (checksum != PN533_FRAME_CHECKSUM(frame))
 475                 return false;
 476
 477         return true;
 478 }
 479
 480 static bool pn533_rx_frame_is_ack(struct pn533_frame *frame)
 481 {
 482         if (frame->start_frame != cpu_to_be16(PN533_SOF))
 483                 return false;
 484
 485         if (frame->datalen != 0 || frame->datalen_checksum != 0xFF)
 486                 return false;
 487
 488         return true;
 489 }
 490
 491 static bool pn533_rx_frame_is_cmd_response(struct pn533_frame *frame, u8 cmd)
 492 {
 493         return (PN533_FRAME_CMD(frame) == PN533_CMD_RESPONSE(cmd));
 494 }
 495
 496
 497 static void pn533_wq_cmd_complete(struct work_struct *work)
 498 {
 499         struct pn533 *dev = container_of(work, struct pn533, cmd_complete_work);
 500         struct pn533_frame *in_frame;
 501         int rc;
 502
 503         in_frame = dev->wq_in_frame;
 504
 505         if (dev->wq_in_error)
 506                 rc = dev->cmd_complete(dev, dev->cmd_complete_arg, NULL,
 507                                                         dev->wq_in_error);
 508         else
 509                 rc = dev->cmd_complete(dev, dev->cmd_complete_arg,
 510                                         PN533_FRAME_CMD_PARAMS_PTR(in_frame),
 511                                         PN533_FRAME_CMD_PARAMS_LEN(in_frame));
 512
 513         if (rc != -EINPROGRESS)
 514                 queue_work(dev->wq, &dev->cmd_work);
 515 }
 516
 517 static void pn533_recv_response(struct urb *urb)
 518 {
 519         struct pn533 *dev = urb->context;
 520         struct pn533_frame *in_frame;
 521
 522         dev->wq_in_frame = NULL;
 523
 524         switch (urb->status) {
 525         case 0:
 526                 /* success */
 527                 break;
 528         case -ECONNRESET:
 529         case -ENOENT:
 530         case -ESHUTDOWN:
 531                 nfc_dev_dbg(&dev->interface->dev, "Urb shutting down with"
 532                                                 " status: %d", urb->status);
 533                 dev->wq_in_error = urb->status;
 534                 goto sched_wq;
 535         default:
 536                 nfc_dev_err(&dev->interface->dev, "Nonzero urb status received:"
 537                                                         " %d", urb->status);
 538                 dev->wq_in_error = urb->status;
 539                 goto sched_wq;
 540         }
 541
 542         in_frame = dev->in_urb->transfer_buffer;
 543
 544         if (!pn533_rx_frame_is_valid(in_frame)) {
 545                 nfc_dev_err(&dev->interface->dev, "Received an invalid frame");
 546                 dev->wq_in_error = -EIO;
 547                 goto sched_wq;
 548         }
 549
 550         if (!pn533_rx_frame_is_cmd_response(in_frame, dev->cmd)) {
 551                 nfc_dev_err(&dev->interface->dev, "The received frame is not "
 552                                                 "response to the last command");
 553                 dev->wq_in_error = -EIO;
 554                 goto sched_wq;
 555         }
 556
 557         nfc_dev_dbg(&dev->interface->dev, "Received a valid frame");
 558         dev->wq_in_error = 0;
 559         dev->wq_in_frame = in_frame;
 560
 561 sched_wq:
 562         queue_work(dev->wq, &dev->cmd_complete_work);
 563 }
 564
 565 static int pn533_submit_urb_for_response(struct pn533 *dev, gfp_t flags)
 566 {
 567         dev->in_urb->complete = pn533_recv_response;
 568
 569         return usb_submit_urb(dev->in_urb, flags);
 570 }
 571
 572 static void pn533_recv_ack(struct urb *urb)
 573 {
 574         struct pn533 *dev = urb->context;
 575         struct pn533_frame *in_frame;
 576         int rc;
 577
 578         switch (urb->status) {
 579         case 0:
 580                 /* success */
 581                 break;
 582         case -ECONNRESET:
 583         case -ENOENT:
 584         case -ESHUTDOWN:
 585                 nfc_dev_dbg(&dev->interface->dev, "Urb shutting down with"
 586                                                 " status: %d", urb->status);
 587                 dev->wq_in_error = urb->status;
 588                 goto sched_wq;
 589         default:
 590                 nfc_dev_err(&dev->interface->dev, "Nonzero urb status received:"
 591                                                         " %d", urb->status);
 592                 dev->wq_in_error = urb->status;
 593                 goto sched_wq;
 594         }
 595
 596         in_frame = dev->in_urb->transfer_buffer;
 597
 598         if (!pn533_rx_frame_is_ack(in_frame)) {
 599                 nfc_dev_err(&dev->interface->dev, "Received an invalid ack");
 600                 dev->wq_in_error = -EIO;
 601                 goto sched_wq;
 602         }
 603
 604         nfc_dev_dbg(&dev->interface->dev, "Received a valid ack");
 605
 606         rc = pn533_submit_urb_for_response(dev, GFP_ATOMIC);
 607         if (rc) {
 608                 nfc_dev_err(&dev->interface->dev, "usb_submit_urb failed with"
 609                                                         " result %d", rc);
 610                 dev->wq_in_error = rc;
 611                 goto sched_wq;
 612         }
 613
 614         return;
 615
 616 sched_wq:
 617         dev->wq_in_frame = NULL;
 618         queue_work(dev->wq, &dev->cmd_complete_work);
 619 }
 620
 621 static int pn533_submit_urb_for_ack(struct pn533 *dev, gfp_t flags)
 622 {
 623         dev->in_urb->complete = pn533_recv_ack;
 624
 625         return usb_submit_urb(dev->in_urb, flags);
 626 }
 627
 628 static int pn533_send_ack(struct pn533 *dev, gfp_t flags)
 629 {
 630         int rc;
 631
 632         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
 633
 634         pn533_tx_frame_ack(dev->out_frame);
 635
 636         dev->out_urb->transfer_buffer = dev->out_frame;
 637         dev->out_urb->transfer_buffer_length = PN533_FRAME_ACK_SIZE;
 638         rc = usb_submit_urb(dev->out_urb, flags);
 639
 640         return rc;
 641 }
 642
 643 static int __pn533_send_cmd_frame_async(struct pn533 *dev,
 644                                         struct pn533_frame *out_frame,
 645                                         struct pn533_frame *in_frame,
 646                                         int in_frame_len,
 647                                         pn533_cmd_complete_t cmd_complete,
 648                                         void *arg)
 649 {
 650         int rc;
 651
 652         nfc_dev_dbg(&dev->interface->dev, "Sending command 0x%x",
 653                                                 PN533_FRAME_CMD(out_frame));
 654
 655         dev->cmd = PN533_FRAME_CMD(out_frame);
 656         dev->cmd_complete = cmd_complete;
 657         dev->cmd_complete_arg = arg;
 658
 659         dev->out_urb->transfer_buffer = out_frame;
 660         dev->out_urb->transfer_buffer_length =
 661                                 PN533_FRAME_SIZE(out_frame);
 662
 663         dev->in_urb->transfer_buffer = in_frame;
 664         dev->in_urb->transfer_buffer_length = in_frame_len;
 665
 666         rc = usb_submit_urb(dev->out_urb, GFP_KERNEL);
 667         if (rc)
 668                 return rc;
 669
 670         rc = pn533_submit_urb_for_ack(dev, GFP_KERNEL);
 671         if (rc)
 672                 goto error;
 673
 674         return 0;
 675
 676 error:
 677         usb_unlink_urb(dev->out_urb);
 678         return rc;
 679 }
 680
 681 static void pn533_build_cmd_frame(u8 cmd_code, struct sk_buff *skb)
 682 {
 683         struct pn533_frame *frame;
 684         /* payload is already there, just update datalen */
 685         int payload_len = skb->len;
 686
 687         skb_push(skb, PN533_FRAME_HEADER_LEN);
 688         skb_put(skb, PN533_FRAME_TAIL_LEN);
 689
 690         frame = (struct pn533_frame *)skb->data;
 691
 692         pn533_tx_frame_init(frame, cmd_code);
 693         frame->datalen += payload_len;
 694         pn533_tx_frame_finish(frame);
 695 }
 696
 697 struct pn533_send_async_complete_arg {
 698         pn533_send_async_complete_t  complete_cb;
 699         void *complete_cb_context;
 700         struct sk_buff *resp;
 701         struct sk_buff *req;
 702 };
 703
 704 static int pn533_send_async_complete(struct pn533 *dev, void *_arg, u8 *params,
 705                                      int params_len)
 706 {
 707         struct pn533_send_async_complete_arg *arg = _arg;
 708
 709         struct sk_buff *req = arg->req;
 710         struct sk_buff *resp = arg->resp;
 711
 712         struct pn533_frame *frame = (struct pn533_frame *)resp->data;
 713         int rc;
 714
 715         dev_kfree_skb(req);
 716
 717         if (params_len < 0) {
 718                 nfc_dev_err(&dev->interface->dev,
 719                             "Error %d when starting as a target",
 720                             params_len);
 721
 722                 arg->complete_cb(dev, arg->complete_cb_context,
 723                                  ERR_PTR(params_len));
 724                 rc = params_len;
 725                 dev_kfree_skb(resp);
 726                 goto out;
 727         }
 728
 729         skb_put(resp, PN533_FRAME_SIZE(frame));
 730         skb_pull(resp, PN533_FRAME_HEADER_LEN);
 731         skb_trim(resp, resp->len - PN533_FRAME_TAIL_LEN);
 732
 733         rc = arg->complete_cb(dev, arg->complete_cb_context, resp);
 734
 735 out:
 736         kfree(arg);
 737         return rc;
 738 }
 739
 740 static int __pn533_send_async(struct pn533 *dev, u8 cmd_code,
 741                               struct sk_buff *req, struct sk_buff *resp,
 742                               int resp_len,
 743                               pn533_send_async_complete_t complete_cb,
 744                               void *complete_cb_context)
 745 {
 746         struct pn533_cmd *cmd;
 747         struct pn533_send_async_complete_arg *arg;
 748         int rc = 0;
 749
 750         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
 751
 752         arg = kzalloc(sizeof(arg), GFP_KERNEL);
 753         if (!arg)
 754                 return -ENOMEM;
 755
