drivers/nfc/pn533.c

   1 /*
   2  * Copyright (C) 2011 Instituto Nokia de Tecnologia
   3  * Copyright (C) 2012-2013 Tieto Poland
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License as published by
   7  * the Free Software Foundation; either version 2 of the License, or
   8  * (at your option) any later version.
   9  *
  10  * This program is distributed in the hope that it will be useful,
  11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  13  * GNU General Public License for more details.
  14  *
  15  * You should have received a copy of the GNU General Public License
  16  * along with this program; if not, write to the
  17  * Free Software Foundation, Inc.,
  18  * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
  19  */
  20
  21 #include <linux/device.h>
  22 #include <linux/kernel.h>
  23 #include <linux/module.h>
  24 #include <linux/slab.h>
  25 #include <linux/usb.h>
  26 #include <linux/nfc.h>
  27 #include <linux/netdevice.h>
  28 #include <net/nfc/nfc.h>
  29
  30 #define VERSION "0.2"
  31
  32 #define PN533_VENDOR_ID 0x4CC
  33 #define PN533_PRODUCT_ID 0x2533
  34
  35 #define SCM_VENDOR_ID 0x4E6
  36 #define SCL3711_PRODUCT_ID 0x5591
  37
  38 #define SONY_VENDOR_ID         0x054c
  39 #define PASORI_PRODUCT_ID      0x02e1
  40
  41 #define ACS_VENDOR_ID 0x072f
  42 #define ACR122U_PRODUCT_ID 0x2200
  43
  44 #define PN533_DEVICE_STD     0x1
  45 #define PN533_DEVICE_PASORI  0x2
  46 #define PN533_DEVICE_ACR122U 0x3
  47
  48 #define PN533_ALL_PROTOCOLS (NFC_PROTO_JEWEL_MASK | NFC_PROTO_MIFARE_MASK |\
  49                              NFC_PROTO_FELICA_MASK | NFC_PROTO_ISO14443_MASK |\
  50                              NFC_PROTO_NFC_DEP_MASK |\
  51                              NFC_PROTO_ISO14443_B_MASK)
  52
  53 #define PN533_NO_TYPE_B_PROTOCOLS (NFC_PROTO_JEWEL_MASK | \
  54                                    NFC_PROTO_MIFARE_MASK | \
  55                                    NFC_PROTO_FELICA_MASK | \
  56                                    NFC_PROTO_ISO14443_MASK | \
  57                                    NFC_PROTO_NFC_DEP_MASK)
  58
  59 static const struct usb_device_id pn533_table[] = {
  60         { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE,
  61           .idVendor             = PN533_VENDOR_ID,
  62           .idProduct            = PN533_PRODUCT_ID,
  63           .driver_info          = PN533_DEVICE_STD,
  64         },
  65         { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE,
  66           .idVendor             = SCM_VENDOR_ID,
  67           .idProduct            = SCL3711_PRODUCT_ID,
  68           .driver_info          = PN533_DEVICE_STD,
  69         },
  70         { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE,
  71           .idVendor             = SONY_VENDOR_ID,
  72           .idProduct            = PASORI_PRODUCT_ID,
  73           .driver_info          = PN533_DEVICE_PASORI,
  74         },
  75         { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE,
  76           .idVendor             = ACS_VENDOR_ID,
  77           .idProduct            = ACR122U_PRODUCT_ID,
  78           .driver_info          = PN533_DEVICE_ACR122U,
  79         },
  80         { }
  81 };
  82 MODULE_DEVICE_TABLE(usb, pn533_table);
  83
  84 /* How much time we spend listening for initiators */
  85 #define PN533_LISTEN_TIME 2
  86 /* Delay between each poll frame (ms) */
  87 #define PN533_POLL_INTERVAL 10
  88
  89 /* Standard pn533 frame definitions (standard and extended)*/
  90 #define PN533_STD_FRAME_HEADER_LEN (sizeof(struct pn533_std_frame) \
  91                                         + 2) /* data[0] TFI, data[1] CC */
  92 #define PN533_STD_FRAME_TAIL_LEN 2 /* data[len] DCS, data[len + 1] postamble*/
  93
  94 #define PN533_EXT_FRAME_HEADER_LEN (sizeof(struct pn533_ext_frame) \
  95                                         + 2) /* data[0] TFI, data[1] CC */
  96
  97 #define PN533_CMD_DATAEXCH_DATA_MAXLEN  262
  98 #define PN533_CMD_DATAFRAME_MAXLEN      240     /* max data length (send) */
  99
 100 /*
 101  * Max extended frame payload len, excluding TFI and CC
 102  * which are already in PN533_FRAME_HEADER_LEN.
 103  */
 104 #define PN533_STD_FRAME_MAX_PAYLOAD_LEN 263
 105
 106 #define PN533_STD_FRAME_ACK_SIZE 6 /* Preamble (1), SoPC (2), ACK Code (2),
 107                                   Postamble (1) */
 108 #define PN533_STD_FRAME_CHECKSUM(f) (f->data[f->datalen])
 109 #define PN533_STD_FRAME_POSTAMBLE(f) (f->data[f->datalen + 1])
 110 /* Half start code (3), LEN (4) should be 0xffff for extended frame */
 111 #define PN533_STD_IS_EXTENDED(hdr) ((hdr)->datalen == 0xFF \
 112                                         && (hdr)->datalen_checksum == 0xFF)
 113 #define PN533_EXT_FRAME_CHECKSUM(f) (f->data[be16_to_cpu(f->datalen)])
 114
 115 /* start of frame */
 116 #define PN533_STD_FRAME_SOF 0x00FF
 117
 118 /* standard frame identifier: in/out/error */
 119 #define PN533_STD_FRAME_IDENTIFIER(f) (f->data[0]) /* TFI */
 120 #define PN533_STD_FRAME_DIR_OUT 0xD4
 121 #define PN533_STD_FRAME_DIR_IN 0xD5
 122
 123 /* ACS ACR122 pn533 frame definitions */
 124 #define PN533_ACR122_TX_FRAME_HEADER_LEN (sizeof(struct pn533_acr122_tx_frame) \
 125                                           + 2)
 126 #define PN533_ACR122_TX_FRAME_TAIL_LEN 0
 127 #define PN533_ACR122_RX_FRAME_HEADER_LEN (sizeof(struct pn533_acr122_rx_frame) \
 128                                           + 2)
 129 #define PN533_ACR122_RX_FRAME_TAIL_LEN 2
 130 #define PN533_ACR122_FRAME_MAX_PAYLOAD_LEN PN533_STD_FRAME_MAX_PAYLOAD_LEN
 131
 132 /* CCID messages types */
 133 #define PN533_ACR122_PC_TO_RDR_ICCPOWERON 0x62
 134 #define PN533_ACR122_PC_TO_RDR_ESCAPE 0x6B
 135
 136 #define PN533_ACR122_RDR_TO_PC_ESCAPE 0x83
 137
 138 /* PN533 Commands */
 139 #define PN533_FRAME_CMD(f) (f->data[1])
 140
 141 #define PN533_CMD_GET_FIRMWARE_VERSION 0x02
 142 #define PN533_CMD_RF_CONFIGURATION 0x32
 143 #define PN533_CMD_IN_DATA_EXCHANGE 0x40
 144 #define PN533_CMD_IN_COMM_THRU     0x42
 145 #define PN533_CMD_IN_LIST_PASSIVE_TARGET 0x4A
 146 #define PN533_CMD_IN_ATR 0x50
 147 #define PN533_CMD_IN_RELEASE 0x52
 148 #define PN533_CMD_IN_JUMP_FOR_DEP 0x56
 149
 150 #define PN533_CMD_TG_INIT_AS_TARGET 0x8c
 151 #define PN533_CMD_TG_GET_DATA 0x86
 152 #define PN533_CMD_TG_SET_DATA 0x8e
 153 #define PN533_CMD_UNDEF 0xff
 154
 155 #define PN533_CMD_RESPONSE(cmd) (cmd + 1)
 156
 157 /* PN533 Return codes */
 158 #define PN533_CMD_RET_MASK 0x3F
 159 #define PN533_CMD_MI_MASK 0x40
 160 #define PN533_CMD_RET_SUCCESS 0x00
 161
 162 struct pn533;
 163
 164 typedef int (*pn533_send_async_complete_t) (struct pn533 *dev, void *arg,
 165                                         struct sk_buff *resp);
 166
 167 /* structs for pn533 commands */
 168
 169 /* PN533_CMD_GET_FIRMWARE_VERSION */
 170 struct pn533_fw_version {
 171         u8 ic;
 172         u8 ver;
 173         u8 rev;
 174         u8 support;
 175 };
 176
 177 /* PN533_CMD_RF_CONFIGURATION */
 178 #define PN533_CFGITEM_RF_FIELD    0x01
 179 #define PN533_CFGITEM_TIMING      0x02
 180 #define PN533_CFGITEM_MAX_RETRIES 0x05
 181 #define PN533_CFGITEM_PASORI      0x82
 182
 183 #define PN533_CFGITEM_RF_FIELD_AUTO_RFCA 0x2
 184 #define PN533_CFGITEM_RF_FIELD_ON        0x1
 185 #define PN533_CFGITEM_RF_FIELD_OFF       0x0
 186
 187 #define PN533_CONFIG_TIMING_102 0xb
 188 #define PN533_CONFIG_TIMING_204 0xc
 189 #define PN533_CONFIG_TIMING_409 0xd
 190 #define PN533_CONFIG_TIMING_819 0xe
 191
 192 #define PN533_CONFIG_MAX_RETRIES_NO_RETRY 0x00
 193 #define PN533_CONFIG_MAX_RETRIES_ENDLESS 0xFF
 194
 195 struct pn533_config_max_retries {
 196         u8 mx_rty_atr;
 197         u8 mx_rty_psl;
 198         u8 mx_rty_passive_act;
 199 } __packed;
 200
 201 struct pn533_config_timing {
 202         u8 rfu;
 203         u8 atr_res_timeout;
 204         u8 dep_timeout;
 205 } __packed;
 206
 207 /* PN533_CMD_IN_LIST_PASSIVE_TARGET */
 208
 209 /* felica commands opcode */
 210 #define PN533_FELICA_OPC_SENSF_REQ 0
 211 #define PN533_FELICA_OPC_SENSF_RES 1
 212 /* felica SENSF_REQ parameters */
 213 #define PN533_FELICA_SENSF_SC_ALL 0xFFFF
 214 #define PN533_FELICA_SENSF_RC_NO_SYSTEM_CODE 0
 215 #define PN533_FELICA_SENSF_RC_SYSTEM_CODE 1
 216 #define PN533_FELICA_SENSF_RC_ADVANCED_PROTOCOL 2
 217
 218 /* type B initiator_data values */
 219 #define PN533_TYPE_B_AFI_ALL_FAMILIES 0
 220 #define PN533_TYPE_B_POLL_METHOD_TIMESLOT 0
 221 #define PN533_TYPE_B_POLL_METHOD_PROBABILISTIC 1
 222
 223 union pn533_cmd_poll_initdata {
 224         struct {
 225                 u8 afi;
 226                 u8 polling_method;
 227         } __packed type_b;
 228         struct {
 229                 u8 opcode;
 230                 __be16 sc;
 231                 u8 rc;
 232                 u8 tsn;
 233         } __packed felica;
 234 };
 235
 236 /* Poll modulations */
 237 enum {
 238         PN533_POLL_MOD_106KBPS_A,
 239         PN533_POLL_MOD_212KBPS_FELICA,
 240         PN533_POLL_MOD_424KBPS_FELICA,
 241         PN533_POLL_MOD_106KBPS_JEWEL,
 242         PN533_POLL_MOD_847KBPS_B,
 243         PN533_LISTEN_MOD,
 244
 245         __PN533_POLL_MOD_AFTER_LAST,
 246 };
 247 #define PN533_POLL_MOD_MAX (__PN533_POLL_MOD_AFTER_LAST - 1)
 248
 249 struct pn533_poll_modulations {
 250         struct {
 251                 u8 maxtg;
 252                 u8 brty;
 253                 union pn533_cmd_poll_initdata initiator_data;
 254         } __packed data;
 255         u8 len;
 256 };
 257
 258 static const struct pn533_poll_modulations poll_mod[] = {
 259         [PN533_POLL_MOD_106KBPS_A] = {
 260                 .data = {
 261                         .maxtg = 1,
 262                         .brty = 0,
 263                 },
 264                 .len = 2,
 265         },
 266         [PN533_POLL_MOD_212KBPS_FELICA] = {
 267                 .data = {
 268                         .maxtg = 1,
 269                         .brty = 1,
 270                         .initiator_data.felica = {
 271                                 .opcode = PN533_FELICA_OPC_SENSF_REQ,
 272                                 .sc = PN533_FELICA_SENSF_SC_ALL,
 273                                 .rc = PN533_FELICA_SENSF_RC_SYSTEM_CODE,
 274                                 .tsn = 0x03,
 275                         },
 276                 },
 277                 .len = 7,
 278         },
 279         [PN533_POLL_MOD_424KBPS_FELICA] = {
 280                 .data = {
 281                         .maxtg = 1,
 282                         .brty = 2,
 283                         .initiator_data.felica = {
 284                                 .opcode = PN533_FELICA_OPC_SENSF_REQ,
 285                                 .sc = PN533_FELICA_SENSF_SC_ALL,
 286                                 .rc = PN533_FELICA_SENSF_RC_SYSTEM_CODE,
 287                                 .tsn = 0x03,
 288                         },
 289                  },
 290                 .len = 7,
 291         },
 292         [PN533_POLL_MOD_106KBPS_JEWEL] = {
 293                 .data = {
 294                         .maxtg = 1,
 295                         .brty = 4,
 296                 },
 297                 .len = 2,
 298         },
 299         [PN533_POLL_MOD_847KBPS_B] = {
 300                 .data = {
 301                         .maxtg = 1,
 302                         .brty = 8,
 303                         .initiator_data.type_b = {
 304                                 .afi = PN533_TYPE_B_AFI_ALL_FAMILIES,
 305                                 .polling_method =
 306                                         PN533_TYPE_B_POLL_METHOD_TIMESLOT,
 307                         },
 308                 },
 309                 .len = 3,
 310         },
 311         [PN533_LISTEN_MOD] = {
 312                 .len = 0,
 313         },
 314 };
 315
 316 /* PN533_CMD_IN_ATR */
 317
 318 struct pn533_cmd_activate_response {
 319         u8 status;
 320         u8 nfcid3t[10];
 321         u8 didt;
 322         u8 bst;
 323         u8 brt;
 324         u8 to;
 325         u8 ppt;
 326         /* optional */
 327         u8 gt[];
 328 } __packed;
 329
 330 struct pn533_cmd_jump_dep_response {
 331         u8 status;
 332         u8 tg;
 333         u8 nfcid3t[10];
 334         u8 didt;
 335         u8 bst;
 336         u8 brt;
 337         u8 to;
 338         u8 ppt;
 339         /* optional */
 340         u8 gt[];
 341 } __packed;
 342
 343
 344 /* PN533_TG_INIT_AS_TARGET */
 345 #define PN533_INIT_TARGET_PASSIVE 0x1
 346 #define PN533_INIT_TARGET_DEP 0x2
 347
 348 #define PN533_INIT_TARGET_RESP_FRAME_MASK 0x3
 349 #define PN533_INIT_TARGET_RESP_ACTIVE     0x1
 350 #define PN533_INIT_TARGET_RESP_DEP        0x4
 351
 352 enum  pn533_protocol_type {
 353         PN533_PROTO_REQ_ACK_RESP = 0,
 354         PN533_PROTO_REQ_RESP
 355 };
 356
 357 struct pn533 {
 358         struct usb_device *udev;
 359         struct usb_interface *interface;
 360         struct nfc_dev *nfc_dev;
 361         u32 device_type;
 362         enum pn533_protocol_type protocol_type;
 363
 364         struct urb *out_urb;
 365         struct urb *in_urb;
 366
 367         struct sk_buff_head resp_q;
 368         struct sk_buff_head fragment_skb;
 369
 370         struct workqueue_struct *wq;
 371         struct work_struct cmd_work;
 372         struct work_struct cmd_complete_work;
 373         struct delayed_work poll_work;
 374         struct work_struct mi_rx_work;
 375         struct work_struct mi_tx_work;
 376         struct work_struct mi_tm_rx_work;
 377         struct work_struct tg_work;
 378         struct work_struct rf_work;
 379
 380         struct list_head cmd_queue;
 381         struct pn533_cmd *cmd;
 382         u8 cmd_pending;
 383         struct mutex cmd_lock;  /* protects cmd queue */
 384
 385         void *cmd_complete_mi_arg;
 386         void *cmd_complete_dep_arg;
 387
 388         struct pn533_poll_modulations *poll_mod_active[PN533_POLL_MOD_MAX + 1];
 389         u8 poll_mod_count;
 390         u8 poll_mod_curr;
 391         u8 poll_dep;
 392         u32 poll_protocols;
 393         u32 listen_protocols;
 394         struct timer_list listen_timer;
 395         int cancel_listen;
 396
 397         u8 *gb;
 398         size_t gb_len;
 399
 400         u8 tgt_available_prots;
 401         u8 tgt_active_prot;
 402         u8 tgt_mode;
 403
 404         struct pn533_frame_ops *ops;
 405 };
 406
 407 struct pn533_cmd {
 408         struct list_head queue;
 409         u8 code;
 410         int status;
 411         struct sk_buff *req;
 412         struct sk_buff *resp;
 413         int resp_len;
 414         pn533_send_async_complete_t  complete_cb;
 415         void *complete_cb_context;
 416 };
 417
 418 struct pn533_std_frame {
 419         u8 preamble;
 420         __be16 start_frame;
 421         u8 datalen;
 422         u8 datalen_checksum;
 423         u8 data[];
 424 } __packed;
 425
 426 struct pn533_ext_frame {        /* Extended Information frame */
 427         u8 preamble;
 428         __be16 start_frame;
 429         __be16 eif_flag;        /* fixed to 0xFFFF */
 430         __be16 datalen;
 431         u8 datalen_checksum;
 432         u8 data[];
 433 } __packed;
 434
 435 struct pn533_frame_ops {
 436         void (*tx_frame_init)(void *frame, u8 cmd_code);
 437         void (*tx_frame_finish)(void *frame);
 438         void (*tx_update_payload_len)(void *frame, int len);
 439         int tx_header_len;
 440         int tx_tail_len;
 441
 442         bool (*rx_is_frame_valid)(void *frame, struct pn533 *dev);
 443         int (*rx_frame_size)(void *frame);
 444         int rx_header_len;
 445         int rx_tail_len;
 446
 447         int max_payload_len;
 448         u8 (*get_cmd_code)(void *frame);
 449 };
 450
 451 struct pn533_acr122_ccid_hdr {
 452         u8 type;
 453         u32 datalen;
 454         u8 slot;
 455         u8 seq;
 456         u8 params[3]; /* 3 msg specific bytes or status, error and 1 specific
 457                          byte for reposnse msg */
 458         u8 data[]; /* payload */
 459 } __packed;
 460
 461 struct pn533_acr122_apdu_hdr {
 462         u8 class;
 463         u8 ins;
 464         u8 p1;
 465         u8 p2;
 466 } __packed;
 467
 468 struct pn533_acr122_tx_frame {
 469         struct pn533_acr122_ccid_hdr ccid;
 470         struct pn533_acr122_apdu_hdr apdu;
 471         u8 datalen;
 472         u8 data[]; /* pn533 frame: TFI ... */
 473 } __packed;
 474
 475 struct pn533_acr122_rx_frame {
 476         struct pn533_acr122_ccid_hdr ccid;
 477         u8 data[]; /* pn533 frame : TFI ... */
 478 } __packed;
 479
 480 static void pn533_acr122_tx_frame_init(void *_frame, u8 cmd_code)
 481 {
 482         struct pn533_acr122_tx_frame *frame = _frame;
 483
 484         frame->ccid.type = PN533_ACR122_PC_TO_RDR_ESCAPE;
 485         frame->ccid.datalen = sizeof(frame->apdu) + 1; /* sizeof(apdu_hdr) +
 486                                                           sizeof(datalen) */
 487         frame->ccid.slot = 0;
 488         frame->ccid.seq = 0;
 489         frame->ccid.params[0] = 0;
 490         frame->ccid.params[1] = 0;
 491         frame->ccid.params[2] = 0;
 492
 493         frame->data[0] = PN533_STD_FRAME_DIR_OUT;
 494         frame->data[1] = cmd_code;
 495         frame->datalen = 2;  /* data[0] + data[1] */
 496
 497         frame->apdu.class = 0xFF;
 498         frame->apdu.ins = 0;
 499         frame->apdu.p1 = 0;
 500         frame->apdu.p2 = 0;
 501 }
 502
 503 static void pn533_acr122_tx_frame_finish(void *_frame)
 504 {
 505         struct pn533_acr122_tx_frame *frame = _frame;
 506
 507         frame->ccid.datalen += frame->datalen;
 508 }
 509
 510 static void pn533_acr122_tx_update_payload_len(void *_frame, int len)
 511 {
 512         struct pn533_acr122_tx_frame *frame = _frame;
 513
 514         frame->datalen += len;
 515 }
 516
 517 static bool pn533_acr122_is_rx_frame_valid(void *_frame, struct pn533 *dev)
 518 {
 519         struct pn533_acr122_rx_frame *frame = _frame;
 520
 521         if (frame->ccid.type != 0x83)
 522                 return false;
 523
 524         if (frame->data[frame->ccid.datalen - 2] == 0x63)
 525                 return false;
 526
 527         return true;
 528 }
 529
 530 static int pn533_acr122_rx_frame_size(void *frame)
 531 {
 532         struct pn533_acr122_rx_frame *f = frame;
 533
 534         /* f->ccid.datalen already includes tail length */
 535         return sizeof(struct pn533_acr122_rx_frame) + f->ccid.datalen;
 536 }
 537
 538 static u8 pn533_acr122_get_cmd_code(void *frame)
 539 {
 540         struct pn533_acr122_rx_frame *f = frame;
 541
 542         return PN533_FRAME_CMD(f);
 543 }
 544
 545 static struct pn533_frame_ops pn533_acr122_frame_ops = {
 546         .tx_frame_init = pn533_acr122_tx_frame_init,
 547         .tx_frame_finish = pn533_acr122_tx_frame_finish,
 548         .tx_update_payload_len = pn533_acr122_tx_update_payload_len,
 549         .tx_header_len = PN533_ACR122_TX_FRAME_HEADER_LEN,
 550         .tx_tail_len = PN533_ACR122_TX_FRAME_TAIL_LEN,
 551
 552         .rx_is_frame_valid = pn533_acr122_is_rx_frame_valid,
 553         .rx_header_len = PN533_ACR122_RX_FRAME_HEADER_LEN,
 554         .rx_tail_len = PN533_ACR122_RX_FRAME_TAIL_LEN,
 555         .rx_frame_size = pn533_acr122_rx_frame_size,
 556
 557         .max_payload_len = PN533_ACR122_FRAME_MAX_PAYLOAD_LEN,
 558         .get_cmd_code = pn533_acr122_get_cmd_code,
 559 };
 560
 561 /* The rule: value(high byte) + value(low byte) + checksum = 0 */
 562 static inline u8 pn533_ext_checksum(u16 value)
 563 {
 564         return ~(u8)(((value & 0xFF00) >> 8) + (u8)(value & 0xFF)) + 1;
 565 }
 566
 567 /* The rule: value + checksum = 0 */
 568 static inline u8 pn533_std_checksum(u8 value)
 569 {
 570         return ~value + 1;
 571 }
 572
 573 /* The rule: sum(data elements) + checksum = 0 */
 574 static u8 pn533_std_data_checksum(u8 *data, int datalen)
 575 {
 576         u8 sum = 0;
 577         int i;
 578
 579         for (i = 0; i < datalen; i++)
 580                 sum += data[i];
 581
 582         return pn533_std_checksum(sum);
 583 }
 584
 585 static void pn533_std_tx_frame_init(void *_frame, u8 cmd_code)
 586 {
 587         struct pn533_std_frame *frame = _frame;
 588
 589         frame->preamble = 0;
 590         frame->start_frame = cpu_to_be16(PN533_STD_FRAME_SOF);
 591         PN533_STD_FRAME_IDENTIFIER(frame) = PN533_STD_FRAME_DIR_OUT;
 592         PN533_FRAME_CMD(frame) = cmd_code;
 593         frame->datalen = 2;
 594 }
 595
 596 static void pn533_std_tx_frame_finish(void *_frame)
 597 {
 598         struct pn533_std_frame *frame = _frame;
 599
 600         frame->datalen_checksum = pn533_std_checksum(frame->datalen);
 601
 602         PN533_STD_FRAME_CHECKSUM(frame) =
 603                 pn533_std_data_checksum(frame->data, frame->datalen);
 604
 605         PN533_STD_FRAME_POSTAMBLE(frame) = 0;
 606 }
 607
 608 static void pn533_std_tx_update_payload_len(void *_frame, int len)
 609 {
 610         struct pn533_std_frame *frame = _frame;
 611
 612         frame->datalen += len;
 613 }
 614
 615 static bool pn533_std_rx_frame_is_valid(void *_frame, struct pn533 *dev)
 616 {
 617         u8 checksum;
 618         struct pn533_std_frame *stdf = _frame;
 619
 620         if (stdf->start_frame != cpu_to_be16(PN533_STD_FRAME_SOF))
 621                 return false;
 622
 623         if (likely(!PN533_STD_IS_EXTENDED(stdf))) {
 624                 /* Standard frame code */
 625                 dev->ops->rx_header_len = PN533_STD_FRAME_HEADER_LEN;
 626
 627                 checksum = pn533_std_checksum(stdf->datalen);
 628                 if (checksum != stdf->datalen_checksum)
 629                         return false;
 630
 631                 checksum = pn533_std_data_checksum(stdf->data, stdf->datalen);
 632                 if (checksum != PN533_STD_FRAME_CHECKSUM(stdf))
 633                         return false;
 634         } else {
 635                 /* Extended */
 636                 struct pn533_ext_frame *eif = _frame;
 637
 638                 dev->ops->rx_header_len = PN533_EXT_FRAME_HEADER_LEN;
 639
 640                 checksum = pn533_ext_checksum(be16_to_cpu(eif->datalen));
 641                 if (checksum != eif->datalen_checksum)
 642                         return false;
 643
 644                 /* check data checksum */
 645                 checksum = pn533_std_data_checksum(eif->data,
 646                                                    be16_to_cpu(eif->datalen));
 647                 if (checksum != PN533_EXT_FRAME_CHECKSUM(eif))
 648                         return false;
 649         }
 650
 651         return true;
 652 }
 653
 654 static bool pn533_std_rx_frame_is_ack(struct pn533_std_frame *frame)
 655 {
 656         if (frame->start_frame != cpu_to_be16(PN533_STD_FRAME_SOF))
 657                 return false;
 658
 659         if (frame->datalen != 0 || frame->datalen_checksum != 0xFF)
 660                 return false;
 661
 662         return true;
 663 }
 664
 665 static inline int pn533_std_rx_frame_size(void *frame)
 666 {
 667         struct pn533_std_frame *f = frame;
 668
 669         /* check for Extended Information frame */
 670         if (PN533_STD_IS_EXTENDED(f)) {
 671                 struct pn533_ext_frame *eif = frame;
 672
 673                 return sizeof(struct pn533_ext_frame)
 674                         + be16_to_cpu(eif->datalen) + PN533_STD_FRAME_TAIL_LEN;
 675         }
 676
 677         return sizeof(struct pn533_std_frame) + f->datalen +
 678                PN533_STD_FRAME_TAIL_LEN;
 679 }
 680
 681 static u8 pn533_std_get_cmd_code(void *frame)
 682 {
 683         struct pn533_std_frame *f = frame;
 684         struct pn533_ext_frame *eif = frame;
 685
 686         if (PN533_STD_IS_EXTENDED(f))
 687                 return PN533_FRAME_CMD(eif);
 688         else
 689                 return PN533_FRAME_CMD(f);
 690 }
 691
 692 static struct pn533_frame_ops pn533_std_frame_ops = {
 693         .tx_frame_init = pn533_std_tx_frame_init,
 694         .tx_frame_finish = pn533_std_tx_frame_finish,
 695         .tx_update_payload_len = pn533_std_tx_update_payload_len,
 696         .tx_header_len = PN533_STD_FRAME_HEADER_LEN,
 697         .tx_tail_len = PN533_STD_FRAME_TAIL_LEN,
 698
 699         .rx_is_frame_valid = pn533_std_rx_frame_is_valid,
 700         .rx_frame_size = pn533_std_rx_frame_size,
 701         .rx_header_len = PN533_STD_FRAME_HEADER_LEN,
 702         .rx_tail_len = PN533_STD_FRAME_TAIL_LEN,
 703
 704         .max_payload_len =  PN533_STD_FRAME_MAX_PAYLOAD_LEN,
 705         .get_cmd_code = pn533_std_get_cmd_code,
 706 };
 707
 708 static bool pn533_rx_frame_is_cmd_response(struct pn533 *dev, void *frame)
 709 {
 710         return (dev->ops->get_cmd_code(frame) ==
 711                                 PN533_CMD_RESPONSE(dev->cmd->code));
 712 }
 713
 714 static void pn533_recv_response(struct urb *urb)
 715 {
 716         struct pn533 *dev = urb->context;
 717         struct pn533_cmd *cmd = dev->cmd;
 718         u8 *in_frame;
 719
 720         cmd->status = urb->status;
 721
 722         switch (urb->status) {
 723         case 0:
 724                 break; /* success */
 725         case -ECONNRESET:
 726         case -ENOENT:
 727                 dev_dbg(&dev->interface->dev,
 728                         "The urb has been canceled (status %d)\n",
 729                         urb->status);
 730                 goto sched_wq;
 731         case -ESHUTDOWN:
 732         default:
 733                 nfc_err(&dev->interface->dev,
 734                         "Urb failure (status %d)\n", urb->status);
 735                 goto sched_wq;
 736         }
 737
 738         in_frame = dev->in_urb->transfer_buffer;
 739
 740         dev_dbg(&dev->interface->dev, "Received a frame\n");
 741         print_hex_dump_debug("PN533 RX: ", DUMP_PREFIX_NONE, 16, 1, in_frame,
 742                              dev->ops->rx_frame_size(in_frame), false);
 743
 744         if (!dev->ops->rx_is_frame_valid(in_frame, dev)) {
 745                 nfc_err(&dev->interface->dev, "Received an invalid frame\n");