 756         arg->complete_cb = complete_cb;
 757         arg->complete_cb_context = complete_cb_context;
 758         arg->resp = resp;
 759         arg->req = req;
 760
 761         pn533_build_cmd_frame(cmd_code, req);
 762
 763         mutex_lock(&dev->cmd_lock);
 764
 765         if (!dev->cmd_pending) {
 766                 rc = __pn533_send_cmd_frame_async(dev,
 767                                                   (struct pn533_frame *)req->data,
 768                                                   (struct pn533_frame *)resp->data,
 769                                                   resp_len, pn533_send_async_complete,
 770                                                   arg);
 771                 if (rc)
 772                         goto error;
 773
 774                 dev->cmd_pending = 1;
 775                 goto unlock;
 776         }
 777
 778         nfc_dev_dbg(&dev->interface->dev, "%s Queueing command", __func__);
 779
 780         cmd = kzalloc(sizeof(struct pn533_cmd), GFP_KERNEL);
 781         if (!cmd) {
 782                 rc = -ENOMEM;
 783                 goto error;
 784         }
 785
 786         INIT_LIST_HEAD(&cmd->queue);
 787         cmd->cmd_code = cmd_code;
 788         cmd->req = req;
 789         cmd->resp = resp;
 790         cmd->arg = arg;
 791
 792         list_add_tail(&cmd->queue, &dev->cmd_queue);
 793
 794         goto unlock;
 795
 796 error:
 797         kfree(arg);
 798 unlock:
 799         mutex_unlock(&dev->cmd_lock);
 800         return rc;
 801 }
 802
 803 static int pn533_send_data_async(struct pn533 *dev, u8 cmd_code,
 804                                  struct sk_buff *req,
 805                                  pn533_send_async_complete_t complete_cb,
 806                                  void *complete_cb_context)
 807 {
 808         struct sk_buff *resp;
 809         int rc;
 810         int  resp_len = PN533_FRAME_HEADER_LEN +
 811                         PN533_FRAME_MAX_PAYLOAD_LEN +
 812                         PN533_FRAME_TAIL_LEN;
 813
 814         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
 815
 816         resp = nfc_alloc_recv_skb(resp_len, GFP_KERNEL);
 817         if (!resp)
 818                 return -ENOMEM;
 819
 820         rc = __pn533_send_async(dev, cmd_code, req, resp, resp_len, complete_cb,
 821                                 complete_cb_context);
 822         if (rc)
 823                 dev_kfree_skb(resp);
 824
 825         return rc;
 826 }
 827
 828 static int pn533_send_cmd_async(struct pn533 *dev, u8 cmd_code,
 829                                 struct sk_buff *req,
 830                                 pn533_send_async_complete_t complete_cb,
 831                                 void *complete_cb_context)
 832 {
 833         struct sk_buff *resp;
 834         int rc;
 835
 836         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
 837
 838         resp = alloc_skb(PN533_NORMAL_FRAME_MAX_LEN, GFP_KERNEL);
 839         if (!resp)
 840                 return -ENOMEM;
 841
 842         rc = __pn533_send_async(dev, cmd_code, req, resp,
 843                                 PN533_NORMAL_FRAME_MAX_LEN,
 844                                 complete_cb, complete_cb_context);
 845         if (rc)
 846                 dev_kfree_skb(resp);
 847
 848         return rc;
 849 }
 850
 851 static void pn533_wq_cmd(struct work_struct *work)
 852 {
 853         struct pn533 *dev = container_of(work, struct pn533, cmd_work);
 854         struct pn533_cmd *cmd;
 855
 856         mutex_lock(&dev->cmd_lock);
 857
 858         if (list_empty(&dev->cmd_queue)) {
 859                 dev->cmd_pending = 0;
 860                 mutex_unlock(&dev->cmd_lock);
 861                 return;
 862         }
 863
 864         cmd = list_first_entry(&dev->cmd_queue, struct pn533_cmd, queue);
 865
 866         list_del(&cmd->queue);
 867
 868         mutex_unlock(&dev->cmd_lock);
 869
 870         if (cmd->cmd_code != PN533_CMD_UNDEF)
 871                 __pn533_send_cmd_frame_async(dev,
 872                                              (struct pn533_frame *)cmd->req->data,
 873                                              (struct pn533_frame *)cmd->resp->data,
 874                                              PN533_NORMAL_FRAME_MAX_LEN,
 875                                              pn533_send_async_complete,
 876                                              cmd->arg);
 877         else
 878                 __pn533_send_cmd_frame_async(dev, cmd->out_frame, cmd->in_frame,
 879                                              cmd->in_frame_len,
 880                                              cmd->cmd_complete, cmd->arg);
 881
 882         kfree(cmd);
 883 }
 884
 885 static int pn533_send_cmd_frame_async(struct pn533 *dev,
 886                                         struct pn533_frame *out_frame,
 887                                         struct pn533_frame *in_frame,
 888                                         int in_frame_len,
 889                                         pn533_cmd_complete_t cmd_complete,
 890                                         void *arg)
 891 {
 892         struct pn533_cmd *cmd;
 893         int rc = 0;
 894
 895         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
 896
 897         mutex_lock(&dev->cmd_lock);
 898
 899         if (!dev->cmd_pending) {
 900                 rc = __pn533_send_cmd_frame_async(dev, out_frame, in_frame,
 901                                                   in_frame_len, cmd_complete,
 902                                                   arg);
 903                 if (!rc)
 904                         dev->cmd_pending = 1;
 905
 906                 goto unlock;
 907         }
 908
 909         nfc_dev_dbg(&dev->interface->dev, "%s Queueing command", __func__);
 910
 911         cmd = kzalloc(sizeof(struct pn533_cmd), GFP_KERNEL);
 912         if (!cmd) {
 913                 rc = -ENOMEM;
 914                 goto unlock;
 915         }
 916
 917         INIT_LIST_HEAD(&cmd->queue);
 918         cmd->out_frame = out_frame;
 919         cmd->in_frame = in_frame;
 920         cmd->in_frame_len = in_frame_len;
 921         cmd->cmd_code = PN533_CMD_UNDEF;
 922         cmd->cmd_complete = cmd_complete;
 923         cmd->arg = arg;
 924
 925         list_add_tail(&cmd->queue, &dev->cmd_queue);
 926
 927 unlock:
 928         mutex_unlock(&dev->cmd_lock);
 929
 930         return rc;
 931 }
 932
 933 struct pn533_sync_cmd_response {
 934         struct sk_buff *resp;
 935         struct completion done;
 936 };
 937
 938 static int pn533_send_sync_complete(struct pn533 *dev, void *_arg,
 939                                     struct sk_buff *resp)
 940 {
 941         struct pn533_sync_cmd_response *arg = _arg;
 942
 943         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
 944
 945         arg->resp = resp;
 946         complete(&arg->done);
 947
 948         return 0;
 949 }
 950
 951 /*  pn533_send_cmd_sync
 952  *
 953  *  Please note the req parameter is freed inside the function to
 954  *  limit a number of return value interpretations by the caller.
 955  *
 956  *  1. negative in case of error during TX path -> req should be freed
 957  *
 958  *  2. negative in case of error during RX path -> req should not be freed
 959  *     as it's been already freed at the begining of RX path by
 960  *     async_complete_cb.
 961  *
 962  *  3. valid pointer in case of succesfult RX path
 963  *
 964  *  A caller has to check a return value with IS_ERR macro. If the test pass,
 965  *  the returned pointer is valid.
 966  *
 967  * */
 968 static struct sk_buff *pn533_send_cmd_sync(struct pn533 *dev, u8 cmd_code,
 969                                                struct sk_buff *req)
 970 {
 971         int rc;
 972         struct pn533_sync_cmd_response arg;
 973
 974         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
 975
 976         init_completion(&arg.done);
 977
 978         rc = pn533_send_cmd_async(dev, cmd_code, req,
 979                                   pn533_send_sync_complete, &arg);
 980         if (rc) {
 981                 dev_kfree_skb(req);
 982                 return ERR_PTR(rc);
 983         }
 984
 985         wait_for_completion(&arg.done);
 986
 987         return arg.resp;
 988 }
 989
 990 static void pn533_send_complete(struct urb *urb)
 991 {
 992         struct pn533 *dev = urb->context;
 993
 994         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
 995
 996         switch (urb->status) {
 997         case 0:
 998                 /* success */
 999                 break;
1000         case -ECONNRESET:
1001         case -ENOENT:
1002         case -ESHUTDOWN:
1003                 nfc_dev_dbg(&dev->interface->dev, "Urb shutting down with"
1004                                                 " status: %d", urb->status);
1005                 break;
1006         default:
1007                 nfc_dev_dbg(&dev->interface->dev, "Nonzero urb status received:"
1008                                                         " %d", urb->status);
1009         }
1010 }
1011
1012 static struct sk_buff *pn533_alloc_skb(unsigned int size)
1013 {
1014         struct sk_buff *skb;
1015
1016         skb = alloc_skb(PN533_FRAME_HEADER_LEN +
1017                         size +
1018                         PN533_FRAME_TAIL_LEN, GFP_KERNEL);
1019
1020         if (skb)
1021                 skb_reserve(skb, PN533_FRAME_HEADER_LEN);
1022
1023         return skb;
1024 }
1025
1026 struct pn533_target_type_a {
1027         __be16 sens_res;
1028         u8 sel_res;
1029         u8 nfcid_len;
1030         u8 nfcid_data[];
1031 } __packed;
1032
1033
1034 #define PN533_TYPE_A_SENS_RES_NFCID1(x) ((u8)((be16_to_cpu(x) & 0x00C0) >> 6))
1035 #define PN533_TYPE_A_SENS_RES_SSD(x) ((u8)((be16_to_cpu(x) & 0x001F) >> 0))
1036 #define PN533_TYPE_A_SENS_RES_PLATCONF(x) ((u8)((be16_to_cpu(x) & 0x0F00) >> 8))
1037
1038 #define PN533_TYPE_A_SENS_RES_SSD_JEWEL 0x00
1039 #define PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL 0x0C
1040
1041 #define PN533_TYPE_A_SEL_PROT(x) (((x) & 0x60) >> 5)