 746                 cmd->status = -EIO;
 747                 goto sched_wq;
 748         }
 749
 750         if (!pn533_rx_frame_is_cmd_response(dev, in_frame)) {
 751                 nfc_err(&dev->interface->dev,
 752                         "It it not the response to the last command\n");
 753                 cmd->status = -EIO;
 754                 goto sched_wq;
 755         }
 756
 757 sched_wq:
 758         queue_work(dev->wq, &dev->cmd_complete_work);
 759 }
 760
 761 static int pn533_submit_urb_for_response(struct pn533 *dev, gfp_t flags)
 762 {
 763         dev->in_urb->complete = pn533_recv_response;
 764
 765         return usb_submit_urb(dev->in_urb, flags);
 766 }
 767
 768 static void pn533_recv_ack(struct urb *urb)
 769 {
 770         struct pn533 *dev = urb->context;
 771         struct pn533_cmd *cmd = dev->cmd;
 772         struct pn533_std_frame *in_frame;
 773         int rc;
 774
 775         cmd->status = urb->status;
 776
 777         switch (urb->status) {
 778         case 0:
 779                 break; /* success */
 780         case -ECONNRESET:
 781         case -ENOENT:
 782                 dev_dbg(&dev->interface->dev,
 783                         "The urb has been stopped (status %d)\n",
 784                         urb->status);
 785                 goto sched_wq;
 786         case -ESHUTDOWN:
 787         default:
 788                 nfc_err(&dev->interface->dev,
 789                         "Urb failure (status %d)\n", urb->status);
 790                 goto sched_wq;
 791         }
 792
 793         in_frame = dev->in_urb->transfer_buffer;
 794
 795         if (!pn533_std_rx_frame_is_ack(in_frame)) {
 796                 nfc_err(&dev->interface->dev, "Received an invalid ack\n");
 797                 cmd->status = -EIO;
 798                 goto sched_wq;
 799         }
 800
 801         rc = pn533_submit_urb_for_response(dev, GFP_ATOMIC);
 802         if (rc) {
 803                 nfc_err(&dev->interface->dev,
 804                         "usb_submit_urb failed with result %d\n", rc);
 805                 cmd->status = rc;
 806                 goto sched_wq;
 807         }
 808
 809         return;
 810
 811 sched_wq:
 812         queue_work(dev->wq, &dev->cmd_complete_work);
 813 }
 814
 815 static int pn533_submit_urb_for_ack(struct pn533 *dev, gfp_t flags)
 816 {
 817         dev->in_urb->complete = pn533_recv_ack;
 818
 819         return usb_submit_urb(dev->in_urb, flags);
 820 }
 821
 822 static int pn533_send_ack(struct pn533 *dev, gfp_t flags)
 823 {
 824         u8 ack[PN533_STD_FRAME_ACK_SIZE] = {0x00, 0x00, 0xff, 0x00, 0xff, 0x00};
 825         /* spec 7.1.1.3:  Preamble, SoPC (2), ACK Code (2), Postamble */
 826         int rc;
 827
 828         dev->out_urb->transfer_buffer = ack;
 829         dev->out_urb->transfer_buffer_length = sizeof(ack);
 830         rc = usb_submit_urb(dev->out_urb, flags);
 831
 832         return rc;
 833 }
 834
 835 static int __pn533_send_frame_async(struct pn533 *dev,
 836                                         struct sk_buff *out,
 837                                         struct sk_buff *in,
 838                                         int in_len)
 839 {
 840         int rc;
 841
 842         dev->out_urb->transfer_buffer = out->data;
 843         dev->out_urb->transfer_buffer_length = out->len;
 844
 845         dev->in_urb->transfer_buffer = in->data;
 846         dev->in_urb->transfer_buffer_length = in_len;
 847
 848         print_hex_dump_debug("PN533 TX: ", DUMP_PREFIX_NONE, 16, 1,
 849                              out->data, out->len, false);
 850
 851         rc = usb_submit_urb(dev->out_urb, GFP_KERNEL);
 852         if (rc)
 853                 return rc;
 854
 855         if (dev->protocol_type == PN533_PROTO_REQ_RESP) {
 856                 /* request for response for sent packet directly */
 857                 rc = pn533_submit_urb_for_response(dev, GFP_ATOMIC);
 858                 if (rc)
 859                         goto error;
 860         } else if (dev->protocol_type == PN533_PROTO_REQ_ACK_RESP) {
 861                 /* request for ACK if that's the case */
 862                 rc = pn533_submit_urb_for_ack(dev, GFP_KERNEL);
 863                 if (rc)
 864                         goto error;
 865         }
 866
 867         return 0;
 868
 869 error:
 870         usb_unlink_urb(dev->out_urb);
 871         return rc;
 872 }
 873
 874 static void pn533_build_cmd_frame(struct pn533 *dev, u8 cmd_code,
 875                                   struct sk_buff *skb)
 876 {
 877         /* payload is already there, just update datalen */
 878         int payload_len = skb->len;
 879         struct pn533_frame_ops *ops = dev->ops;
 880
 881
 882         skb_push(skb, ops->tx_header_len);
 883         skb_put(skb, ops->tx_tail_len);
 884
 885         ops->tx_frame_init(skb->data, cmd_code);
 886         ops->tx_update_payload_len(skb->data, payload_len);
 887         ops->tx_frame_finish(skb->data);
 888 }
 889
 890 static int pn533_send_async_complete(struct pn533 *dev)
 891 {
 892         struct pn533_cmd *cmd = dev->cmd;
 893         int status = cmd->status;
 894
 895         struct sk_buff *req = cmd->req;
 896         struct sk_buff *resp = cmd->resp;
 897
 898         int rc;
 899
 900         dev_kfree_skb(req);
 901
 902         if (status < 0) {
 903                 rc = cmd->complete_cb(dev, cmd->complete_cb_context,
 904                                       ERR_PTR(status));
 905                 dev_kfree_skb(resp);
 906                 goto done;
 907         }
 908
 909         skb_put(resp, dev->ops->rx_frame_size(resp->data));
 910         skb_pull(resp, dev->ops->rx_header_len);
 911         skb_trim(resp, resp->len - dev->ops->rx_tail_len);
 912
 913         rc = cmd->complete_cb(dev, cmd->complete_cb_context, resp);
 914
 915 done:
 916         kfree(cmd);
 917         dev->cmd = NULL;
 918         return rc;
 919 }
 920
 921 static int __pn533_send_async(struct pn533 *dev, u8 cmd_code,
 922                               struct sk_buff *req, struct sk_buff *resp,
 923                               int resp_len,
 924                               pn533_send_async_complete_t complete_cb,
 925                               void *complete_cb_context)
 926 {
 927         struct pn533_cmd *cmd;
 928         int rc = 0;
 929
 930         dev_dbg(&dev->interface->dev, "Sending command 0x%x\n", cmd_code);
 931
 932         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
 933         if (!cmd)
 934                 return -ENOMEM;
 935
 936         cmd->code = cmd_code;
 937         cmd->req = req;
 938         cmd->resp = resp;
 939         cmd->resp_len = resp_len;
 940         cmd->complete_cb = complete_cb;
 941         cmd->complete_cb_context = complete_cb_context;
 942
 943         pn533_build_cmd_frame(dev, cmd_code, req);
 944
 945         mutex_lock(&dev->cmd_lock);
 946
 947         if (!dev->cmd_pending) {
 948                 rc = __pn533_send_frame_async(dev, req, resp, resp_len);
 949                 if (rc)
 950                         goto error;
 951
 952                 dev->cmd_pending = 1;
 953                 dev->cmd = cmd;
 954                 goto unlock;
 955         }
 956
 957         dev_dbg(&dev->interface->dev, "%s Queueing command 0x%x\n",
 958                 __func__, cmd_code);
 959
 960         INIT_LIST_HEAD(&cmd->queue);
 961         list_add_tail(&cmd->queue, &dev->cmd_queue);
 962
 963         goto unlock;
 964
 965 error:
 966         kfree(cmd);
 967 unlock:
 968         mutex_unlock(&dev->cmd_lock);
 969         return rc;
 970 }
 971
 972 static int pn533_send_data_async(struct pn533 *dev, u8 cmd_code,
 973                                  struct sk_buff *req,
 974                                  pn533_send_async_complete_t complete_cb,
 975                                  void *complete_cb_context)
 976 {
 977         struct sk_buff *resp;
 978         int rc;
 979         int  resp_len = dev->ops->rx_header_len +
 980                         dev->ops->max_payload_len +
 981                         dev->ops->rx_tail_len;
 982
 983         resp = nfc_alloc_recv_skb(resp_len, GFP_KERNEL);
 984         if (!resp)
 985                 return -ENOMEM;
 986
 987         rc = __pn533_send_async(dev, cmd_code, req, resp, resp_len, complete_cb,
 988                                 complete_cb_context);
 989         if (rc)
 990                 dev_kfree_skb(resp);
 991
 992         return rc;
 993 }
 994
 995 static int pn533_send_cmd_async(struct pn533 *dev, u8 cmd_code,
 996                                 struct sk_buff *req,
 997                                 pn533_send_async_complete_t complete_cb,
 998                                 void *complete_cb_context)
 999 {
1000         struct sk_buff *resp;
1001         int rc;
1002         int  resp_len = dev->ops->rx_header_len +
1003                         dev->ops->max_payload_len +
1004                         dev->ops->rx_tail_len;
1005
1006         resp = alloc_skb(resp_len, GFP_KERNEL);
1007         if (!resp)
1008                 return -ENOMEM;
1009
1010         rc = __pn533_send_async(dev, cmd_code, req, resp, resp_len, complete_cb,
1011                                 complete_cb_context);
1012         if (rc)
1013                 dev_kfree_skb(resp);
1014
1015         return rc;
1016 }
1017
1018 /*
1019  * pn533_send_cmd_direct_async
1020  *
1021  * The function sends a piority cmd directly to the chip omiting the cmd
1022  * queue. It's intended to be used by chaining mechanism of received responses
1023  * where the host has to request every single chunk of data before scheduling
1024  * next cmd from the queue.
1025  */
1026 static int pn533_send_cmd_direct_async(struct pn533 *dev, u8 cmd_code,
1027                                        struct sk_buff *req,
1028                                        pn533_send_async_complete_t complete_cb,
1029                                        void *complete_cb_context)
1030 {
1031         struct sk_buff *resp;
1032         struct pn533_cmd *cmd;
1033         int rc;
1034         int resp_len = dev->ops->rx_header_len +
1035                        dev->ops->max_payload_len +
1036                        dev->ops->rx_tail_len;
1037
1038         resp = alloc_skb(resp_len, GFP_KERNEL);
1039         if (!resp)
1040                 return -ENOMEM;
1041
1042         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
1043         if (!cmd) {
1044                 dev_kfree_skb(resp);
1045                 return -ENOMEM;
1046         }
1047
1048         cmd->code = cmd_code;
1049         cmd->req = req;
1050         cmd->resp = resp;
1051         cmd->resp_len = resp_len;
1052         cmd->complete_cb = complete_cb;
1053         cmd->complete_cb_context = complete_cb_context;
1054
1055         pn533_build_cmd_frame(dev, cmd_code, req);
1056
1057         rc = __pn533_send_frame_async(dev, req, resp, resp_len);
1058         if (rc < 0) {
1059                 dev_kfree_skb(resp);
1060                 kfree(cmd);
1061         } else {
1062                 dev->cmd = cmd;
1063         }
1064
1065         return rc;
1066 }
1067
1068 static void pn533_wq_cmd_complete(struct work_struct *work)
1069 {
1070         struct pn533 *dev = container_of(work, struct pn533, cmd_complete_work);
1071         int rc;
1072
1073         rc = pn533_send_async_complete(dev);
1074         if (rc != -EINPROGRESS)
1075                 queue_work(dev->wq, &dev->cmd_work);
1076 }
1077
1078 static void pn533_wq_cmd(struct work_struct *work)
1079 {
1080         struct pn533 *dev = container_of(work, struct pn533, cmd_work);
1081         struct pn533_cmd *cmd;
1082         int rc;
1083
1084         mutex_lock(&dev->cmd_lock);
1085
1086         if (list_empty(&dev->cmd_queue)) {
1087                 dev->cmd_pending = 0;
1088                 mutex_unlock(&dev->cmd_lock);
1089                 return;
1090         }
1091
1092         cmd = list_first_entry(&dev->cmd_queue, struct pn533_cmd, queue);
1093
1094         list_del(&cmd->queue);
1095
1096         mutex_unlock(&dev->cmd_lock);
1097
1098         rc = __pn533_send_frame_async(dev, cmd->req, cmd->resp, cmd->resp_len);
1099         if (rc < 0) {
1100                 dev_kfree_skb(cmd->req);
1101                 dev_kfree_skb(cmd->resp);
1102                 kfree(cmd);
1103                 return;
1104         }
1105
1106         dev->cmd = cmd;
1107 }
1108
1109 struct pn533_sync_cmd_response {
1110         struct sk_buff *resp;
1111         struct completion done;
1112 };
1113
1114 static int pn533_send_sync_complete(struct pn533 *dev, void *_arg,
1115                                     struct sk_buff *resp)
1116 {
1117         struct pn533_sync_cmd_response *arg = _arg;
1118
1119         arg->resp = resp;
1120         complete(&arg->done);
1121
1122         return 0;
1123 }
1124
1125 /*  pn533_send_cmd_sync
1126  *
1127  *  Please note the req parameter is freed inside the function to
1128  *  limit a number of return value interpretations by the caller.