1042 #define PN533_TYPE_A_SEL_CASCADE(x) (((x) & 0x04) >> 2)
1043
1044 #define PN533_TYPE_A_SEL_PROT_MIFARE 0
1045 #define PN533_TYPE_A_SEL_PROT_ISO14443 1
1046 #define PN533_TYPE_A_SEL_PROT_DEP 2
1047 #define PN533_TYPE_A_SEL_PROT_ISO14443_DEP 3
1048
1049 static bool pn533_target_type_a_is_valid(struct pn533_target_type_a *type_a,
1050                                                         int target_data_len)
1051 {
1052         u8 ssd;
1053         u8 platconf;
1054
1055         if (target_data_len < sizeof(struct pn533_target_type_a))
1056                 return false;
1057
1058         /* The lenght check of nfcid[] and ats[] are not being performed because
1059            the values are not being used */
1060
1061         /* Requirement 4.6.3.3 from NFC Forum Digital Spec */
1062         ssd = PN533_TYPE_A_SENS_RES_SSD(type_a->sens_res);
1063         platconf = PN533_TYPE_A_SENS_RES_PLATCONF(type_a->sens_res);
1064
1065         if ((ssd == PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
1066                         platconf != PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL) ||
1067                         (ssd != PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
1068                         platconf == PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL))
1069                 return false;
1070
1071         /* Requirements 4.8.2.1, 4.8.2.3, 4.8.2.5 and 4.8.2.7 from NFC Forum */
1072         if (PN533_TYPE_A_SEL_CASCADE(type_a->sel_res) != 0)
1073                 return false;
1074
1075         return true;
1076 }
1077
1078 static int pn533_target_found_type_a(struct nfc_target *nfc_tgt, u8 *tgt_data,
1079                                                         int tgt_data_len)
1080 {
1081         struct pn533_target_type_a *tgt_type_a;
1082
1083         tgt_type_a = (struct pn533_target_type_a *) tgt_data;
1084
1085         if (!pn533_target_type_a_is_valid(tgt_type_a, tgt_data_len))
1086                 return -EPROTO;
1087
1088         switch (PN533_TYPE_A_SEL_PROT(tgt_type_a->sel_res)) {
1089         case PN533_TYPE_A_SEL_PROT_MIFARE:
1090                 nfc_tgt->supported_protocols = NFC_PROTO_MIFARE_MASK;
1091                 break;
1092         case PN533_TYPE_A_SEL_PROT_ISO14443:
1093                 nfc_tgt->supported_protocols = NFC_PROTO_ISO14443_MASK;
1094                 break;
1095         case PN533_TYPE_A_SEL_PROT_DEP:
1096                 nfc_tgt->supported_protocols = NFC_PROTO_NFC_DEP_MASK;
1097                 break;
1098         case PN533_TYPE_A_SEL_PROT_ISO14443_DEP:
1099                 nfc_tgt->supported_protocols = NFC_PROTO_ISO14443_MASK |
1100                                                         NFC_PROTO_NFC_DEP_MASK;
1101                 break;
1102         }
1103
1104         nfc_tgt->sens_res = be16_to_cpu(tgt_type_a->sens_res);
1105         nfc_tgt->sel_res = tgt_type_a->sel_res;
1106         nfc_tgt->nfcid1_len = tgt_type_a->nfcid_len;
1107         memcpy(nfc_tgt->nfcid1, tgt_type_a->nfcid_data, nfc_tgt->nfcid1_len);
1108
1109         return 0;
1110 }
1111
1112 struct pn533_target_felica {
1113         u8 pol_res;
1114         u8 opcode;
1115         u8 nfcid2[8];
1116         u8 pad[8];
1117         /* optional */
1118         u8 syst_code[];
1119 } __packed;
1120
1121 #define PN533_FELICA_SENSF_NFCID2_DEP_B1 0x01
1122 #define PN533_FELICA_SENSF_NFCID2_DEP_B2 0xFE
1123
1124 static bool pn533_target_felica_is_valid(struct pn533_target_felica *felica,
1125                                                         int target_data_len)
1126 {
1127         if (target_data_len < sizeof(struct pn533_target_felica))
1128                 return false;
1129
1130         if (felica->opcode != PN533_FELICA_OPC_SENSF_RES)
1131                 return false;
1132
1133         return true;
1134 }
1135
1136 static int pn533_target_found_felica(struct nfc_target *nfc_tgt, u8 *tgt_data,
1137                                                         int tgt_data_len)
1138 {
1139         struct pn533_target_felica *tgt_felica;
1140
1141         tgt_felica = (struct pn533_target_felica *) tgt_data;
1142
1143         if (!pn533_target_felica_is_valid(tgt_felica, tgt_data_len))
1144                 return -EPROTO;
1145
1146         if (tgt_felica->nfcid2[0] == PN533_FELICA_SENSF_NFCID2_DEP_B1 &&
1147                                         tgt_felica->nfcid2[1] ==
1148                                         PN533_FELICA_SENSF_NFCID2_DEP_B2)
1149                 nfc_tgt->supported_protocols = NFC_PROTO_NFC_DEP_MASK;
1150         else
1151                 nfc_tgt->supported_protocols = NFC_PROTO_FELICA_MASK;
1152
1153         memcpy(nfc_tgt->sensf_res, &tgt_felica->opcode, 9);
1154         nfc_tgt->sensf_res_len = 9;
1155
1156         return 0;
1157 }
1158
1159 struct pn533_target_jewel {
1160         __be16 sens_res;
1161         u8 jewelid[4];
1162 } __packed;
1163
1164 static bool pn533_target_jewel_is_valid(struct pn533_target_jewel *jewel,
1165                                                         int target_data_len)
1166 {
1167         u8 ssd;
1168         u8 platconf;
1169
1170         if (target_data_len < sizeof(struct pn533_target_jewel))
1171                 return false;
1172
1173         /* Requirement 4.6.3.3 from NFC Forum Digital Spec */
1174         ssd = PN533_TYPE_A_SENS_RES_SSD(jewel->sens_res);
1175         platconf = PN533_TYPE_A_SENS_RES_PLATCONF(jewel->sens_res);
1176
1177         if ((ssd == PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
1178                         platconf != PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL) ||
1179                         (ssd != PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
1180                         platconf == PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL))
1181                 return false;
1182
1183         return true;
1184 }
1185
1186 static int pn533_target_found_jewel(struct nfc_target *nfc_tgt, u8 *tgt_data,
1187                                                         int tgt_data_len)
1188 {
1189         struct pn533_target_jewel *tgt_jewel;
1190
1191         tgt_jewel = (struct pn533_target_jewel *) tgt_data;
1192
1193         if (!pn533_target_jewel_is_valid(tgt_jewel, tgt_data_len))
1194                 return -EPROTO;
1195
1196         nfc_tgt->supported_protocols = NFC_PROTO_JEWEL_MASK;
1197         nfc_tgt->sens_res = be16_to_cpu(tgt_jewel->sens_res);
1198         nfc_tgt->nfcid1_len = 4;
1199         memcpy(nfc_tgt->nfcid1, tgt_jewel->jewelid, nfc_tgt->nfcid1_len);
1200
1201         return 0;
1202 }
1203
1204 struct pn533_type_b_prot_info {
1205         u8 bitrate;
1206         u8 fsci_type;
1207         u8 fwi_adc_fo;
1208 } __packed;
1209
1210 #define PN533_TYPE_B_PROT_FCSI(x) (((x) & 0xF0) >> 4)
1211 #define PN533_TYPE_B_PROT_TYPE(x) (((x) & 0x0F) >> 0)
1212 #define PN533_TYPE_B_PROT_TYPE_RFU_MASK 0x8
1213
1214 struct pn533_type_b_sens_res {
1215         u8 opcode;
1216         u8 nfcid[4];
1217         u8 appdata[4];
1218         struct pn533_type_b_prot_info prot_info;
1219 } __packed;
1220
1221 #define PN533_TYPE_B_OPC_SENSB_RES 0x50
1222
1223 struct pn533_target_type_b {
1224         struct pn533_type_b_sens_res sensb_res;
1225         u8 attrib_res_len;
1226         u8 attrib_res[];
1227 } __packed;
1228
1229 static bool pn533_target_type_b_is_valid(struct pn533_target_type_b *type_b,
1230                                                         int target_data_len)
1231 {
1232         if (target_data_len < sizeof(struct pn533_target_type_b))
1233                 return false;
1234
1235         if (type_b->sensb_res.opcode != PN533_TYPE_B_OPC_SENSB_RES)
1236                 return false;
1237
1238         if (PN533_TYPE_B_PROT_TYPE(type_b->sensb_res.prot_info.fsci_type) &
1239                                                 PN533_TYPE_B_PROT_TYPE_RFU_MASK)
1240                 return false;
1241
1242         return true;
1243 }
1244
1245 static int pn533_target_found_type_b(struct nfc_target *nfc_tgt, u8 *tgt_data,
1246                                                         int tgt_data_len)
1247 {
1248         struct pn533_target_type_b *tgt_type_b;
1249
1250         tgt_type_b = (struct pn533_target_type_b *) tgt_data;
1251
1252         if (!pn533_target_type_b_is_valid(tgt_type_b, tgt_data_len))
1253                 return -EPROTO;
1254
1255         nfc_tgt->supported_protocols = NFC_PROTO_ISO14443_B_MASK;
1256
1257         return 0;
1258 }
1259
1260 struct pn533_poll_response {
1261         u8 nbtg;
1262         u8 tg;
1263         u8 target_data[];
1264 } __packed;
1265
1266 static int pn533_target_found(struct pn533 *dev,
1267                         struct pn533_poll_response *resp, int resp_len)
1268 {
1269         int target_data_len;
1270         struct nfc_target nfc_tgt;
1271         int rc;
1272
1273         nfc_dev_dbg(&dev->interface->dev, "%s - modulation=%d", __func__,
1274                                                         dev->poll_mod_curr);
1275
1276         if (resp->tg != 1)
1277                 return -EPROTO;
1278
1279         memset(&nfc_tgt, 0, sizeof(struct nfc_target));
1280
1281         target_data_len = resp_len - sizeof(struct pn533_poll_response);
1282
1283         switch (dev->poll_mod_curr) {
1284         case PN533_POLL_MOD_106KBPS_A:
1285                 rc = pn533_target_found_type_a(&nfc_tgt, resp->target_data,
1286                                                         target_data_len);
1287                 break;
1288         case PN533_POLL_MOD_212KBPS_FELICA:
1289         case PN533_POLL_MOD_424KBPS_FELICA:
1290                 rc = pn533_target_found_felica(&nfc_tgt, resp->target_data,
1291                                                         target_data_len);
1292                 break;
1293         case PN533_POLL_MOD_106KBPS_JEWEL:
1294                 rc = pn533_target_found_jewel(&nfc_tgt, resp->target_data,
1295                                                         target_data_len);
1296                 break;
1297         case PN533_POLL_MOD_847KBPS_B:
1298                 rc = pn533_target_found_type_b(&nfc_tgt, resp->target_data,
1299                                                         target_data_len);
1300                 break;
1301         default:
1302                 nfc_dev_err(&dev->interface->dev, "Unknown current poll"
1303                                                                 " modulation");
1304                 return -EPROTO;
1305         }
1306
1307         if (rc)
1308                 return rc;
1309
1310         if (!(nfc_tgt.supported_protocols & dev->poll_protocols)) {
1311                 nfc_dev_dbg(&dev->interface->dev, "The target found does not"
1312                                                 " have the desired protocol");
1313                 return -EAGAIN;
1314         }
1315
1316         nfc_dev_dbg(&dev->interface->dev, "Target found - supported protocols: "
1317                                         "0x%x", nfc_tgt.supported_protocols);
1318
1319         dev->tgt_available_prots = nfc_tgt.supported_protocols;
1320
1321         nfc_targets_found(dev->nfc_dev, &nfc_tgt, 1);
1322
1323         return 0;
1324 }
1325
1326 static inline void pn533_poll_next_mod(struct pn533 *dev)
1327 {
1328         dev->poll_mod_curr = (dev->poll_mod_curr + 1) % dev->poll_mod_count;
1329 }
1330
1331 static void pn533_poll_reset_mod_list(struct pn533 *dev)
1332 {
1333         dev->poll_mod_count = 0;
1334 }
1335
1336 static void pn533_poll_add_mod(struct pn533 *dev, u8 mod_index)
1337 {
1338         dev->poll_mod_active[dev->poll_mod_count] =
1339                 (struct pn533_poll_modulations *) &poll_mod[mod_index];
1340         dev->poll_mod_count++;
1341 }
1342
1343 static void pn533_poll_create_mod_list(struct pn533 *dev,
1344                                        u32 im_protocols, u32 tm_protocols)
1345 {
1346         pn533_poll_reset_mod_list(dev);
1347
1348         if (im_protocols & NFC_PROTO_MIFARE_MASK
1349             || im_protocols & NFC_PROTO_ISO14443_MASK
1350             || im_protocols & NFC_PROTO_NFC_DEP_MASK)
1351                 pn533_poll_add_mod(dev, PN533_POLL_MOD_106KBPS_A);
1352
1353         if (im_protocols & NFC_PROTO_FELICA_MASK
1354             || im_protocols & NFC_PROTO_NFC_DEP_MASK) {
1355                 pn533_poll_add_mod(dev, PN533_POLL_MOD_212KBPS_FELICA);
1356                 pn533_poll_add_mod(dev, PN533_POLL_MOD_424KBPS_FELICA);
1357         }
1358
1359         if (im_protocols & NFC_PROTO_JEWEL_MASK)
1360                 pn533_poll_add_mod(dev, PN533_POLL_MOD_106KBPS_JEWEL);
1361
1362         if (im_protocols & NFC_PROTO_ISO14443_B_MASK)
1363                 pn533_poll_add_mod(dev, PN533_POLL_MOD_847KBPS_B);
1364
1365         if (tm_protocols)
1366                 pn533_poll_add_mod(dev, PN533_LISTEN_MOD);
1367 }
1368
1369 static int pn533_start_poll_complete(struct pn533 *dev, u8 *params, int params_len)
1370 {
1371         struct pn533_poll_response *resp;
1372         int rc;
1373
1374         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1375
1376         resp = (struct pn533_poll_response *) params;
1377         if (resp->nbtg) {
1378                 rc = pn533_target_found(dev, resp, params_len);
1379
1380                 /* We must stop the poll after a valid target found */
1381                 if (rc == 0) {
1382                         pn533_poll_reset_mod_list(dev);
1383                         return 0;
1384                 }
1385         }
1386
1387         return -EAGAIN;
1388 }
1389
1390 static int pn533_init_target_frame(struct pn533_frame *frame,
1391                                    u8 *gb, size_t gb_len)
1392 {
1393         struct pn533_cmd_init_target *cmd;
1394         size_t cmd_len;
1395         u8 felica_params[18] = {0x1, 0xfe, /* DEP */
1396                                 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, /* random */
1397                                 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
1398                                 0xff, 0xff}; /* System code */
1399         u8 mifare_params[6] = {0x1, 0x1, /* SENS_RES */
1400                                0x0, 0x0, 0x0,
1401                                0x40}; /* SEL_RES for DEP */
1402
1403         cmd_len = sizeof(struct pn533_cmd_init_target) + gb_len + 1;
1404         cmd = kzalloc(cmd_len, GFP_KERNEL);
1405         if (cmd == NULL)
1406                 return -ENOMEM;
1407
1408         pn533_tx_frame_init(frame, PN533_CMD_TG_INIT_AS_TARGET);
1409
1410         /* DEP support only */
1411         cmd->mode |= PN533_INIT_TARGET_DEP;
1412
1413         /* Felica params */
1414         memcpy(cmd->felica, felica_params, 18);
1415         get_random_bytes(cmd->felica + 2, 6);
1416
1417         /* NFCID3 */
1418         memset(cmd->nfcid3, 0, 10);
1419         memcpy(cmd->nfcid3, cmd->felica, 8);
1420
1421         /* MIFARE params */
1422         memcpy(cmd->mifare, mifare_params, 6);
1423
1424         /* General bytes */
1425         cmd->gb_len = gb_len;
1426         memcpy(cmd->gb, gb, gb_len);
1427
1428         /* Len Tk */
1429         cmd->gb[gb_len] = 0;
1430
1431         memcpy(PN533_FRAME_CMD_PARAMS_PTR(frame), cmd, cmd_len);
1432
1433         frame->datalen += cmd_len;
1434
1435         pn533_tx_frame_finish(frame);
1436
1437         kfree(cmd);
1438
1439         return 0;
1440 }
1441
1442 #define PN533_CMD_DATAEXCH_HEAD_LEN 1
1443 #define PN533_CMD_DATAEXCH_DATA_MAXLEN 262
1444 static int pn533_tm_get_data_complete(struct pn533 *dev, void *arg,
1445                                       struct sk_buff *resp)
1446 {
1447         u8 status;
1448
1449         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1450
1451         if (IS_ERR(resp))
1452                 return PTR_ERR(resp);
1453
1454         status = resp->data[0];
1455         skb_pull(resp, sizeof(status));
1456
1457         if (status != 0) {
1458                 nfc_tm_deactivated(dev->nfc_dev);
1459                 dev->tgt_mode = 0;
1460                 dev_kfree_skb(resp);
1461                 return 0;
1462         }
1463
1464         return nfc_tm_data_received(dev->nfc_dev, resp);
1465 }
1466
1467 static void pn533_wq_tg_get_data(struct work_struct *work)
1468 {
1469         struct pn533 *dev = container_of(work, struct pn533, tg_work);
1470
1471         struct sk_buff *skb;
1472         int rc;
1473
1474         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1475
1476         skb = pn533_alloc_skb(0);
1477         if (!skb)
1478                 return;
1479
1480         rc = pn533_send_data_async(dev, PN533_CMD_TG_GET_DATA, skb,
1481                                    pn533_tm_get_data_complete, NULL);
1482
1483         if (rc < 0)
1484                 dev_kfree_skb(skb);
1485
1486         return;
1487 }
1488
1489 #define ATR_REQ_GB_OFFSET 17
1490 static int pn533_init_target_complete(struct pn533 *dev, u8 *params, int params_len)
1491 {
1492         struct pn533_cmd_init_target_response *resp;
1493         u8 frame, comm_mode = NFC_COMM_PASSIVE, *gb;
1494         size_t gb_len;
1495         int rc;
1496
1497         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1498
1499         if (params_len < 0) {
1500                 nfc_dev_err(&dev->interface->dev,
1501                             "Error %d when starting as a target",
1502                             params_len);
1503
1504                 return params_len;
1505         }
1506
1507         if (params_len < ATR_REQ_GB_OFFSET + 1)
1508                 return -EINVAL;
1509
1510         resp = (struct pn533_cmd_init_target_response *) params;
1511
1512         nfc_dev_dbg(&dev->interface->dev, "Target mode 0x%x param len %d\n",
1513                     resp->mode, params_len);
1514
1515         frame = resp->mode & PN533_INIT_TARGET_RESP_FRAME_MASK;
1516         if (frame == PN533_INIT_TARGET_RESP_ACTIVE)
1517                 comm_mode = NFC_COMM_ACTIVE;
1518
1519         /* Again, only DEP */
1520         if ((resp->mode & PN533_INIT_TARGET_RESP_DEP) == 0)
1521                 return -EOPNOTSUPP;
1522
1523         gb = resp->cmd + ATR_REQ_GB_OFFSET;
1524         gb_len = params_len - (ATR_REQ_GB_OFFSET + 1);
1525
1526         rc = nfc_tm_activated(dev->nfc_dev, NFC_PROTO_NFC_DEP_MASK,
1527                               comm_mode, gb, gb_len);
1528         if (rc < 0) {
1529                 nfc_dev_err(&dev->interface->dev,
1530                             "Error when signaling target activation");
1531                 return rc;
1532         }
1533
1534         dev->tgt_mode = 1;
1535
1536         queue_work(dev->wq, &dev->tg_work);
1537
1538         return 0;
1539 }
1540
1541 static void pn533_listen_mode_timer(unsigned long data)
1542 {
1543         struct pn533 *dev = (struct pn533 *) data;
1544
1545         nfc_dev_dbg(&dev->interface->dev, "Listen mode timeout");
1546
1547         /* An ack will cancel the last issued command (poll) */
1548         pn533_send_ack(dev, GFP_ATOMIC);
1549
1550         dev->cancel_listen = 1;
1551
1552         pn533_poll_next_mod(dev);
1553
1554         queue_work(dev->wq, &dev->poll_work);
1555 }
1556
1557 static int pn533_poll_complete(struct pn533 *dev, void *arg,
1558                                u8 *params, int params_len)
1559 {
1560         struct pn533_poll_modulations *cur_mod;
1561         int rc;
1562
1563         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1564
1565         if (params_len == -ENOENT) {
1566                 if (dev->poll_mod_count != 0)
1567                         return 0;
1568
1569                 nfc_dev_err(&dev->interface->dev,
1570                             "Polling operation has been stopped");
1571
1572                 goto stop_poll;
1573         }
1574
1575         if (params_len < 0) {
1576                 nfc_dev_err(&dev->interface->dev,
1577                             "Error %d when running poll", params_len);
1578
1579                 goto stop_poll;
1580         }
1581
1582         cur_mod = dev->poll_mod_active[dev->poll_mod_curr];
1583
1584         if (cur_mod->len == 0) {
1585                 del_timer(&dev->listen_timer);