1129  *
1130  *  1. negative in case of error during TX path -> req should be freed
1131  *
1132  *  2. negative in case of error during RX path -> req should not be freed
1133  *     as it's been already freed at the begining of RX path by
1134  *     async_complete_cb.
1135  *
1136  *  3. valid pointer in case of succesfult RX path
1137  *
1138  *  A caller has to check a return value with IS_ERR macro. If the test pass,
1139  *  the returned pointer is valid.
1140  *
1141  * */
1142 static struct sk_buff *pn533_send_cmd_sync(struct pn533 *dev, u8 cmd_code,
1143                                                struct sk_buff *req)
1144 {
1145         int rc;
1146         struct pn533_sync_cmd_response arg;
1147
1148         init_completion(&arg.done);
1149
1150         rc = pn533_send_cmd_async(dev, cmd_code, req,
1151                                   pn533_send_sync_complete, &arg);
1152         if (rc) {
1153                 dev_kfree_skb(req);
1154                 return ERR_PTR(rc);
1155         }
1156
1157         wait_for_completion(&arg.done);
1158
1159         return arg.resp;
1160 }
1161
1162 static void pn533_send_complete(struct urb *urb)
1163 {
1164         struct pn533 *dev = urb->context;
1165
1166         switch (urb->status) {
1167         case 0:
1168                 break; /* success */
1169         case -ECONNRESET:
1170         case -ENOENT:
1171                 dev_dbg(&dev->interface->dev,
1172                         "The urb has been stopped (status %d)\n",
1173                         urb->status);
1174                 break;
1175         case -ESHUTDOWN:
1176         default:
1177                 nfc_err(&dev->interface->dev, "Urb failure (status %d)\n",
1178                         urb->status);
1179         }
1180 }
1181
1182 static void pn533_abort_cmd(struct pn533 *dev, gfp_t flags)
1183 {
1184         /* ACR122U does not support any command which aborts last
1185          * issued command i.e. as ACK for standard PN533. Additionally,
1186          * it behaves stange, sending broken or incorrect responses,
1187          * when we cancel urb before the chip will send response.
1188          */
1189         if (dev->device_type == PN533_DEVICE_ACR122U)
1190                 return;
1191
1192         /* An ack will cancel the last issued command */
1193         pn533_send_ack(dev, flags);
1194
1195         /* cancel the urb request */
1196         usb_kill_urb(dev->in_urb);
1197 }
1198
1199 static struct sk_buff *pn533_alloc_skb(struct pn533 *dev, unsigned int size)
1200 {
1201         struct sk_buff *skb;
1202
1203         skb = alloc_skb(dev->ops->tx_header_len +
1204                         size +
1205                         dev->ops->tx_tail_len, GFP_KERNEL);
1206
1207         if (skb)
1208                 skb_reserve(skb, dev->ops->tx_header_len);
1209
1210         return skb;
1211 }
1212
1213 struct pn533_target_type_a {
1214         __be16 sens_res;
1215         u8 sel_res;
1216         u8 nfcid_len;
1217         u8 nfcid_data[];
1218 } __packed;
1219
1220
1221 #define PN533_TYPE_A_SENS_RES_NFCID1(x) ((u8)((be16_to_cpu(x) & 0x00C0) >> 6))
1222 #define PN533_TYPE_A_SENS_RES_SSD(x) ((u8)((be16_to_cpu(x) & 0x001F) >> 0))
1223 #define PN533_TYPE_A_SENS_RES_PLATCONF(x) ((u8)((be16_to_cpu(x) & 0x0F00) >> 8))
1224
1225 #define PN533_TYPE_A_SENS_RES_SSD_JEWEL 0x00
1226 #define PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL 0x0C
1227
1228 #define PN533_TYPE_A_SEL_PROT(x) (((x) & 0x60) >> 5)
1229 #define PN533_TYPE_A_SEL_CASCADE(x) (((x) & 0x04) >> 2)
1230
1231 #define PN533_TYPE_A_SEL_PROT_MIFARE 0
1232 #define PN533_TYPE_A_SEL_PROT_ISO14443 1
1233 #define PN533_TYPE_A_SEL_PROT_DEP 2
1234 #define PN533_TYPE_A_SEL_PROT_ISO14443_DEP 3
1235
1236 static bool pn533_target_type_a_is_valid(struct pn533_target_type_a *type_a,
1237                                                         int target_data_len)
1238 {
1239         u8 ssd;
1240         u8 platconf;
1241
1242         if (target_data_len < sizeof(struct pn533_target_type_a))
1243                 return false;
1244
1245         /* The lenght check of nfcid[] and ats[] are not being performed because
1246            the values are not being used */
1247
1248         /* Requirement 4.6.3.3 from NFC Forum Digital Spec */
1249         ssd = PN533_TYPE_A_SENS_RES_SSD(type_a->sens_res);
1250         platconf = PN533_TYPE_A_SENS_RES_PLATCONF(type_a->sens_res);
1251
1252         if ((ssd == PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
1253              platconf != PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL) ||
1254             (ssd != PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
1255              platconf == PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL))
1256                 return false;
1257
1258         /* Requirements 4.8.2.1, 4.8.2.3, 4.8.2.5 and 4.8.2.7 from NFC Forum */
1259         if (PN533_TYPE_A_SEL_CASCADE(type_a->sel_res) != 0)
1260                 return false;
1261
1262         return true;
1263 }
1264
1265 static int pn533_target_found_type_a(struct nfc_target *nfc_tgt, u8 *tgt_data,
1266                                                         int tgt_data_len)
1267 {
1268         struct pn533_target_type_a *tgt_type_a;
1269
1270         tgt_type_a = (struct pn533_target_type_a *)tgt_data;
1271
1272         if (!pn533_target_type_a_is_valid(tgt_type_a, tgt_data_len))
1273                 return -EPROTO;
1274
1275         switch (PN533_TYPE_A_SEL_PROT(tgt_type_a->sel_res)) {
1276         case PN533_TYPE_A_SEL_PROT_MIFARE:
1277                 nfc_tgt->supported_protocols = NFC_PROTO_MIFARE_MASK;
1278                 break;
1279         case PN533_TYPE_A_SEL_PROT_ISO14443:
1280                 nfc_tgt->supported_protocols = NFC_PROTO_ISO14443_MASK;
1281                 break;
1282         case PN533_TYPE_A_SEL_PROT_DEP:
1283                 nfc_tgt->supported_protocols = NFC_PROTO_NFC_DEP_MASK;
1284                 break;
1285         case PN533_TYPE_A_SEL_PROT_ISO14443_DEP:
1286                 nfc_tgt->supported_protocols = NFC_PROTO_ISO14443_MASK |
1287                                                         NFC_PROTO_NFC_DEP_MASK;
1288                 break;
1289         }
1290
1291         nfc_tgt->sens_res = be16_to_cpu(tgt_type_a->sens_res);
1292         nfc_tgt->sel_res = tgt_type_a->sel_res;
1293         nfc_tgt->nfcid1_len = tgt_type_a->nfcid_len;
1294         memcpy(nfc_tgt->nfcid1, tgt_type_a->nfcid_data, nfc_tgt->nfcid1_len);
1295
1296         return 0;
1297 }
1298
1299 struct pn533_target_felica {
1300         u8 pol_res;
1301         u8 opcode;
1302         u8 nfcid2[NFC_NFCID2_MAXSIZE];
1303         u8 pad[8];
1304         /* optional */
1305         u8 syst_code[];
1306 } __packed;
1307
1308 #define PN533_FELICA_SENSF_NFCID2_DEP_B1 0x01
1309 #define PN533_FELICA_SENSF_NFCID2_DEP_B2 0xFE
1310
1311 static bool pn533_target_felica_is_valid(struct pn533_target_felica *felica,
1312                                                         int target_data_len)
1313 {
1314         if (target_data_len < sizeof(struct pn533_target_felica))
1315                 return false;
1316
1317         if (felica->opcode != PN533_FELICA_OPC_SENSF_RES)
1318                 return false;
1319
1320         return true;
1321 }
1322
1323 static int pn533_target_found_felica(struct nfc_target *nfc_tgt, u8 *tgt_data,
1324                                                         int tgt_data_len)
1325 {
1326         struct pn533_target_felica *tgt_felica;
1327
1328         tgt_felica = (struct pn533_target_felica *)tgt_data;
1329
1330         if (!pn533_target_felica_is_valid(tgt_felica, tgt_data_len))
1331                 return -EPROTO;
1332
1333         if ((tgt_felica->nfcid2[0] == PN533_FELICA_SENSF_NFCID2_DEP_B1) &&
1334             (tgt_felica->nfcid2[1] == PN533_FELICA_SENSF_NFCID2_DEP_B2))
1335                 nfc_tgt->supported_protocols = NFC_PROTO_NFC_DEP_MASK;
1336         else
1337                 nfc_tgt->supported_protocols = NFC_PROTO_FELICA_MASK;
1338
1339         memcpy(nfc_tgt->sensf_res, &tgt_felica->opcode, 9);
1340         nfc_tgt->sensf_res_len = 9;
1341
1342         memcpy(nfc_tgt->nfcid2, tgt_felica->nfcid2, NFC_NFCID2_MAXSIZE);
1343         nfc_tgt->nfcid2_len = NFC_NFCID2_MAXSIZE;
1344
1345         return 0;
1346 }
1347
1348 struct pn533_target_jewel {
1349         __be16 sens_res;
1350         u8 jewelid[4];
1351 } __packed;
1352
1353 static bool pn533_target_jewel_is_valid(struct pn533_target_jewel *jewel,
1354                                                         int target_data_len)
1355 {
1356         u8 ssd;
1357         u8 platconf;
1358
1359         if (target_data_len < sizeof(struct pn533_target_jewel))
1360                 return false;
1361
1362         /* Requirement 4.6.3.3 from NFC Forum Digital Spec */
1363         ssd = PN533_TYPE_A_SENS_RES_SSD(jewel->sens_res);
1364         platconf = PN533_TYPE_A_SENS_RES_PLATCONF(jewel->sens_res);
1365
1366         if ((ssd == PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
1367              platconf != PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL) ||
1368             (ssd != PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
1369              platconf == PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL))
1370                 return false;
1371
1372         return true;
1373 }
1374
1375 static int pn533_target_found_jewel(struct nfc_target *nfc_tgt, u8 *tgt_data,
1376                                                         int tgt_data_len)
1377 {
1378         struct pn533_target_jewel *tgt_jewel;
1379
1380         tgt_jewel = (struct pn533_target_jewel *)tgt_data;
1381
1382         if (!pn533_target_jewel_is_valid(tgt_jewel, tgt_data_len))
1383                 return -EPROTO;
1384
1385         nfc_tgt->supported_protocols = NFC_PROTO_JEWEL_MASK;
1386         nfc_tgt->sens_res = be16_to_cpu(tgt_jewel->sens_res);
1387         nfc_tgt->nfcid1_len = 4;
1388         memcpy(nfc_tgt->nfcid1, tgt_jewel->jewelid, nfc_tgt->nfcid1_len);
1389
1390         return 0;
1391 }
1392
1393 struct pn533_type_b_prot_info {
1394         u8 bitrate;
1395         u8 fsci_type;
1396         u8 fwi_adc_fo;
1397 } __packed;
1398
1399 #define PN533_TYPE_B_PROT_FCSI(x) (((x) & 0xF0) >> 4)
1400 #define PN533_TYPE_B_PROT_TYPE(x) (((x) & 0x0F) >> 0)
1401 #define PN533_TYPE_B_PROT_TYPE_RFU_MASK 0x8
1402
1403 struct pn533_type_b_sens_res {
1404         u8 opcode;
1405         u8 nfcid[4];
1406         u8 appdata[4];
1407         struct pn533_type_b_prot_info prot_info;
1408 } __packed;
1409
1410 #define PN533_TYPE_B_OPC_SENSB_RES 0x50
1411
1412 struct pn533_target_type_b {
1413         struct pn533_type_b_sens_res sensb_res;
1414         u8 attrib_res_len;
1415         u8 attrib_res[];
1416 } __packed;
1417
1418 static bool pn533_target_type_b_is_valid(struct pn533_target_type_b *type_b,
1419                                                         int target_data_len)
1420 {
1421         if (target_data_len < sizeof(struct pn533_target_type_b))
1422                 return false;
1423
1424         if (type_b->sensb_res.opcode != PN533_TYPE_B_OPC_SENSB_RES)
1425                 return false;
1426
1427         if (PN533_TYPE_B_PROT_TYPE(type_b->sensb_res.prot_info.fsci_type) &
1428                                                 PN533_TYPE_B_PROT_TYPE_RFU_MASK)
1429                 return false;
1430
1431         return true;
1432 }
1433
1434 static int pn533_target_found_type_b(struct nfc_target *nfc_tgt, u8 *tgt_data,
1435                                                         int tgt_data_len)
1436 {
1437         struct pn533_target_type_b *tgt_type_b;
1438
1439         tgt_type_b = (struct pn533_target_type_b *)tgt_data;
1440
1441         if (!pn533_target_type_b_is_valid(tgt_type_b, tgt_data_len))
1442                 return -EPROTO;
1443
1444         nfc_tgt->supported_protocols = NFC_PROTO_ISO14443_B_MASK;
1445
1446         return 0;
1447 }
1448
1449 static int pn533_target_found(struct pn533 *dev, u8 tg, u8 *tgdata,
1450                               int tgdata_len)
1451 {
1452         struct nfc_target nfc_tgt;
1453         int rc;
1454
1455         dev_dbg(&dev->interface->dev, "%s: modulation=%d\n",
1456                 __func__, dev->poll_mod_curr);
1457
1458         if (tg != 1)
1459                 return -EPROTO;
1460
1461         memset(&nfc_tgt, 0, sizeof(struct nfc_target));
1462
1463         switch (dev->poll_mod_curr) {
1464         case PN533_POLL_MOD_106KBPS_A:
1465                 rc = pn533_target_found_type_a(&nfc_tgt, tgdata, tgdata_len);
1466                 break;
1467         case PN533_POLL_MOD_212KBPS_FELICA:
1468         case PN533_POLL_MOD_424KBPS_FELICA:
1469                 rc = pn533_target_found_felica(&nfc_tgt, tgdata, tgdata_len);
1470                 break;
1471         case PN533_POLL_MOD_106KBPS_JEWEL:
1472                 rc = pn533_target_found_jewel(&nfc_tgt, tgdata, tgdata_len);
1473                 break;
1474         case PN533_POLL_MOD_847KBPS_B:
1475                 rc = pn533_target_found_type_b(&nfc_tgt, tgdata, tgdata_len);