1586
1587                 return pn533_init_target_complete(dev, params, params_len);
1588         } else {
1589                 rc = pn533_start_poll_complete(dev, params, params_len);
1590                 if (!rc)
1591                         return rc;
1592         }
1593
1594         pn533_poll_next_mod(dev);
1595
1596         queue_work(dev->wq, &dev->poll_work);
1597
1598         return 0;
1599
1600 stop_poll:
1601         pn533_poll_reset_mod_list(dev);
1602         dev->poll_protocols = 0;
1603         return 0;
1604 }
1605
1606 static void pn533_build_poll_frame(struct pn533 *dev,
1607                                    struct pn533_frame *frame,
1608                                    struct pn533_poll_modulations *mod)
1609 {
1610         nfc_dev_dbg(&dev->interface->dev, "mod len %d\n", mod->len);
1611
1612         if (mod->len == 0) {
1613                 /* Listen mode */
1614                 pn533_init_target_frame(frame, dev->gb, dev->gb_len);
1615         } else {
1616                 /* Polling mode */
1617                 pn533_tx_frame_init(frame, PN533_CMD_IN_LIST_PASSIVE_TARGET);
1618
1619                 memcpy(PN533_FRAME_CMD_PARAMS_PTR(frame), &mod->data, mod->len);
1620                 frame->datalen += mod->len;
1621
1622                 pn533_tx_frame_finish(frame);
1623         }
1624 }
1625
1626 static int pn533_send_poll_frame(struct pn533 *dev)
1627 {
1628         struct pn533_poll_modulations *cur_mod;
1629         int rc;
1630
1631         cur_mod = dev->poll_mod_active[dev->poll_mod_curr];
1632
1633         pn533_build_poll_frame(dev, dev->out_frame, cur_mod);
1634
1635         rc = pn533_send_cmd_frame_async(dev, dev->out_frame, dev->in_frame,
1636                                         PN533_NORMAL_FRAME_MAX_LEN,
1637                                         pn533_poll_complete,
1638                                         NULL);
1639         if (rc)
1640                 nfc_dev_err(&dev->interface->dev, "Polling loop error %d", rc);
1641
1642         return rc;
1643 }
1644
1645 static void pn533_wq_poll(struct work_struct *work)
1646 {
1647         struct pn533 *dev = container_of(work, struct pn533, poll_work);
1648         struct pn533_poll_modulations *cur_mod;
1649         int rc;
1650
1651         cur_mod = dev->poll_mod_active[dev->poll_mod_curr];
1652
1653         nfc_dev_dbg(&dev->interface->dev,
1654                     "%s cancel_listen %d modulation len %d",
1655                     __func__, dev->cancel_listen, cur_mod->len);
1656
1657         if (dev->cancel_listen == 1) {
1658                 dev->cancel_listen = 0;
1659                 usb_kill_urb(dev->in_urb);
1660         }
1661
1662         rc = pn533_send_poll_frame(dev);
1663         if (rc)
1664                 return;
1665
1666         if (cur_mod->len == 0 && dev->poll_mod_count > 1)
1667                 mod_timer(&dev->listen_timer, jiffies + PN533_LISTEN_TIME * HZ);
1668
1669         return;
1670 }
1671
1672 static int pn533_start_poll(struct nfc_dev *nfc_dev,
1673                             u32 im_protocols, u32 tm_protocols)
1674 {
1675         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
1676
1677         nfc_dev_dbg(&dev->interface->dev,
1678                     "%s: im protocols 0x%x tm protocols 0x%x",
1679                     __func__, im_protocols, tm_protocols);
1680
1681         if (dev->tgt_active_prot) {
1682                 nfc_dev_err(&dev->interface->dev,
1683                             "Cannot poll with a target already activated");
1684                 return -EBUSY;
1685         }
1686
1687         if (dev->tgt_mode) {
1688                 nfc_dev_err(&dev->interface->dev,
1689                             "Cannot poll while already being activated");
1690                 return -EBUSY;
1691         }
1692
1693         if (tm_protocols) {
1694                 dev->gb = nfc_get_local_general_bytes(nfc_dev, &dev->gb_len);
1695                 if (dev->gb == NULL)
1696                         tm_protocols = 0;
1697         }
1698
1699         dev->poll_mod_curr = 0;
1700         pn533_poll_create_mod_list(dev, im_protocols, tm_protocols);
1701         dev->poll_protocols = im_protocols;
1702         dev->listen_protocols = tm_protocols;
1703
1704         return pn533_send_poll_frame(dev);
1705 }
1706
1707 static void pn533_stop_poll(struct nfc_dev *nfc_dev)
1708 {
1709         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
1710
1711         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1712
1713         del_timer(&dev->listen_timer);
1714
1715         if (!dev->poll_mod_count) {
1716                 nfc_dev_dbg(&dev->interface->dev, "Polling operation was not"
1717                                                                 " running");
1718                 return;
1719         }
1720
1721         /* An ack will cancel the last issued command (poll) */
1722         pn533_send_ack(dev, GFP_KERNEL);
1723
1724         /* prevent pn533_start_poll_complete to issue a new poll meanwhile */
1725         usb_kill_urb(dev->in_urb);
1726
1727         pn533_poll_reset_mod_list(dev);
1728 }
1729
1730 static int pn533_activate_target_nfcdep(struct pn533 *dev)
1731 {
1732         struct pn533_cmd_activate_response *rsp;
1733         u16 gt_len;
1734         int rc;
1735
1736         struct sk_buff *skb;
1737         struct sk_buff *resp;
1738
1739         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1740
1741         skb = pn533_alloc_skb(sizeof(u8) * 2); /*TG + Next*/
1742         if (!skb)
1743                 return -ENOMEM;
1744
1745         *skb_put(skb, sizeof(u8)) = 1; /* TG */
1746         *skb_put(skb, sizeof(u8)) = 0; /* Next */
1747
1748         resp = pn533_send_cmd_sync(dev, PN533_CMD_IN_ATR, skb);
1749         if (IS_ERR(resp))
1750                 return PTR_ERR(resp);
1751
1752         rsp = (struct pn533_cmd_activate_response *) resp->data;
1753         rc = rsp->status & PN533_CMD_RET_MASK;
1754         if (rc != PN533_CMD_RET_SUCCESS)
1755                 dev_kfree_skb(resp);
1756                 return -EIO;
1757
1758         /* ATR_RES general bytes are located at offset 16 */
1759         gt_len = resp->len - 16;
1760         rc = nfc_set_remote_general_bytes(dev->nfc_dev, rsp->gt, gt_len);
1761
1762         dev_kfree_skb(resp);
1763         return rc;
1764 }
1765
1766 static int pn533_activate_target(struct nfc_dev *nfc_dev,
1767                                  struct nfc_target *target, u32 protocol)
1768 {
1769         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
1770         int rc;
1771
1772         nfc_dev_dbg(&dev->interface->dev, "%s - protocol=%u", __func__,
1773                                                                 protocol);
1774
1775         if (dev->poll_mod_count) {
1776                 nfc_dev_err(&dev->interface->dev, "Cannot activate while"
1777                                                                 " polling");
1778                 return -EBUSY;
1779         }
1780
1781         if (dev->tgt_active_prot) {
1782                 nfc_dev_err(&dev->interface->dev, "There is already an active"
1783                                                                 " target");
1784                 return -EBUSY;
1785         }
1786
1787         if (!dev->tgt_available_prots) {
1788                 nfc_dev_err(&dev->interface->dev, "There is no available target"
1789                                                                 " to activate");
1790                 return -EINVAL;
1791         }
1792
1793         if (!(dev->tgt_available_prots & (1 << protocol))) {
1794                 nfc_dev_err(&dev->interface->dev, "The target does not support"
1795                                         " the requested protocol %u", protocol);
1796                 return -EINVAL;
1797         }
1798
1799         if (protocol == NFC_PROTO_NFC_DEP) {
1800                 rc = pn533_activate_target_nfcdep(dev);
1801                 if (rc) {
1802                         nfc_dev_err(&dev->interface->dev, "Error %d when"
1803                                                 " activating target with"
1804                                                 " NFC_DEP protocol", rc);
1805                         return rc;
1806                 }
1807         }
1808
1809         dev->tgt_active_prot = protocol;
1810         dev->tgt_available_prots = 0;
1811
1812         return 0;
1813 }
1814
1815 static void pn533_deactivate_target(struct nfc_dev *nfc_dev,
1816                                     struct nfc_target *target)
1817 {
1818         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
1819
1820         struct sk_buff *skb;
1821         struct sk_buff *resp;
1822
1823         int rc;
1824
1825         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1826
1827         if (!dev->tgt_active_prot) {
1828                 nfc_dev_err(&dev->interface->dev, "There is no active target");
1829                 return;
1830         }
1831
1832         dev->tgt_active_prot = 0;
1833         skb_queue_purge(&dev->resp_q);
1834
1835         skb = pn533_alloc_skb(sizeof(u8));
1836         if (!skb)
1837                 return;
1838
1839         *skb_put(skb, 1) = 1; /* TG*/
1840
1841         resp = pn533_send_cmd_sync(dev, PN533_CMD_IN_RELEASE, skb);
1842         if (IS_ERR(resp))
1843                 return;
1844
1845         rc = resp->data[0] & PN533_CMD_RET_MASK;
1846         if (rc != PN533_CMD_RET_SUCCESS)
1847                 nfc_dev_err(&dev->interface->dev, "Error 0x%x when releasing"
1848                                                         " the target", rc);
1849
1850         dev_kfree_skb(resp);
1851         return;
1852 }
1853
1854
1855 static int pn533_in_dep_link_up_complete(struct pn533 *dev, void *arg,
1856                                          struct sk_buff *resp)
1857 {
1858         struct pn533_cmd_jump_dep_response *rsp;
1859         u8 target_gt_len;
1860         int rc;
1861         u8 active = *(u8 *)arg;
1862
1863         kfree(arg);
1864
1865         if (IS_ERR(resp))
1866                 return PTR_ERR(resp);
1867
1868         if (dev->tgt_available_prots &&
1869             !(dev->tgt_available_prots & (1 << NFC_PROTO_NFC_DEP))) {
1870                 nfc_dev_err(&dev->interface->dev,
1871                         "The target does not support DEP");
1872                 rc =  -EINVAL;
1873                 goto error;
1874         }
1875
1876         rsp = (struct pn533_cmd_jump_dep_response *)resp->data;
1877
1878         rc = rsp->status & PN533_CMD_RET_MASK;
1879         if (rc != PN533_CMD_RET_SUCCESS) {
1880                 nfc_dev_err(&dev->interface->dev,
1881                                 "Bringing DEP link up failed %d", rc);
1882                 goto error;
1883         }
1884
1885         if (!dev->tgt_available_prots) {
1886                 struct nfc_target nfc_target;
1887
1888                 nfc_dev_dbg(&dev->interface->dev, "Creating new target");
1889
1890                 nfc_target.supported_protocols = NFC_PROTO_NFC_DEP_MASK;
1891                 nfc_target.nfcid1_len = 10;
1892                 memcpy(nfc_target.nfcid1, rsp->nfcid3t, nfc_target.nfcid1_len);
1893                 rc = nfc_targets_found(dev->nfc_dev, &nfc_target, 1);
1894                 if (rc)
1895                         goto error;
1896
1897                 dev->tgt_available_prots = 0;
1898         }
1899
1900         dev->tgt_active_prot = NFC_PROTO_NFC_DEP;
1901
1902         /* ATR_RES general bytes are located at offset 17 */
1903         target_gt_len = resp->len - 17;
1904         rc = nfc_set_remote_general_bytes(dev->nfc_dev,
1905                                           rsp->gt, target_gt_len);
1906         if (rc == 0)
1907                 rc = nfc_dep_link_is_up(dev->nfc_dev,
1908                                         dev->nfc_dev->targets[0].idx,
1909                                         !active, NFC_RF_INITIATOR);
1910
1911 error:
1912         dev_kfree_skb(resp);
1913         return rc;
1914 }
1915
1916 static int pn533_mod_to_baud(struct pn533 *dev)
1917 {
1918         switch (dev->poll_mod_curr) {
1919         case PN533_POLL_MOD_106KBPS_A:
1920                 return 0;
1921         case PN533_POLL_MOD_212KBPS_FELICA:
1922                 return 1;
1923         case PN533_POLL_MOD_424KBPS_FELICA:
1924                 return 2;
1925         default:
1926                 return -EINVAL;
1927         }
1928 }
1929
1930 #define PASSIVE_DATA_LEN 5
1931 static int pn533_dep_link_up(struct nfc_dev *nfc_dev, struct nfc_target *target,
1932                              u8 comm_mode, u8* gb, size_t gb_len)
1933 {
1934         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
1935         struct sk_buff *skb;
1936         int rc, baud, skb_len;
1937         u8 *next, *arg;
1938
1939         u8 passive_data[PASSIVE_DATA_LEN] = {0x00, 0xff, 0xff, 0x00, 0x3};
1940
1941         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1942
1943         if (dev->poll_mod_count) {
1944                 nfc_dev_err(&dev->interface->dev,
1945                                 "Cannot bring the DEP link up while polling");
1946                 return -EBUSY;
1947         }
1948
1949         if (dev->tgt_active_prot) {
1950                 nfc_dev_err(&dev->interface->dev,
1951                                 "There is already an active target");
1952                 return -EBUSY;
1953         }
1954
1955         baud = pn533_mod_to_baud(dev);
1956         if (baud < 0) {
1957                 nfc_dev_err(&dev->interface->dev,
1958                             "Invalid curr modulation %d", dev->poll_mod_curr);
1959                 return baud;
1960         }
1961
1962         skb_len = 3 + gb_len; /* ActPass + BR + Next */
1963         if (comm_mode == NFC_COMM_PASSIVE)
1964                 skb_len += PASSIVE_DATA_LEN;
1965
1966         skb = pn533_alloc_skb(skb_len);
1967         if (!skb)
1968                 return -ENOMEM;
1969
1970         *skb_put(skb, 1) = !comm_mode;  /* ActPass */
1971         *skb_put(skb, 1) = baud;  /* Baud rate */
1972
1973         next = skb_put(skb, 1);  /* Next */
1974         *next = 0;
1975
1976         if (comm_mode == NFC_COMM_PASSIVE && baud > 0) {
1977                 memcpy(skb_put(skb, PASSIVE_DATA_LEN), passive_data,
1978                        PASSIVE_DATA_LEN);
1979                 *next |= 1;
1980         }
1981
1982         if (gb != NULL && gb_len > 0) {
1983                 memcpy(skb_put(skb, gb_len), gb, gb_len);
1984                 *next |= 4; /* We have some Gi */
1985         } else {
1986                 *next = 0;
1987         }
1988
1989         arg = kmalloc(sizeof(*arg), GFP_KERNEL);
1990         if (!arg) {
1991                 dev_kfree_skb(skb);
1992                 return -ENOMEM;
1993         }
1994
1995         *arg = !comm_mode;
1996
1997         rc = pn533_send_cmd_async(dev, PN533_CMD_IN_JUMP_FOR_DEP, skb,
1998                                   pn533_in_dep_link_up_complete, arg);
1999
2000         if (rc < 0) {
2001                 dev_kfree_skb(skb);
2002                 kfree(arg);
2003         }
2004
2005         return rc;
2006 }
2007
2008 static int pn533_dep_link_down(struct nfc_dev *nfc_dev)
2009 {
2010         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2011
2012         pn533_poll_reset_mod_list(dev);
2013
2014         if (dev->tgt_mode || dev->tgt_active_prot) {
2015                 pn533_send_ack(dev, GFP_KERNEL);
2016                 usb_kill_urb(dev->in_urb);
2017         }
2018
2019         dev->tgt_active_prot = 0;
2020         dev->tgt_mode = 0;
2021
2022         skb_queue_purge(&dev->resp_q);
2023
2024         return 0;
2025 }
2026
2027 static int pn533_build_tx_frame(struct pn533 *dev, struct sk_buff *skb,
2028                                 bool target)
2029 {
2030         int payload_len = skb->len;
2031         struct pn533_frame *out_frame;
2032         u8 tg;
2033
2034         nfc_dev_dbg(&dev->interface->dev, "%s - Sending %d bytes", __func__,
2035                                                                 payload_len);
2036
2037         if (payload_len > PN533_CMD_DATAEXCH_DATA_MAXLEN) {
2038                 /* TODO: Implement support to multi-part data exchange */
2039                 nfc_dev_err(&dev->interface->dev, "Data length greater than the"
2040                                                 " max allowed: %d",
2041                                                 PN533_CMD_DATAEXCH_DATA_MAXLEN);
2042                 return -ENOSYS;
2043         }
2044
2045         skb_push(skb, PN533_FRAME_HEADER_LEN);
2046
2047         if (target == true) {
2048                 switch (dev->device_type) {
2049                 case PN533_DEVICE_PASORI:
2050                         if (dev->tgt_active_prot == NFC_PROTO_FELICA) {
2051                                 out_frame = (struct pn533_frame *) skb->data;
2052                                 pn533_tx_frame_init(out_frame,
2053                                                     PN533_CMD_IN_COMM_THRU);
2054
2055                                 break;
2056                         }
2057
2058                 default:
2059                         skb_push(skb, PN533_CMD_DATAEXCH_HEAD_LEN);
2060                         out_frame = (struct pn533_frame *) skb->data;
2061                         pn533_tx_frame_init(out_frame,
2062                                             PN533_CMD_IN_DATA_EXCHANGE);
2063                         tg = 1;
2064                         memcpy(PN533_FRAME_CMD_PARAMS_PTR(out_frame),
2065                                &tg, sizeof(u8));
2066                         out_frame->datalen += sizeof(u8);
2067
2068                         break;
2069                 }
2070
2071         } else {
2072                 skb_push(skb, PN533_CMD_DATAEXCH_HEAD_LEN - 1);
2073                 out_frame = (struct pn533_frame *) skb->data;
2074                 pn533_tx_frame_init(out_frame, PN533_CMD_TG_SET_DATA);
2075         }
2076
2077
2078         /* The data is already in the out_frame, just update the datalen */
2079         out_frame->datalen += payload_len;
2080
2081         pn533_tx_frame_finish(out_frame);
2082         skb_put(skb, PN533_FRAME_TAIL_LEN);
2083
2084         return 0;
2085 }
2086
2087 struct pn533_data_exchange_arg {
2088         struct sk_buff *skb_resp;
2089         struct sk_buff *skb_out;
2090         data_exchange_cb_t cb;
2091         void *cb_context;
2092 };
2093
2094 static struct sk_buff *pn533_build_response(struct pn533 *dev)
2095 {
2096         struct sk_buff *skb, *tmp, *t;
2097         unsigned int skb_len = 0, tmp_len = 0;
2098
2099         nfc_dev_dbg(&dev->interface->dev, "%s\n", __func__);
2100
2101         if (skb_queue_empty(&dev->resp_q))
2102                 return NULL;
2103
2104         if (skb_queue_len(&dev->resp_q) == 1) {
2105                 skb = skb_dequeue(&dev->resp_q);
2106                 goto out;
2107         }
2108
2109         skb_queue_walk_safe(&dev->resp_q, tmp, t)
2110                 skb_len += tmp->len;
2111
2112         nfc_dev_dbg(&dev->interface->dev, "%s total length %d\n",
2113                     __func__, skb_len);
2114
2115         skb = alloc_skb(skb_len, GFP_KERNEL);
2116         if (skb == NULL)
2117                 goto out;
2118
2119         skb_put(skb, skb_len);
2120
2121         skb_queue_walk_safe(&dev->resp_q, tmp, t) {
2122                 memcpy(skb->data + tmp_len, tmp->data, tmp->len);
2123                 tmp_len += tmp->len;
2124         }
2125
2126 out:
2127         skb_queue_purge(&dev->resp_q);
2128
2129         return skb;
2130 }
2131
2132 static int pn533_data_exchange_complete(struct pn533 *dev, void *_arg,
2133                                                 u8 *params, int params_len)
2134 {
2135         struct pn533_data_exchange_arg *arg = _arg;
2136         struct sk_buff *skb = NULL, *skb_resp = arg->skb_resp;
2137         struct pn533_frame *in_frame = (struct pn533_frame *) skb_resp->data;
2138         int err = 0;
2139         u8 status;
2140         u8 cmd_ret;
2141
2142         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