1476                 break;
1477         default:
1478                 nfc_err(&dev->interface->dev,
1479                         "Unknown current poll modulation\n");
1480                 return -EPROTO;
1481         }
1482
1483         if (rc)
1484                 return rc;
1485
1486         if (!(nfc_tgt.supported_protocols & dev->poll_protocols)) {
1487                 dev_dbg(&dev->interface->dev,
1488                         "The Tg found doesn't have the desired protocol\n");
1489                 return -EAGAIN;
1490         }
1491
1492         dev_dbg(&dev->interface->dev,
1493                 "Target found - supported protocols: 0x%x\n",
1494                 nfc_tgt.supported_protocols);
1495
1496         dev->tgt_available_prots = nfc_tgt.supported_protocols;
1497
1498         nfc_targets_found(dev->nfc_dev, &nfc_tgt, 1);
1499
1500         return 0;
1501 }
1502
1503 static inline void pn533_poll_next_mod(struct pn533 *dev)
1504 {
1505         dev->poll_mod_curr = (dev->poll_mod_curr + 1) % dev->poll_mod_count;
1506 }
1507
1508 static void pn533_poll_reset_mod_list(struct pn533 *dev)
1509 {
1510         dev->poll_mod_count = 0;
1511 }
1512
1513 static void pn533_poll_add_mod(struct pn533 *dev, u8 mod_index)
1514 {
1515         dev->poll_mod_active[dev->poll_mod_count] =
1516                 (struct pn533_poll_modulations *)&poll_mod[mod_index];
1517         dev->poll_mod_count++;
1518 }
1519
1520 static void pn533_poll_create_mod_list(struct pn533 *dev,
1521                                        u32 im_protocols, u32 tm_protocols)
1522 {
1523         pn533_poll_reset_mod_list(dev);
1524
1525         if ((im_protocols & NFC_PROTO_MIFARE_MASK) ||
1526             (im_protocols & NFC_PROTO_ISO14443_MASK) ||
1527             (im_protocols & NFC_PROTO_NFC_DEP_MASK))
1528                 pn533_poll_add_mod(dev, PN533_POLL_MOD_106KBPS_A);
1529
1530         if (im_protocols & NFC_PROTO_FELICA_MASK ||
1531             im_protocols & NFC_PROTO_NFC_DEP_MASK) {
1532                 pn533_poll_add_mod(dev, PN533_POLL_MOD_212KBPS_FELICA);
1533                 pn533_poll_add_mod(dev, PN533_POLL_MOD_424KBPS_FELICA);
1534         }
1535
1536         if (im_protocols & NFC_PROTO_JEWEL_MASK)
1537                 pn533_poll_add_mod(dev, PN533_POLL_MOD_106KBPS_JEWEL);
1538
1539         if (im_protocols & NFC_PROTO_ISO14443_B_MASK)
1540                 pn533_poll_add_mod(dev, PN533_POLL_MOD_847KBPS_B);
1541
1542         if (tm_protocols)
1543                 pn533_poll_add_mod(dev, PN533_LISTEN_MOD);
1544 }
1545
1546 static int pn533_start_poll_complete(struct pn533 *dev, struct sk_buff *resp)
1547 {
1548         u8 nbtg, tg, *tgdata;
1549         int rc, tgdata_len;
1550
1551         /* Toggle the DEP polling */
1552         dev->poll_dep = 1;
1553
1554         nbtg = resp->data[0];
1555         tg = resp->data[1];
1556         tgdata = &resp->data[2];
1557         tgdata_len = resp->len - 2;  /* nbtg + tg */
1558
1559         if (nbtg) {
1560                 rc = pn533_target_found(dev, tg, tgdata, tgdata_len);
1561
1562                 /* We must stop the poll after a valid target found */
1563                 if (rc == 0) {
1564                         pn533_poll_reset_mod_list(dev);
1565                         return 0;
1566                 }
1567         }
1568
1569         return -EAGAIN;
1570 }
1571
1572 static struct sk_buff *pn533_alloc_poll_tg_frame(struct pn533 *dev)
1573 {
1574         struct sk_buff *skb;
1575         u8 *felica, *nfcid3, *gb;
1576
1577         u8 *gbytes = dev->gb;
1578         size_t gbytes_len = dev->gb_len;
1579
1580         u8 felica_params[18] = {0x1, 0xfe, /* DEP */
1581                                 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, /* random */
1582                                 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
1583                                 0xff, 0xff}; /* System code */
1584
1585         u8 mifare_params[6] = {0x1, 0x1, /* SENS_RES */
1586                                0x0, 0x0, 0x0,
1587                                0x40}; /* SEL_RES for DEP */
1588
1589         unsigned int skb_len = 36 + /* mode (1), mifare (6),
1590                                        felica (18), nfcid3 (10), gb_len (1) */
1591                                gbytes_len +
1592                                1;  /* len Tk*/
1593
1594         skb = pn533_alloc_skb(dev, skb_len);
1595         if (!skb)
1596                 return NULL;
1597
1598         /* DEP support only */
1599         *skb_put(skb, 1) = PN533_INIT_TARGET_DEP;
1600
1601         /* MIFARE params */
1602         memcpy(skb_put(skb, 6), mifare_params, 6);
1603
1604         /* Felica params */
1605         felica = skb_put(skb, 18);
1606         memcpy(felica, felica_params, 18);
1607         get_random_bytes(felica + 2, 6);
1608
1609         /* NFCID3 */
1610         nfcid3 = skb_put(skb, 10);
1611         memset(nfcid3, 0, 10);
1612         memcpy(nfcid3, felica, 8);
1613
1614         /* General bytes */
1615         *skb_put(skb, 1) = gbytes_len;
1616
1617         gb = skb_put(skb, gbytes_len);
1618         memcpy(gb, gbytes, gbytes_len);
1619
1620         /* Len Tk */
1621         *skb_put(skb, 1) = 0;
1622
1623         return skb;
1624 }
1625
1626 #define PN533_CMD_DATAEXCH_HEAD_LEN 1
1627 #define PN533_CMD_DATAEXCH_DATA_MAXLEN 262
1628 static void pn533_wq_tm_mi_recv(struct work_struct *work);
1629 static struct sk_buff *pn533_build_response(struct pn533 *dev);
1630
1631 static int pn533_tm_get_data_complete(struct pn533 *dev, void *arg,
1632                                       struct sk_buff *resp)
1633 {
1634         struct sk_buff *skb;
1635         u8 status, ret, mi;
1636         int rc;
1637
1638         dev_dbg(&dev->interface->dev, "%s\n", __func__);
1639
1640         if (IS_ERR(resp)) {
1641                 skb_queue_purge(&dev->resp_q);
1642                 return PTR_ERR(resp);
1643         }
1644
1645         status = resp->data[0];
1646
1647         ret = status & PN533_CMD_RET_MASK;
1648         mi = status & PN533_CMD_MI_MASK;
1649
1650         skb_pull(resp, sizeof(status));
1651
1652         if (ret != PN533_CMD_RET_SUCCESS) {
1653                 rc = -EIO;
1654                 goto error;
1655         }
1656
1657         skb_queue_tail(&dev->resp_q, resp);
1658
1659         if (mi) {
1660                 queue_work(dev->wq, &dev->mi_tm_rx_work);
1661                 return -EINPROGRESS;
1662         }
1663
1664         skb = pn533_build_response(dev);
1665         if (!skb) {
1666                 rc = -EIO;
1667                 goto error;
1668         }
1669
1670         return nfc_tm_data_received(dev->nfc_dev, skb);
1671
1672 error:
1673         nfc_tm_deactivated(dev->nfc_dev);
1674         dev->tgt_mode = 0;
1675         skb_queue_purge(&dev->resp_q);
1676         dev_kfree_skb(resp);
1677
1678         return rc;
1679 }
1680
1681 static void pn533_wq_tm_mi_recv(struct work_struct *work)
1682 {
1683         struct pn533 *dev = container_of(work, struct pn533, mi_tm_rx_work);
1684         struct sk_buff *skb;
1685         int rc;
1686
1687         dev_dbg(&dev->interface->dev, "%s\n", __func__);
1688
1689         skb = pn533_alloc_skb(dev, 0);
1690         if (!skb)
1691                 return;
1692
1693         rc = pn533_send_cmd_direct_async(dev,
1694                                         PN533_CMD_TG_GET_DATA,
1695                                         skb,
1696                                         pn533_tm_get_data_complete,
1697                                         NULL);
1698
1699         if (rc < 0)
1700                 dev_kfree_skb(skb);
1701
1702         return;
1703 }
1704
1705 static void pn533_wq_tg_get_data(struct work_struct *work)
1706 {
1707         struct pn533 *dev = container_of(work, struct pn533, tg_work);
1708         struct sk_buff *skb;
1709         int rc;
1710
1711         dev_dbg(&dev->interface->dev, "%s\n", __func__);
1712
1713         skb = pn533_alloc_skb(dev, 0);
1714         if (!skb)
1715                 return;
1716
1717         rc = pn533_send_data_async(dev, PN533_CMD_TG_GET_DATA, skb,
1718                                    pn533_tm_get_data_complete, NULL);
1719
1720         if (rc < 0)
1721                 dev_kfree_skb(skb);
1722
1723         return;
1724 }
1725
1726 #define ATR_REQ_GB_OFFSET 17
1727 static int pn533_init_target_complete(struct pn533 *dev, struct sk_buff *resp)
1728 {
1729         u8 mode, *cmd, comm_mode = NFC_COMM_PASSIVE, *gb;
1730         size_t gb_len;
1731         int rc;
1732
1733         dev_dbg(&dev->interface->dev, "%s\n", __func__);
1734
1735         if (resp->len < ATR_REQ_GB_OFFSET + 1)
1736                 return -EINVAL;
1737
1738         mode = resp->data[0];
1739         cmd = &resp->data[1];
1740
1741         dev_dbg(&dev->interface->dev, "Target mode 0x%x len %d\n",
1742                 mode, resp->len);
1743
1744         if ((mode & PN533_INIT_TARGET_RESP_FRAME_MASK) ==
1745             PN533_INIT_TARGET_RESP_ACTIVE)
1746                 comm_mode = NFC_COMM_ACTIVE;
1747
1748         if ((mode & PN533_INIT_TARGET_RESP_DEP) == 0)  /* Only DEP supported */
1749                 return -EOPNOTSUPP;
1750
1751         gb = cmd + ATR_REQ_GB_OFFSET;
1752         gb_len = resp->len - (ATR_REQ_GB_OFFSET + 1);
1753
1754         rc = nfc_tm_activated(dev->nfc_dev, NFC_PROTO_NFC_DEP_MASK,
1755                               comm_mode, gb, gb_len);
1756         if (rc < 0) {
1757                 nfc_err(&dev->interface->dev,
1758                         "Error when signaling target activation\n");
1759                 return rc;
1760         }
1761
1762         dev->tgt_mode = 1;
1763         queue_work(dev->wq, &dev->tg_work);
1764
1765         return 0;
1766 }
1767
1768 static void pn533_listen_mode_timer(unsigned long data)
1769 {
1770         struct pn533 *dev = (struct pn533 *)data;
1771
1772         dev_dbg(&dev->interface->dev, "Listen mode timeout\n");
1773
1774         dev->cancel_listen = 1;
1775
1776         pn533_poll_next_mod(dev);
1777
1778         queue_delayed_work(dev->wq, &dev->poll_work,
1779                            msecs_to_jiffies(PN533_POLL_INTERVAL));
1780 }
1781
1782 static int pn533_rf_complete(struct pn533 *dev, void *arg,
1783                              struct sk_buff *resp)
1784 {
1785         int rc = 0;
1786
1787         dev_dbg(&dev->interface->dev, "%s\n", __func__);
1788
1789         if (IS_ERR(resp)) {
1790                 rc = PTR_ERR(resp);
1791
1792                 nfc_err(&dev->interface->dev, "RF setting error %d", rc);
1793
1794                 return rc;
1795         }
1796
1797         queue_delayed_work(dev->wq, &dev->poll_work,
1798                            msecs_to_jiffies(PN533_POLL_INTERVAL));
1799
1800         dev_kfree_skb(resp);
1801         return rc;
1802 }
1803
1804 static void pn533_wq_rf(struct work_struct *work)
1805 {
1806         struct pn533 *dev = container_of(work, struct pn533, rf_work);
1807         struct sk_buff *skb;
1808         int rc;
1809
1810         dev_dbg(&dev->interface->dev, "%s\n", __func__);
1811
1812         skb = pn533_alloc_skb(dev, 2);
1813         if (!skb)
1814                 return;
1815
1816         *skb_put(skb, 1) = PN533_CFGITEM_RF_FIELD;
1817         *skb_put(skb, 1) = PN533_CFGITEM_RF_FIELD_AUTO_RFCA;
1818
1819         rc = pn533_send_cmd_async(dev, PN533_CMD_RF_CONFIGURATION, skb,
1820                                   pn533_rf_complete, NULL);
1821         if (rc < 0) {
1822                 dev_kfree_skb(skb);
1823                 nfc_err(&dev->interface->dev, "RF setting error %d\n", rc);
1824         }
1825
1826         return;
1827 }
1828
1829 static int pn533_poll_dep_complete(struct pn533 *dev, void *arg,
1830                                    struct sk_buff *resp)
1831 {
1832         struct pn533_cmd_jump_dep_response *rsp;
1833         struct nfc_target nfc_target;
1834         u8 target_gt_len;
1835         int rc;
1836
1837         if (IS_ERR(resp))
1838                 return PTR_ERR(resp);
1839
1840         rsp = (struct pn533_cmd_jump_dep_response *)resp->data;
1841
1842         rc = rsp->status & PN533_CMD_RET_MASK;
1843         if (rc != PN533_CMD_RET_SUCCESS) {
1844                 /* Not target found, turn radio off */
1845                 queue_work(dev->wq, &dev->rf_work);
1846
1847                 dev_kfree_skb(resp);
1848                 return 0;
1849         }
1850
1851         dev_dbg(&dev->interface->dev, "Creating new target");
1852
1853         nfc_target.supported_protocols = NFC_PROTO_NFC_DEP_MASK;
1854         nfc_target.nfcid1_len = 10;
1855         memcpy(nfc_target.nfcid1, rsp->nfcid3t, nfc_target.nfcid1_len);
1856         rc = nfc_targets_found(dev->nfc_dev, &nfc_target, 1);
1857         if (rc)
1858                 goto error;
1859
1860         dev->tgt_available_prots = 0;
1861         dev->tgt_active_prot = NFC_PROTO_NFC_DEP;
1862
1863         /* ATR_RES general bytes are located at offset 17 */
1864         target_gt_len = resp->len - 17;