2143
2144         dev_kfree_skb(arg->skb_out);
2145
2146         if (params_len < 0) { /* error */
2147                 err = params_len;
2148                 goto error;
2149         }
2150
2151         status = params[0];
2152
2153         cmd_ret = status & PN533_CMD_RET_MASK;
2154         if (cmd_ret != PN533_CMD_RET_SUCCESS) {
2155                 nfc_dev_err(&dev->interface->dev, "PN533 reported error %d when"
2156                                                 " exchanging data", cmd_ret);
2157                 err = -EIO;
2158                 goto error;
2159         }
2160
2161         skb_put(skb_resp, PN533_FRAME_SIZE(in_frame));
2162         skb_pull(skb_resp, PN533_FRAME_HEADER_LEN);
2163         skb_pull(skb_resp, PN533_CMD_DATAEXCH_HEAD_LEN);
2164         skb_trim(skb_resp, skb_resp->len - PN533_FRAME_TAIL_LEN);
2165         skb_queue_tail(&dev->resp_q, skb_resp);
2166
2167         if (status & PN533_CMD_MI_MASK) {
2168                 queue_work(dev->wq, &dev->mi_work);
2169                 return -EINPROGRESS;
2170         }
2171
2172         skb = pn533_build_response(dev);
2173         if (skb == NULL)
2174                 goto error;
2175
2176         arg->cb(arg->cb_context, skb, 0);
2177         kfree(arg);
2178         return 0;
2179
2180 error:
2181         skb_queue_purge(&dev->resp_q);
2182         dev_kfree_skb(skb_resp);
2183         arg->cb(arg->cb_context, NULL, err);
2184         kfree(arg);
2185         return 0;
2186 }
2187
2188 static int pn533_transceive(struct nfc_dev *nfc_dev,
2189                             struct nfc_target *target, struct sk_buff *skb,
2190                             data_exchange_cb_t cb, void *cb_context)
2191 {
2192         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2193         struct pn533_frame *out_frame, *in_frame;
2194         struct pn533_data_exchange_arg *arg;
2195         struct sk_buff *skb_resp;
2196         int skb_resp_len;
2197         int rc;
2198
2199         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
2200
2201         if (!dev->tgt_active_prot) {
2202                 nfc_dev_err(&dev->interface->dev, "Cannot exchange data if"
2203                                                 " there is no active target");
2204                 rc = -EINVAL;
2205                 goto error;
2206         }
2207
2208         rc = pn533_build_tx_frame(dev, skb, true);
2209         if (rc)
2210                 goto error;
2211
2212         skb_resp_len = PN533_FRAME_HEADER_LEN +
2213                        PN533_CMD_DATAEXCH_HEAD_LEN +
2214                        PN533_CMD_DATAEXCH_DATA_MAXLEN +
2215                        PN533_FRAME_TAIL_LEN;
2216
2217         skb_resp = nfc_alloc_recv_skb(skb_resp_len, GFP_KERNEL);
2218         if (!skb_resp) {
2219                 rc = -ENOMEM;
2220                 goto error;
2221         }
2222
2223         in_frame = (struct pn533_frame *) skb_resp->data;
2224         out_frame = (struct pn533_frame *) skb->data;
2225
2226         arg = kmalloc(sizeof(struct pn533_data_exchange_arg), GFP_KERNEL);
2227         if (!arg) {
2228                 rc = -ENOMEM;
2229                 goto free_skb_resp;
2230         }
2231
2232         arg->skb_resp = skb_resp;
2233         arg->skb_out = skb;
2234         arg->cb = cb;
2235         arg->cb_context = cb_context;
2236
2237         rc = pn533_send_cmd_frame_async(dev, out_frame, in_frame, skb_resp_len,
2238                                         pn533_data_exchange_complete, arg);
2239         if (rc) {
2240                 nfc_dev_err(&dev->interface->dev, "Error %d when trying to"
2241                                                 " perform data_exchange", rc);
2242                 goto free_arg;
2243         }
2244
2245         return 0;
2246
2247 free_arg:
2248         kfree(arg);
2249 free_skb_resp:
2250         kfree_skb(skb_resp);
2251 error:
2252         kfree_skb(skb);
2253         return rc;
2254 }
2255
2256 static int pn533_tm_send_complete(struct pn533 *dev, void *arg,
2257                                   struct sk_buff *resp)
2258 {
2259         u8 status;
2260
2261         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
2262
2263         if (IS_ERR(resp))
2264                 return PTR_ERR(resp);
2265
2266         status = resp->data[0];
2267
2268         dev_kfree_skb(resp);
2269
2270         if (status != 0) {
2271                 nfc_tm_deactivated(dev->nfc_dev);
2272
2273                 dev->tgt_mode = 0;
2274
2275                 return 0;
2276         }
2277
2278         queue_work(dev->wq, &dev->tg_work);
2279
2280         return 0;
2281 }
2282
2283 static int pn533_tm_send(struct nfc_dev *nfc_dev, struct sk_buff *skb)
2284 {
2285         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2286         int rc;
2287
2288         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
2289
2290         if (skb->len > PN533_CMD_DATAEXCH_DATA_MAXLEN) {
2291                 nfc_dev_err(&dev->interface->dev,
2292                             "Data length greater than the max allowed: %d",
2293                             PN533_CMD_DATAEXCH_DATA_MAXLEN);
2294                 return -ENOSYS;
2295         }
2296
2297         rc = pn533_send_data_async(dev, PN533_CMD_TG_SET_DATA, skb,
2298                                    pn533_tm_send_complete, NULL);
2299         if (rc < 0)
2300                 dev_kfree_skb(skb);
2301
2302         return rc;
2303 }
2304
2305 static void pn533_wq_mi_recv(struct work_struct *work)
2306 {
2307         struct pn533 *dev = container_of(work, struct pn533, mi_work);
2308         struct sk_buff *skb_cmd;
2309         struct pn533_data_exchange_arg *arg = dev->cmd_complete_arg;
2310         struct pn533_frame *out_frame, *in_frame;
2311         struct sk_buff *skb_resp;
2312         int skb_resp_len;
2313         int rc;
2314
2315         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
2316
2317         /* This is a zero payload size skb */
2318         skb_cmd = pn533_alloc_skb(PN533_CMD_DATAEXCH_HEAD_LEN);
2319         if (skb_cmd == NULL)
2320                 goto error_cmd;
2321
2322         skb_reserve(skb_cmd, PN533_CMD_DATAEXCH_HEAD_LEN);
2323
2324         rc = pn533_build_tx_frame(dev, skb_cmd, true);
2325         if (rc)
2326                 goto error_frame;
2327
2328         skb_resp_len = PN533_FRAME_HEADER_LEN +
2329                        PN533_CMD_DATAEXCH_HEAD_LEN +
2330                        PN533_CMD_DATAEXCH_DATA_MAXLEN +
2331                        PN533_FRAME_TAIL_LEN;
2332
2333         skb_resp = alloc_skb(skb_resp_len, GFP_KERNEL);
2334         if (!skb_resp) {
2335                 rc = -ENOMEM;
2336                 goto error_frame;
2337         }
2338
2339         in_frame = (struct pn533_frame *) skb_resp->data;
2340         out_frame = (struct pn533_frame *) skb_cmd->data;
2341
2342         arg->skb_resp = skb_resp;
2343         arg->skb_out = skb_cmd;
2344
2345         rc = __pn533_send_cmd_frame_async(dev, out_frame, in_frame,
2346                                           skb_resp_len,
2347                                           pn533_data_exchange_complete,
2348                                           dev->cmd_complete_arg);
2349         if (!rc)
2350                 return;
2351
2352         nfc_dev_err(&dev->interface->dev, "Error %d when trying to"
2353                                                 " perform data_exchange", rc);
2354
2355         kfree_skb(skb_resp);
2356
2357 error_frame:
2358         kfree_skb(skb_cmd);
2359
2360 error_cmd:
2361         pn533_send_ack(dev, GFP_KERNEL);
2362
2363         kfree(arg);
2364
2365         queue_work(dev->wq, &dev->cmd_work);
2366 }
2367
2368 static int pn533_set_configuration(struct pn533 *dev, u8 cfgitem, u8 *cfgdata,
2369                                                                 u8 cfgdata_len)
2370 {
2371         struct sk_buff *skb;
2372         struct sk_buff *resp;
2373
2374         int skb_len;
2375
2376         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
2377
2378         skb_len = sizeof(cfgitem) + cfgdata_len; /* cfgitem + cfgdata */
2379
2380         skb = pn533_alloc_skb(skb_len);
2381         if (!skb)
2382                 return -ENOMEM;
2383
2384         *skb_put(skb, sizeof(cfgitem)) = cfgitem;
2385         memcpy(skb_put(skb, cfgdata_len), cfgdata, cfgdata_len);
2386
2387         resp = pn533_send_cmd_sync(dev, PN533_CMD_RF_CONFIGURATION, skb);
2388         if (IS_ERR(resp))
2389                 return PTR_ERR(resp);
2390
2391         dev_kfree_skb(resp);
2392         return 0;
2393 }
2394
2395 static int pn533_get_firmware_version(struct pn533 *dev,
2396                                       struct pn533_fw_version *fv)
2397 {
2398         struct sk_buff *skb;
2399         struct sk_buff *resp;
2400
2401         skb = pn533_alloc_skb(0);
2402         if (!skb)
2403                 return -ENOMEM;
2404
2405         resp = pn533_send_cmd_sync(dev, PN533_CMD_GET_FIRMWARE_VERSION, skb);
2406         if (IS_ERR(resp))
2407                 return PTR_ERR(resp);
2408
2409         fv->ic = resp->data[0];
2410         fv->ver = resp->data[1];
2411         fv->rev = resp->data[2];
2412         fv->support = resp->data[3];
2413
2414         dev_kfree_skb(resp);
2415         return 0;
2416 }
2417
2418 static int pn533_fw_reset(struct pn533 *dev)
2419 {
2420         struct sk_buff *skb;
2421         struct sk_buff *resp;
2422
2423         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
2424
2425         skb = pn533_alloc_skb(sizeof(u8));
2426         if (!skb)
2427                 return -ENOMEM;
2428
2429         *skb_put(skb, sizeof(u8)) = 0x1;
2430
2431         resp = pn533_send_cmd_sync(dev, 0x18, skb);
2432         if (IS_ERR(resp))
2433                 return PTR_ERR(resp);
2434
2435         dev_kfree_skb(resp);
2436
2437         return 0;
2438 }
2439
2440 static struct nfc_ops pn533_nfc_ops = {
2441         .dev_up = NULL,
2442         .dev_down = NULL,
2443         .dep_link_up = pn533_dep_link_up,
2444         .dep_link_down = pn533_dep_link_down,
2445         .start_poll = pn533_start_poll,
2446         .stop_poll = pn533_stop_poll,
2447         .activate_target = pn533_activate_target,
2448         .deactivate_target = pn533_deactivate_target,
2449         .im_transceive = pn533_transceive,
2450         .tm_send = pn533_tm_send,
2451 };
2452
2453 static int pn533_setup(struct pn533 *dev)
2454 {
2455         struct pn533_config_max_retries max_retries;
2456         struct pn533_config_timing timing;
2457         u8 pasori_cfg[3] = {0x08, 0x01, 0x08};
2458         int rc;
2459
2460         switch (dev->device_type) {
2461         case PN533_DEVICE_STD:
2462                 max_retries.mx_rty_atr = PN533_CONFIG_MAX_RETRIES_ENDLESS;
2463                 max_retries.mx_rty_psl = 2;
2464                 max_retries.mx_rty_passive_act =
2465                         PN533_CONFIG_MAX_RETRIES_NO_RETRY;
2466
2467                 timing.rfu = PN533_CONFIG_TIMING_102;
2468                 timing.atr_res_timeout = PN533_CONFIG_TIMING_204;
2469                 timing.dep_timeout = PN533_CONFIG_TIMING_409;
2470
2471                 break;
2472
2473         case PN533_DEVICE_PASORI:
2474                 max_retries.mx_rty_atr = 0x2;
2475                 max_retries.mx_rty_psl = 0x1;
2476                 max_retries.mx_rty_passive_act =
2477                         PN533_CONFIG_MAX_RETRIES_NO_RETRY;
2478
2479                 timing.rfu = PN533_CONFIG_TIMING_102;
2480                 timing.atr_res_timeout = PN533_CONFIG_TIMING_102;
2481                 timing.dep_timeout = PN533_CONFIG_TIMING_204;
2482
2483                 break;
2484
2485         default:
2486                 nfc_dev_err(&dev->interface->dev, "Unknown device type %d\n",
2487                             dev->device_type);
2488                 return -EINVAL;
2489         }
2490
2491         rc = pn533_set_configuration(dev, PN533_CFGITEM_MAX_RETRIES,
2492                                      (u8 *)&max_retries, sizeof(max_retries));
2493         if (rc) {
2494                 nfc_dev_err(&dev->interface->dev,
2495                             "Error on setting MAX_RETRIES config");
2496                 return rc;
2497         }
2498
2499
2500         rc = pn533_set_configuration(dev, PN533_CFGITEM_TIMING,
2501                                      (u8 *)&timing, sizeof(timing));
2502         if (rc) {
2503                 nfc_dev_err(&dev->interface->dev,
2504                             "Error on setting RF timings");
2505                 return rc;
2506         }
2507
2508         switch (dev->device_type) {
2509         case PN533_DEVICE_STD:
2510                 break;
2511
2512         case PN533_DEVICE_PASORI:
2513                 pn533_fw_reset(dev);
2514
2515                 rc = pn533_set_configuration(dev, PN533_CFGITEM_PASORI,
2516                                              pasori_cfg, 3);
2517                 if (rc) {
2518                         nfc_dev_err(&dev->interface->dev,
2519                                     "Error while settings PASORI config");
2520                         return rc;
2521                 }
2522
2523                 pn533_fw_reset(dev);
2524
2525                 break;
2526         }
2527
2528         return 0;
2529 }
2530
2531 static int pn533_probe(struct usb_interface *interface,
2532                         const struct usb_device_id *id)
2533 {
2534         struct pn533_fw_version fw_ver;
2535         struct pn533 *dev;
2536         struct usb_host_interface *iface_desc;
2537         struct usb_endpoint_descriptor *endpoint;
2538         int in_endpoint = 0;
2539         int out_endpoint = 0;
2540         int rc = -ENOMEM;
2541         int i;
2542         u32 protocols;
2543
2544         dev = kzalloc(sizeof(*dev), GFP_KERNEL);
2545         if (!dev)
2546                 return -ENOMEM;
2547
2548         dev->udev = usb_get_dev(interface_to_usbdev(interface));
2549         dev->interface = interface;
2550         mutex_init(&dev->cmd_lock);
2551
2552         iface_desc = interface->cur_altsetting;
2553         for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
2554                 endpoint = &iface_desc->endpoint[i].desc;
2555
2556                 if (!in_endpoint && usb_endpoint_is_bulk_in(endpoint))
2557                         in_endpoint = endpoint->bEndpointAddress;
2558
2559                 if (!out_endpoint && usb_endpoint_is_bulk_out(endpoint))
2560                         out_endpoint = endpoint->bEndpointAddress;
2561         }
2562
2563         if (!in_endpoint || !out_endpoint) {
2564                 nfc_dev_err(&interface->dev, "Could not find bulk-in or"
2565                                                         " bulk-out endpoint");
2566                 rc = -ENODEV;
2567                 goto error;
2568         }
2569
2570         dev->in_frame = kmalloc(PN533_NORMAL_FRAME_MAX_LEN, GFP_KERNEL);
2571         dev->in_urb = usb_alloc_urb(0, GFP_KERNEL);
2572         dev->out_frame = kmalloc(PN533_NORMAL_FRAME_MAX_LEN, GFP_KERNEL);
2573         dev->out_urb = usb_alloc_urb(0, GFP_KERNEL);
2574
2575         if (!dev->in_frame || !dev->out_frame ||
2576                 !dev->in_urb || !dev->out_urb)
2577                 goto error;
2578
2579         usb_fill_bulk_urb(dev->in_urb, dev->udev,
2580                         usb_rcvbulkpipe(dev->udev, in_endpoint),
2581                         NULL, 0, NULL, dev);
2582         usb_fill_bulk_urb(dev->out_urb, dev->udev,
2583                         usb_sndbulkpipe(dev->udev, out_endpoint),
2584                         NULL, 0,
2585                         pn533_send_complete, dev);
2586
2587         INIT_WORK(&dev->cmd_work, pn533_wq_cmd);
2588         INIT_WORK(&dev->cmd_complete_work, pn533_wq_cmd_complete);
2589         INIT_WORK(&dev->mi_work, pn533_wq_mi_recv);
2590         INIT_WORK(&dev->tg_work, pn533_wq_tg_get_data);
2591         INIT_WORK(&dev->poll_work, pn533_wq_poll);
2592         dev->wq = alloc_ordered_workqueue("pn533", 0);
2593         if (dev->wq == NULL)
2594                 goto error;
2595
2596         init_timer(&dev->listen_timer);
2597         dev->listen_timer.data = (unsigned long) dev;
2598         dev->listen_timer.function = pn533_listen_mode_timer;
2599
2600         skb_queue_head_init(&dev->resp_q);
2601
2602         INIT_LIST_HEAD(&dev->cmd_queue);
2603
2604         usb_set_intfdata(interface, dev);
2605
2606         memset(&fw_ver, 0, sizeof(fw_ver));
2607         rc = pn533_get_firmware_version(dev, &fw_ver);
2608         if (rc < 0)
2609                 goto destroy_wq;
2610
2611         nfc_dev_info(&dev->interface->dev,
2612                      "NXP PN533 firmware ver %d.%d now attached",
2613                      fw_ver.ver, fw_ver.rev);
2614
2615         dev->device_type = id->driver_info;
2616         switch (dev->device_type) {
2617         case PN533_DEVICE_STD:
2618                 protocols = PN533_ALL_PROTOCOLS;
2619                 break;
2620
2621         case PN533_DEVICE_PASORI:
2622                 protocols = PN533_NO_TYPE_B_PROTOCOLS;
2623                 break;
2624
2625         default:
2626                 nfc_dev_err(&dev->interface->dev, "Unknown device type %d\n",
2627                             dev->device_type);
2628                 rc = -EINVAL;
2629                 goto destroy_wq;
2630         }
2631
2632         dev->nfc_dev = nfc_allocate_device(&pn533_nfc_ops, protocols,
2633                                            PN533_FRAME_HEADER_LEN +
2634                                            PN533_CMD_DATAEXCH_HEAD_LEN,
2635                                            PN533_FRAME_TAIL_LEN);
2636         if (!dev->nfc_dev)
2637                 goto destroy_wq;
2638
2639         nfc_set_parent_dev(dev->nfc_dev, &interface->dev);
2640         nfc_set_drvdata(dev->nfc_dev, dev);
2641
2642         rc = nfc_register_device(dev->nfc_dev);
2643         if (rc)
2644                 goto free_nfc_dev;
2645
2646         rc = pn533_setup(dev);
2647         if (rc)
2648                 goto unregister_nfc_dev;
2649
2650         return 0;
2651
2652 unregister_nfc_dev:
2653         nfc_unregister_device(dev->nfc_dev);
2654
2655 free_nfc_dev:
2656         nfc_free_device(dev->nfc_dev);
2657
2658 destroy_wq:
2659         destroy_workqueue(dev->wq);
2660 error:
2661         kfree(dev->in_frame);
2662         usb_free_urb(dev->in_urb);
2663         kfree(dev->out_frame);
2664         usb_free_urb(dev->out_urb);
2665         kfree(dev);
2666         return rc;
2667 }
2668
2669 static void pn533_disconnect(struct usb_interface *interface)
2670 {
2671         struct pn533 *dev;
2672         struct pn533_cmd *cmd, *n;
2673
2674         dev = usb_get_intfdata(interface);
2675         usb_set_intfdata(interface, NULL);
2676
2677         nfc_unregister_device(dev->nfc_dev);
2678         nfc_free_device(dev->nfc_dev);
2679
2680         usb_kill_urb(dev->in_urb);
2681         usb_kill_urb(dev->out_urb);
2682
2683         destroy_workqueue(dev->wq);
2684
2685         skb_queue_purge(&dev->resp_q);
2686
2687         del_timer(&dev->listen_timer);
2688
2689         list_for_each_entry_safe(cmd, n, &dev->cmd_queue, queue) {
2690                 list_del(&cmd->queue);
2691                 kfree(cmd);
2692         }
2693
2694         kfree(dev->in_frame);
2695         usb_free_urb(dev->in_urb);
2696         kfree(dev->out_frame);
2697         usb_free_urb(dev->out_urb);
2698         kfree(dev);
2699
2700         nfc_dev_info(&interface->dev, "NXP PN533 NFC device disconnected");
2701 }
2702
2703 static struct usb_driver pn533_driver = {
2704         .name =         "pn533",
2705         .probe =        pn533_probe,
2706         .disconnect =   pn533_disconnect,
2707         .id_table =     pn533_table,
2708 };
2709
2710 module_usb_driver(pn533_driver);
2711
2712 MODULE_AUTHOR("Lauro Ramos Venancio <lauro.venancio@openbossa.org>,"
2713                         " Aloisio Almeida Jr <aloisio.almeida@openbossa.org>");
2714 MODULE_DESCRIPTION("PN533 usb driver ver " VERSION);
2715 MODULE_VERSION(VERSION);
2716 MODULE_LICENSE("GPL");