1865         rc = nfc_set_remote_general_bytes(dev->nfc_dev,
1866                                           rsp->gt, target_gt_len);
1867         if (!rc) {
1868                 rc = nfc_dep_link_is_up(dev->nfc_dev,
1869                                         dev->nfc_dev->targets[0].idx,
1870                                         0, NFC_RF_INITIATOR);
1871
1872                 if (!rc)
1873                         pn533_poll_reset_mod_list(dev);
1874         }
1875 error:
1876         dev_kfree_skb(resp);
1877         return rc;
1878 }
1879
1880 #define PASSIVE_DATA_LEN 5
1881 static int pn533_poll_dep(struct nfc_dev *nfc_dev)
1882 {
1883         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
1884         struct sk_buff *skb;
1885         int rc, skb_len;
1886         u8 *next, nfcid3[NFC_NFCID3_MAXSIZE];
1887         u8 passive_data[PASSIVE_DATA_LEN] = {0x00, 0xff, 0xff, 0x00, 0x3};
1888
1889         dev_dbg(&dev->interface->dev, "%s", __func__);
1890
1891         if (!dev->gb) {
1892                 dev->gb = nfc_get_local_general_bytes(nfc_dev, &dev->gb_len);
1893
1894                 if (!dev->gb || !dev->gb_len) {
1895                         dev->poll_dep = 0;
1896                         queue_work(dev->wq, &dev->rf_work);
1897                 }
1898         }
1899
1900         skb_len = 3 + dev->gb_len; /* ActPass + BR + Next */
1901         skb_len += PASSIVE_DATA_LEN;
1902
1903         /* NFCID3 */
1904         skb_len += NFC_NFCID3_MAXSIZE;
1905         nfcid3[0] = 0x1;
1906         nfcid3[1] = 0xfe;
1907         get_random_bytes(nfcid3 + 2, 6);
1908
1909         skb = pn533_alloc_skb(dev, skb_len);
1910         if (!skb)
1911                 return -ENOMEM;
1912
1913         *skb_put(skb, 1) = 0x01;  /* Active */
1914         *skb_put(skb, 1) = 0x02;  /* 424 kbps */
1915
1916         next = skb_put(skb, 1);  /* Next */
1917         *next = 0;
1918
1919         /* Copy passive data */
1920         memcpy(skb_put(skb, PASSIVE_DATA_LEN), passive_data, PASSIVE_DATA_LEN);
1921         *next |= 1;
1922
1923         /* Copy NFCID3 (which is NFCID2 from SENSF_RES) */
1924         memcpy(skb_put(skb, NFC_NFCID3_MAXSIZE), nfcid3,
1925                NFC_NFCID3_MAXSIZE);
1926         *next |= 2;
1927
1928         memcpy(skb_put(skb, dev->gb_len), dev->gb, dev->gb_len);
1929         *next |= 4; /* We have some Gi */
1930
1931         rc = pn533_send_cmd_async(dev, PN533_CMD_IN_JUMP_FOR_DEP, skb,
1932                                   pn533_poll_dep_complete, NULL);
1933
1934         if (rc < 0)
1935                 dev_kfree_skb(skb);
1936
1937         return rc;
1938 }
1939
1940 static int pn533_poll_complete(struct pn533 *dev, void *arg,
1941                                struct sk_buff *resp)
1942 {
1943         struct pn533_poll_modulations *cur_mod;
1944         int rc;
1945
1946         dev_dbg(&dev->interface->dev, "%s\n", __func__);
1947
1948         if (IS_ERR(resp)) {
1949                 rc = PTR_ERR(resp);
1950
1951                 nfc_err(&dev->interface->dev, "%s  Poll complete error %d\n",
1952                         __func__, rc);
1953
1954                 if (rc == -ENOENT) {
1955                         if (dev->poll_mod_count != 0)
1956                                 return rc;
1957                         else
1958                                 goto stop_poll;
1959                 } else if (rc < 0) {
1960                         nfc_err(&dev->interface->dev,
1961                                 "Error %d when running poll\n", rc);
1962                         goto stop_poll;
1963                 }
1964         }
1965
1966         cur_mod = dev->poll_mod_active[dev->poll_mod_curr];
1967
1968         if (cur_mod->len == 0) { /* Target mode */
1969                 del_timer(&dev->listen_timer);
1970                 rc = pn533_init_target_complete(dev, resp);
1971                 goto done;
1972         }
1973
1974         /* Initiator mode */
1975         rc = pn533_start_poll_complete(dev, resp);
1976         if (!rc)
1977                 goto done;
1978
1979         if (!dev->poll_mod_count) {
1980                 dev_dbg(&dev->interface->dev, "Polling has been stopped\n");
1981                 goto done;
1982         }
1983
1984         pn533_poll_next_mod(dev);
1985         /* Not target found, turn radio off */
1986         queue_work(dev->wq, &dev->rf_work);
1987
1988 done:
1989         dev_kfree_skb(resp);
1990         return rc;
1991
1992 stop_poll:
1993         nfc_err(&dev->interface->dev, "Polling operation has been stopped\n");
1994
1995         pn533_poll_reset_mod_list(dev);
1996         dev->poll_protocols = 0;
1997         return rc;
1998 }
1999
2000 static struct sk_buff *pn533_alloc_poll_in_frame(struct pn533 *dev,
2001                                         struct pn533_poll_modulations *mod)
2002 {
2003         struct sk_buff *skb;
2004
2005         skb = pn533_alloc_skb(dev, mod->len);
2006         if (!skb)
2007                 return NULL;
2008
2009         memcpy(skb_put(skb, mod->len), &mod->data, mod->len);
2010
2011         return skb;
2012 }
2013
2014 static int pn533_send_poll_frame(struct pn533 *dev)
2015 {
2016         struct pn533_poll_modulations *mod;
2017         struct sk_buff *skb;
2018         int rc;
2019         u8 cmd_code;
2020
2021         mod = dev->poll_mod_active[dev->poll_mod_curr];
2022
2023         dev_dbg(&dev->interface->dev, "%s mod len %d\n",
2024                 __func__, mod->len);
2025
2026         if (dev->poll_dep)  {
2027                 dev->poll_dep = 0;
2028                 return pn533_poll_dep(dev->nfc_dev);
2029         }
2030
2031         if (mod->len == 0) {  /* Listen mode */
2032                 cmd_code = PN533_CMD_TG_INIT_AS_TARGET;
2033                 skb = pn533_alloc_poll_tg_frame(dev);
2034         } else {  /* Polling mode */
2035                 cmd_code =  PN533_CMD_IN_LIST_PASSIVE_TARGET;
2036                 skb = pn533_alloc_poll_in_frame(dev, mod);
2037         }
2038
2039         if (!skb) {
2040                 nfc_err(&dev->interface->dev, "Failed to allocate skb\n");
2041                 return -ENOMEM;
2042         }
2043
2044         rc = pn533_send_cmd_async(dev, cmd_code, skb, pn533_poll_complete,
2045                                   NULL);
2046         if (rc < 0) {
2047                 dev_kfree_skb(skb);
2048                 nfc_err(&dev->interface->dev, "Polling loop error %d\n", rc);
2049         }
2050
2051         return rc;
2052 }
2053
2054 static void pn533_wq_poll(struct work_struct *work)
2055 {
2056         struct pn533 *dev = container_of(work, struct pn533, poll_work.work);
2057         struct pn533_poll_modulations *cur_mod;
2058         int rc;
2059
2060         cur_mod = dev->poll_mod_active[dev->poll_mod_curr];
2061
2062         dev_dbg(&dev->interface->dev,
2063                 "%s cancel_listen %d modulation len %d\n",
2064                 __func__, dev->cancel_listen, cur_mod->len);
2065
2066         if (dev->cancel_listen == 1) {
2067                 dev->cancel_listen = 0;
2068                 pn533_abort_cmd(dev, GFP_ATOMIC);
2069         }
2070
2071         rc = pn533_send_poll_frame(dev);
2072         if (rc)
2073                 return;
2074
2075         if (cur_mod->len == 0 && dev->poll_mod_count > 1)
2076                 mod_timer(&dev->listen_timer, jiffies + PN533_LISTEN_TIME * HZ);
2077
2078         return;
2079 }
2080
2081 static int pn533_start_poll(struct nfc_dev *nfc_dev,
2082                             u32 im_protocols, u32 tm_protocols)
2083 {
2084         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2085         struct pn533_poll_modulations *cur_mod;
2086         u8 rand_mod;
2087         int rc;
2088
2089         dev_dbg(&dev->interface->dev,
2090                 "%s: im protocols 0x%x tm protocols 0x%x\n",
2091                 __func__, im_protocols, tm_protocols);
2092
2093         if (dev->tgt_active_prot) {
2094                 nfc_err(&dev->interface->dev,
2095                         "Cannot poll with a target already activated\n");
2096                 return -EBUSY;
2097         }
2098
2099         if (dev->tgt_mode) {
2100                 nfc_err(&dev->interface->dev,
2101                         "Cannot poll while already being activated\n");
2102                 return -EBUSY;
2103         }
2104
2105         if (tm_protocols) {
2106                 dev->gb = nfc_get_local_general_bytes(nfc_dev, &dev->gb_len);
2107                 if (dev->gb == NULL)
2108                         tm_protocols = 0;
2109         }
2110
2111         pn533_poll_create_mod_list(dev, im_protocols, tm_protocols);
2112         dev->poll_protocols = im_protocols;
2113         dev->listen_protocols = tm_protocols;
2114
2115         /* Do not always start polling from the same modulation */
2116         get_random_bytes(&rand_mod, sizeof(rand_mod));
2117         rand_mod %= dev->poll_mod_count;
2118         dev->poll_mod_curr = rand_mod;
2119
2120         cur_mod = dev->poll_mod_active[dev->poll_mod_curr];
2121
2122         rc = pn533_send_poll_frame(dev);
2123
2124         /* Start listen timer */
2125         if (!rc && cur_mod->len == 0 && dev->poll_mod_count > 1)
2126                 mod_timer(&dev->listen_timer, jiffies + PN533_LISTEN_TIME * HZ);
2127
2128         return rc;
2129 }
2130
2131 static void pn533_stop_poll(struct nfc_dev *nfc_dev)
2132 {
2133         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2134
2135         del_timer(&dev->listen_timer);
2136
2137         if (!dev->poll_mod_count) {
2138                 dev_dbg(&dev->interface->dev,
2139                         "Polling operation was not running\n");
2140                 return;
2141         }
2142
2143         pn533_abort_cmd(dev, GFP_KERNEL);
2144         flush_delayed_work(&dev->poll_work);
2145         pn533_poll_reset_mod_list(dev);
2146 }
2147
2148 static int pn533_activate_target_nfcdep(struct pn533 *dev)
2149 {
2150         struct pn533_cmd_activate_response *rsp;
2151         u16 gt_len;
2152         int rc;
2153         struct sk_buff *skb;
2154         struct sk_buff *resp;
2155
2156         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2157
2158         skb = pn533_alloc_skb(dev, sizeof(u8) * 2); /*TG + Next*/
2159         if (!skb)
2160                 return -ENOMEM;
2161
2162         *skb_put(skb, sizeof(u8)) = 1; /* TG */
2163         *skb_put(skb, sizeof(u8)) = 0; /* Next */
2164
2165         resp = pn533_send_cmd_sync(dev, PN533_CMD_IN_ATR, skb);
2166         if (IS_ERR(resp))
2167                 return PTR_ERR(resp);
2168
2169         rsp = (struct pn533_cmd_activate_response *)resp->data;
2170         rc = rsp->status & PN533_CMD_RET_MASK;
2171         if (rc != PN533_CMD_RET_SUCCESS) {
2172                 nfc_err(&dev->interface->dev,
2173                         "Target activation failed (error 0x%x)\n", rc);
2174                 dev_kfree_skb(resp);
2175                 return -EIO;
2176         }
2177
2178         /* ATR_RES general bytes are located at offset 16 */
2179         gt_len = resp->len - 16;
2180         rc = nfc_set_remote_general_bytes(dev->nfc_dev, rsp->gt, gt_len);
2181
2182         dev_kfree_skb(resp);
2183         return rc;
2184 }
2185
2186 static int pn533_activate_target(struct nfc_dev *nfc_dev,
2187                                  struct nfc_target *target, u32 protocol)
2188 {
2189         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2190         int rc;
2191
2192         dev_dbg(&dev->interface->dev, "%s: protocol=%u\n", __func__, protocol);
2193
2194         if (dev->poll_mod_count) {
2195                 nfc_err(&dev->interface->dev,
2196                         "Cannot activate while polling\n");
2197                 return -EBUSY;
2198         }
2199
2200         if (dev->tgt_active_prot) {
2201                 nfc_err(&dev->interface->dev,
2202                         "There is already an active target\n");
2203                 return -EBUSY;
2204         }
2205
2206         if (!dev->tgt_available_prots) {
2207                 nfc_err(&dev->interface->dev,
2208                         "There is no available target to activate\n");
2209                 return -EINVAL;
2210         }
2211
2212         if (!(dev->tgt_available_prots & (1 << protocol))) {
2213                 nfc_err(&dev->interface->dev,
2214                         "Target doesn't support requested proto %u\n",
2215                         protocol);
2216                 return -EINVAL;
2217         }
2218
2219         if (protocol == NFC_PROTO_NFC_DEP) {
2220                 rc = pn533_activate_target_nfcdep(dev);
2221                 if (rc) {
2222                         nfc_err(&dev->interface->dev,
2223                                 "Activating target with DEP failed %d\n", rc);
2224                         return rc;
2225                 }
2226         }
2227
2228         dev->tgt_active_prot = protocol;
2229         dev->tgt_available_prots = 0;
2230
2231         return 0;
2232 }
2233
2234 static void pn533_deactivate_target(struct nfc_dev *nfc_dev,
2235                                     struct nfc_target *target)
2236 {
2237         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2238         struct sk_buff *skb;
2239         struct sk_buff *resp;
2240         int rc;
2241
2242         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2243
2244         if (!dev->tgt_active_prot) {
2245                 nfc_err(&dev->interface->dev, "There is no active target\n");
2246                 return;
2247         }
2248
2249         dev->tgt_active_prot = 0;
2250         skb_queue_purge(&dev->resp_q);
2251
2252         skb = pn533_alloc_skb(dev, sizeof(u8));
2253         if (!skb)
2254                 return;
2255
2256         *skb_put(skb, 1) = 1; /* TG*/
2257
2258         resp = pn533_send_cmd_sync(dev, PN533_CMD_IN_RELEASE, skb);
2259         if (IS_ERR(resp))
2260                 return;
2261
2262         rc = resp->data[0] & PN533_CMD_RET_MASK;
2263         if (rc != PN533_CMD_RET_SUCCESS)
2264                 nfc_err(&dev->interface->dev,
2265                         "Error 0x%x when releasing the target\n", rc);
2266
2267         dev_kfree_skb(resp);
2268         return;
2269 }
2270
2271
2272 static int pn533_in_dep_link_up_complete(struct pn533 *dev, void *arg,
2273                                          struct sk_buff *resp)
2274 {
2275         struct pn533_cmd_jump_dep_response *rsp;
2276         u8 target_gt_len;
2277         int rc;
2278         u8 active = *(u8 *)arg;
2279
2280         kfree(arg);
2281
2282         if (IS_ERR(resp))
2283                 return PTR_ERR(resp);
2284
2285         if (dev->tgt_available_prots &&
2286             !(dev->tgt_available_prots & (1 << NFC_PROTO_NFC_DEP))) {
2287                 nfc_err(&dev->interface->dev,
2288                         "The target does not support DEP\n");
2289                 rc =  -EINVAL;
2290                 goto error;
2291         }
2292
2293         rsp = (struct pn533_cmd_jump_dep_response *)resp->data;
2294
2295         rc = rsp->status & PN533_CMD_RET_MASK;
2296         if (rc != PN533_CMD_RET_SUCCESS) {
2297                 nfc_err(&dev->interface->dev,
2298                         "Bringing DEP link up failed (error 0x%x)\n", rc);
2299                 goto error;
2300         }
2301
2302         if (!dev->tgt_available_prots) {
2303                 struct nfc_target nfc_target;
2304
2305                 dev_dbg(&dev->interface->dev, "Creating new target\n");
2306
2307                 nfc_target.supported_protocols = NFC_PROTO_NFC_DEP_MASK;
2308                 nfc_target.nfcid1_len = 10;
2309                 memcpy(nfc_target.nfcid1, rsp->nfcid3t, nfc_target.nfcid1_len);
2310                 rc = nfc_targets_found(dev->nfc_dev, &nfc_target, 1);
2311                 if (rc)
2312                         goto error;
2313
2314                 dev->tgt_available_prots = 0;
2315         }
2316
2317         dev->tgt_active_prot = NFC_PROTO_NFC_DEP;
2318
2319         /* ATR_RES general bytes are located at offset 17 */
2320         target_gt_len = resp->len - 17;
2321         rc = nfc_set_remote_general_bytes(dev->nfc_dev,
2322                                           rsp->gt, target_gt_len);
2323         if (rc == 0)
2324                 rc = nfc_dep_link_is_up(dev->nfc_dev,
2325                                         dev->nfc_dev->targets[0].idx,
2326                                         !active, NFC_RF_INITIATOR);
2327
2328 error:
2329         dev_kfree_skb(resp);
2330         return rc;
2331 }
2332
2333 static int pn533_rf_field(struct nfc_dev *nfc_dev, u8 rf);
2334 static int pn533_dep_link_up(struct nfc_dev *nfc_dev, struct nfc_target *target,
2335                              u8 comm_mode, u8 *gb, size_t gb_len)
2336 {
2337         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2338         struct sk_buff *skb;
2339         int rc, skb_len;
2340         u8 *next, *arg, nfcid3[NFC_NFCID3_MAXSIZE];
2341         u8 passive_data[PASSIVE_DATA_LEN] = {0x00, 0xff, 0xff, 0x00, 0x3};
2342
2343         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2344
2345         if (dev->poll_mod_count) {
2346                 nfc_err(&dev->interface->dev,
2347                         "Cannot bring the DEP link up while polling\n");
2348                 return -EBUSY;
2349         }
2350
2351         if (dev->tgt_active_prot) {
2352                 nfc_err(&dev->interface->dev,
2353                         "There is already an active target\n");
2354                 return -EBUSY;
2355         }
2356
2357         skb_len = 3 + gb_len; /* ActPass + BR + Next */
2358         skb_len += PASSIVE_DATA_LEN;
2359
2360         /* NFCID3 */
2361         skb_len += NFC_NFCID3_MAXSIZE;
2362         if (target && !target->nfcid2_len) {
2363                 nfcid3[0] = 0x1;
2364                 nfcid3[1] = 0xfe;
2365                 get_random_bytes(nfcid3 + 2, 6);
2366         }
2367
2368         skb = pn533_alloc_skb(dev, skb_len);
2369         if (!skb)
2370                 return -ENOMEM;
2371
2372         *skb_put(skb, 1) = !comm_mode;  /* ActPass */
2373         *skb_put(skb, 1) = 0x02;  /* 424 kbps */
2374
2375         next = skb_put(skb, 1);  /* Next */
2376         *next = 0;
2377
2378         /* Copy passive data */
2379         memcpy(skb_put(skb, PASSIVE_DATA_LEN), passive_data, PASSIVE_DATA_LEN);
2380         *next |= 1;
2381
2382         /* Copy NFCID3 (which is NFCID2 from SENSF_RES) */
2383         if (target && target->nfcid2_len)
2384                 memcpy(skb_put(skb, NFC_NFCID3_MAXSIZE), target->nfcid2,
2385                        target->nfcid2_len);
2386         else
2387                 memcpy(skb_put(skb, NFC_NFCID3_MAXSIZE), nfcid3,
2388                        NFC_NFCID3_MAXSIZE);
2389         *next |= 2;
2390
2391         if (gb != NULL && gb_len > 0) {
2392                 memcpy(skb_put(skb, gb_len), gb, gb_len);
2393                 *next |= 4; /* We have some Gi */
2394         } else {
2395                 *next = 0;
2396         }
2397
2398         arg = kmalloc(sizeof(*arg), GFP_KERNEL);
2399         if (!arg) {
2400                 dev_kfree_skb(skb);
2401                 return -ENOMEM;
2402         }
2403
2404         *arg = !comm_mode;
2405
2406         pn533_rf_field(dev->nfc_dev, 0);
2407
2408         rc = pn533_send_cmd_async(dev, PN533_CMD_IN_JUMP_FOR_DEP, skb,
2409                                   pn533_in_dep_link_up_complete, arg);
2410
2411         if (rc < 0) {
2412                 dev_kfree_skb(skb);
2413                 kfree(arg);
2414         }
2415
2416         return rc;
2417 }
2418
2419 static int pn533_dep_link_down(struct nfc_dev *nfc_dev)
2420 {
2421         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2422
2423         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2424
2425         pn533_poll_reset_mod_list(dev);
2426
2427         if (dev->tgt_mode || dev->tgt_active_prot)
2428                 pn533_abort_cmd(dev, GFP_KERNEL);
2429
2430         dev->tgt_active_prot = 0;
2431         dev->tgt_mode = 0;
2432
2433         skb_queue_purge(&dev->resp_q);
2434
2435         return 0;
2436 }
2437
2438 struct pn533_data_exchange_arg {
2439         data_exchange_cb_t cb;
2440         void *cb_context;
2441 };
2442
2443 static struct sk_buff *pn533_build_response(struct pn533 *dev)
2444 {
2445         struct sk_buff *skb, *tmp, *t;
2446         unsigned int skb_len = 0, tmp_len = 0;
2447
2448         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2449
2450         if (skb_queue_empty(&dev->resp_q))
2451                 return NULL;
2452
2453         if (skb_queue_len(&dev->resp_q) == 1) {
2454                 skb = skb_dequeue(&dev->resp_q);
2455                 goto out;
2456         }
2457
2458         skb_queue_walk_safe(&dev->resp_q, tmp, t)
2459                 skb_len += tmp->len;
2460
2461         dev_dbg(&dev->interface->dev, "%s total length %d\n",
2462                 __func__, skb_len);
2463
2464         skb = alloc_skb(skb_len, GFP_KERNEL);
2465         if (skb == NULL)
2466                 goto out;
2467
2468         skb_put(skb, skb_len);
2469
2470         skb_queue_walk_safe(&dev->resp_q, tmp, t) {
2471                 memcpy(skb->data + tmp_len, tmp->data, tmp->len);
2472                 tmp_len += tmp->len;
2473         }
2474
2475 out:
2476         skb_queue_purge(&dev->resp_q);
2477
2478         return skb;
2479 }
2480
2481 static int pn533_data_exchange_complete(struct pn533 *dev, void *_arg,
2482                                         struct sk_buff *resp)
2483 {
2484         struct pn533_data_exchange_arg *arg = _arg;
2485         struct sk_buff *skb;
2486         int rc = 0;
2487         u8 status, ret, mi;
2488
2489         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2490
2491         if (IS_ERR(resp)) {
2492                 rc = PTR_ERR(resp);
2493                 goto _error;
2494         }
2495
2496         status = resp->data[0];
2497         ret = status & PN533_CMD_RET_MASK;
2498         mi = status & PN533_CMD_MI_MASK;
2499
2500         skb_pull(resp, sizeof(status));
2501
2502         if (ret != PN533_CMD_RET_SUCCESS) {
2503                 nfc_err(&dev->interface->dev,
2504                         "Exchanging data failed (error 0x%x)\n", ret);
2505                 rc = -EIO;
2506                 goto error;
2507         }
2508
2509         skb_queue_tail(&dev->resp_q, resp);
2510
2511         if (mi) {
2512                 dev->cmd_complete_mi_arg = arg;
2513                 queue_work(dev->wq, &dev->mi_rx_work);
2514                 return -EINPROGRESS;
2515         }
2516
2517         /* Prepare for the next round */
2518         if (skb_queue_len(&dev->fragment_skb) > 0) {
2519                 dev->cmd_complete_dep_arg = arg;
2520                 queue_work(dev->wq, &dev->mi_tx_work);
2521
2522                 return -EINPROGRESS;
2523         }
2524
2525         skb = pn533_build_response(dev);
2526         if (!skb)
2527                 goto error;
2528
2529         arg->cb(arg->cb_context, skb, 0);
2530         kfree(arg);
2531         return 0;
2532
2533 error:
2534         dev_kfree_skb(resp);
2535 _error:
2536         skb_queue_purge(&dev->resp_q);
2537         arg->cb(arg->cb_context, NULL, rc);
2538         kfree(arg);
2539         return rc;
2540 }
2541
2542 /* Split the Tx skb into small chunks */
2543 static int pn533_fill_fragment_skbs(struct pn533 *dev, struct sk_buff *skb)
2544 {
2545         struct sk_buff *frag;
2546         int  frag_size;
2547
2548         do {
2549                 /* Remaining size */
2550                 if (skb->len > PN533_CMD_DATAFRAME_MAXLEN)
2551                         frag_size = PN533_CMD_DATAFRAME_MAXLEN;
2552                 else
2553                         frag_size = skb->len;
2554
2555                 /* Allocate and reserve */
2556                 frag = pn533_alloc_skb(dev, frag_size);
2557                 if (!frag) {
2558                         skb_queue_purge(&dev->fragment_skb);
2559                         break;
2560                 }
2561
2562                 if (!dev->tgt_mode) {
2563                         /* Reserve the TG/MI byte */
2564                         skb_reserve(frag, 1);
2565
2566                         /* MI + TG */
2567                         if (frag_size  == PN533_CMD_DATAFRAME_MAXLEN)
2568                                 *skb_push(frag, sizeof(u8)) =
2569                                                         (PN533_CMD_MI_MASK | 1);
2570                         else
2571                                 *skb_push(frag, sizeof(u8)) =  1; /* TG */
2572                 }
2573
2574                 memcpy(skb_put(frag, frag_size), skb->data, frag_size);
2575
2576                 /* Reduce the size of incoming buffer */
2577                 skb_pull(skb, frag_size);
2578
2579                 /* Add this to skb_queue */
2580                 skb_queue_tail(&dev->fragment_skb, frag);
2581
2582         } while (skb->len > 0);
2583
2584         dev_kfree_skb(skb);
2585
2586         return skb_queue_len(&dev->fragment_skb);
2587 }
2588
2589 static int pn533_transceive(struct nfc_dev *nfc_dev,
2590                             struct nfc_target *target, struct sk_buff *skb,
2591                             data_exchange_cb_t cb, void *cb_context)
2592 {
2593         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2594         struct pn533_data_exchange_arg *arg = NULL;
2595         int rc;
2596
2597         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2598
2599         if (!dev->tgt_active_prot) {
2600                 nfc_err(&dev->interface->dev,
2601                         "Can't exchange data if there is no active target\n");
2602                 rc = -EINVAL;
2603                 goto error;
2604         }
2605
2606         arg = kmalloc(sizeof(*arg), GFP_KERNEL);
2607         if (!arg) {
2608                 rc = -ENOMEM;
2609                 goto error;
2610         }
2611
2612         arg->cb = cb;
2613         arg->cb_context = cb_context;
2614
2615         switch (dev->device_type) {
2616         case PN533_DEVICE_PASORI:
2617                 if (dev->tgt_active_prot == NFC_PROTO_FELICA) {
2618                         rc = pn533_send_data_async(dev, PN533_CMD_IN_COMM_THRU,
2619                                                    skb,
2620                                                    pn533_data_exchange_complete,
2621                                                    arg);
2622
2623                         break;
2624                 }
2625         default:
2626                 /* jumbo frame ? */
2627                 if (skb->len > PN533_CMD_DATAEXCH_DATA_MAXLEN) {
2628                         rc = pn533_fill_fragment_skbs(dev, skb);
2629                         if (rc <= 0)
2630                                 goto error;
2631
2632                         skb = skb_dequeue(&dev->fragment_skb);
2633                         if (!skb) {
2634                                 rc = -EIO;
2635                                 goto error;
2636                         }
2637                 } else {
2638                         *skb_push(skb, sizeof(u8)) =  1; /* TG */
2639                 }
2640
2641                 rc = pn533_send_data_async(dev, PN533_CMD_IN_DATA_EXCHANGE,
2642                                            skb, pn533_data_exchange_complete,
2643                                            arg);
2644
2645                 break;
2646         }
2647
2648         if (rc < 0) /* rc from send_async */
2649                 goto error;
2650
2651         return 0;
2652
2653 error:
2654         kfree(arg);
2655         dev_kfree_skb(skb);
2656         return rc;
2657 }
2658
2659 static int pn533_tm_send_complete(struct pn533 *dev, void *arg,
2660                                   struct sk_buff *resp)
2661 {
2662         u8 status;
2663
2664         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2665
2666         if (IS_ERR(resp))
2667                 return PTR_ERR(resp);
2668
2669         status = resp->data[0];
2670
2671         dev_kfree_skb(resp);
2672
2673         if (status != 0) {
2674                 nfc_tm_deactivated(dev->nfc_dev);
2675
2676                 dev->tgt_mode = 0;
2677
2678                 return 0;
2679         }
2680
2681         queue_work(dev->wq, &dev->tg_work);
2682
2683         return 0;
2684 }
2685
2686 static int pn533_tm_send(struct nfc_dev *nfc_dev, struct sk_buff *skb)
2687 {
2688         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2689         int rc;
2690
2691         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2692
2693         if (skb->len > PN533_CMD_DATAEXCH_DATA_MAXLEN) {
2694                 nfc_err(&dev->interface->dev,
2695                         "Data length greater than the max allowed: %d\n",
2696                         PN533_CMD_DATAEXCH_DATA_MAXLEN);
2697                 return -ENOSYS;
2698         }
2699
2700         rc = pn533_send_data_async(dev, PN533_CMD_TG_SET_DATA, skb,
2701                                    pn533_tm_send_complete, NULL);
2702         if (rc < 0)
2703                 dev_kfree_skb(skb);
2704
2705         return rc;
2706 }
2707
2708 static void pn533_wq_mi_recv(struct work_struct *work)
2709 {
2710         struct pn533 *dev = container_of(work, struct pn533, mi_rx_work);
2711         struct sk_buff *skb;
2712         int rc;
2713
2714         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2715
2716         skb = pn533_alloc_skb(dev, PN533_CMD_DATAEXCH_HEAD_LEN);
2717         if (!skb)
2718                 goto error;
2719
2720         switch (dev->device_type) {
2721         case PN533_DEVICE_PASORI:
2722                 if (dev->tgt_active_prot == NFC_PROTO_FELICA) {
2723                         rc = pn533_send_cmd_direct_async(dev,
2724                                                 PN533_CMD_IN_COMM_THRU,
2725                                                 skb,
2726                                                 pn533_data_exchange_complete,
2727                                                  dev->cmd_complete_mi_arg);
2728
2729                         break;
2730                 }
2731         default:
2732                 *skb_put(skb, sizeof(u8)) =  1; /*TG*/
2733
2734                 rc = pn533_send_cmd_direct_async(dev,
2735                                                  PN533_CMD_IN_DATA_EXCHANGE,
2736                                                  skb,
2737                                                  pn533_data_exchange_complete,
2738                                                  dev->cmd_complete_mi_arg);
2739
2740                 break;
2741         }
2742
2743         if (rc == 0) /* success */
2744                 return;
2745
2746         nfc_err(&dev->interface->dev,
2747                 "Error %d when trying to perform data_exchange\n", rc);
2748
2749         dev_kfree_skb(skb);
2750         kfree(dev->cmd_complete_mi_arg);
2751
2752 error:
2753         pn533_send_ack(dev, GFP_KERNEL);
2754         queue_work(dev->wq, &dev->cmd_work);
2755 }
2756
2757 static void pn533_wq_mi_send(struct work_struct *work)
2758 {
2759         struct pn533 *dev = container_of(work, struct pn533, mi_tx_work);
2760         struct sk_buff *skb;
2761         int rc;
2762
2763         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2764
2765         /* Grab the first skb in the queue */
2766         skb = skb_dequeue(&dev->fragment_skb);
2767
2768         if (skb == NULL) {      /* No more data */
2769                 /* Reset the queue for future use */
2770                 skb_queue_head_init(&dev->fragment_skb);
2771                 goto error;
2772         }
2773
2774         switch (dev->device_type) {
2775         case PN533_DEVICE_PASORI:
2776                 if (dev->tgt_active_prot != NFC_PROTO_FELICA) {
2777                         rc = -EIO;
2778                         break;
2779                 }
2780
2781                 rc = pn533_send_cmd_direct_async(dev, PN533_CMD_IN_COMM_THRU,
2782                                                  skb,
2783                                                  pn533_data_exchange_complete,
2784                                                  dev->cmd_complete_dep_arg);
2785
2786                 break;
2787
2788         default:
2789                 /* Still some fragments? */
2790                 rc = pn533_send_cmd_direct_async(dev,PN533_CMD_IN_DATA_EXCHANGE,
2791                                                  skb,
2792                                                  pn533_data_exchange_complete,
2793                                                  dev->cmd_complete_dep_arg);
2794
2795                 break;
2796         }
2797
2798         if (rc == 0) /* success */
2799                 return;
2800
2801         nfc_err(&dev->interface->dev,
2802                 "Error %d when trying to perform data_exchange\n", rc);
2803
2804         dev_kfree_skb(skb);
2805         kfree(dev->cmd_complete_dep_arg);
2806
2807 error:
2808         pn533_send_ack(dev, GFP_KERNEL);
2809         queue_work(dev->wq, &dev->cmd_work);
2810 }
2811
2812 static int pn533_set_configuration(struct pn533 *dev, u8 cfgitem, u8 *cfgdata,
2813                                                                 u8 cfgdata_len)
2814 {
2815         struct sk_buff *skb;
2816         struct sk_buff *resp;
2817         int skb_len;
2818
2819         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2820
2821         skb_len = sizeof(cfgitem) + cfgdata_len; /* cfgitem + cfgdata */
2822
2823         skb = pn533_alloc_skb(dev, skb_len);
2824         if (!skb)
2825                 return -ENOMEM;
2826
2827         *skb_put(skb, sizeof(cfgitem)) = cfgitem;
2828         memcpy(skb_put(skb, cfgdata_len), cfgdata, cfgdata_len);
2829
2830         resp = pn533_send_cmd_sync(dev, PN533_CMD_RF_CONFIGURATION, skb);
2831         if (IS_ERR(resp))
2832                 return PTR_ERR(resp);
2833
2834         dev_kfree_skb(resp);
2835         return 0;
2836 }
2837
2838 static int pn533_get_firmware_version(struct pn533 *dev,
2839                                       struct pn533_fw_version *fv)
2840 {
2841         struct sk_buff *skb;
2842         struct sk_buff *resp;
2843
2844         skb = pn533_alloc_skb(dev, 0);
2845         if (!skb)
2846                 return -ENOMEM;
2847
2848         resp = pn533_send_cmd_sync(dev, PN533_CMD_GET_FIRMWARE_VERSION, skb);
2849         if (IS_ERR(resp))
2850                 return PTR_ERR(resp);
2851
2852         fv->ic = resp->data[0];
2853         fv->ver = resp->data[1];
2854         fv->rev = resp->data[2];
2855         fv->support = resp->data[3];
2856
2857         dev_kfree_skb(resp);
2858         return 0;
2859 }
2860
2861 static int pn533_pasori_fw_reset(struct pn533 *dev)
2862 {
2863         struct sk_buff *skb;
2864         struct sk_buff *resp;
2865
2866         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2867
2868         skb = pn533_alloc_skb(dev, sizeof(u8));
2869         if (!skb)
2870                 return -ENOMEM;
2871
2872         *skb_put(skb, sizeof(u8)) = 0x1;
2873
2874         resp = pn533_send_cmd_sync(dev, 0x18, skb);
2875         if (IS_ERR(resp))
2876                 return PTR_ERR(resp);
2877
2878         dev_kfree_skb(resp);
2879
2880         return 0;
2881 }
2882
2883 struct pn533_acr122_poweron_rdr_arg {
2884         int rc;
2885         struct completion done;
2886 };
2887
2888 static void pn533_acr122_poweron_rdr_resp(struct urb *urb)
2889 {
2890         struct pn533_acr122_poweron_rdr_arg *arg = urb->context;
2891
2892         dev_dbg(&urb->dev->dev, "%s\n", __func__);
2893
2894         print_hex_dump_debug("ACR122 RX: ", DUMP_PREFIX_NONE, 16, 1,
2895                        urb->transfer_buffer, urb->transfer_buffer_length,
2896                        false);
2897
2898         arg->rc = urb->status;
2899         complete(&arg->done);
2900 }
2901
2902 static int pn533_acr122_poweron_rdr(struct pn533 *dev)
2903 {
2904         /* Power on th reader (CCID cmd) */
2905         u8 cmd[10] = {PN533_ACR122_PC_TO_RDR_ICCPOWERON,
2906                       0, 0, 0, 0, 0, 0, 3, 0, 0};
2907         u8 buf[255];
2908         int rc;
2909         void *cntx;
2910         struct pn533_acr122_poweron_rdr_arg arg;
2911
2912         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2913
2914         init_completion(&arg.done);
2915         cntx = dev->in_urb->context;  /* backup context */
2916
2917         dev->in_urb->transfer_buffer = buf;
2918         dev->in_urb->transfer_buffer_length = 255;
2919         dev->in_urb->complete = pn533_acr122_poweron_rdr_resp;
2920         dev->in_urb->context = &arg;
2921
2922         dev->out_urb->transfer_buffer = cmd;
2923         dev->out_urb->transfer_buffer_length = sizeof(cmd);
2924
2925         print_hex_dump_debug("ACR122 TX: ", DUMP_PREFIX_NONE, 16, 1,
2926                        cmd, sizeof(cmd), false);
2927
2928         rc = usb_submit_urb(dev->out_urb, GFP_KERNEL);
2929         if (rc) {
2930                 nfc_err(&dev->interface->dev,
2931                         "Reader power on cmd error %d\n", rc);
2932                 return rc;
2933         }
2934
2935         rc =  usb_submit_urb(dev->in_urb, GFP_KERNEL);
2936         if (rc) {
2937                 nfc_err(&dev->interface->dev,
2938                         "Can't submit reader poweron cmd response %d\n", rc);
2939                 return rc;
2940         }
2941
2942         wait_for_completion(&arg.done);
2943         dev->in_urb->context = cntx; /* restore context */
2944
2945         return arg.rc;
2946 }
2947
2948 static int pn533_rf_field(struct nfc_dev *nfc_dev, u8 rf)
2949 {
2950         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2951         u8 rf_field = !!rf;
2952         int rc;
2953
2954         rf_field |= PN533_CFGITEM_RF_FIELD_AUTO_RFCA;
2955
2956         rc = pn533_set_configuration(dev, PN533_CFGITEM_RF_FIELD,
2957                                      (u8 *)&rf_field, 1);
2958         if (rc) {
2959                 nfc_err(&dev->interface->dev, "Error on setting RF field\n");
2960                 return rc;
2961         }
2962
2963         return rc;
2964 }
2965
2966 static int pn533_dev_up(struct nfc_dev *nfc_dev)
2967 {
2968         return pn533_rf_field(nfc_dev, 1);
2969 }
2970
2971 static int pn533_dev_down(struct nfc_dev *nfc_dev)
2972 {
2973         return pn533_rf_field(nfc_dev, 0);
2974 }
2975
2976 static struct nfc_ops pn533_nfc_ops = {
2977         .dev_up = pn533_dev_up,
2978         .dev_down = pn533_dev_down,
2979         .dep_link_up = pn533_dep_link_up,
2980         .dep_link_down = pn533_dep_link_down,
2981         .start_poll = pn533_start_poll,
2982         .stop_poll = pn533_stop_poll,
2983         .activate_target = pn533_activate_target,
2984         .deactivate_target = pn533_deactivate_target,
2985         .im_transceive = pn533_transceive,
2986         .tm_send = pn533_tm_send,
2987 };
2988
2989 static int pn533_setup(struct pn533 *dev)
2990 {
2991         struct pn533_config_max_retries max_retries;
2992         struct pn533_config_timing timing;
2993         u8 pasori_cfg[3] = {0x08, 0x01, 0x08};
2994         int rc;
2995
2996         switch (dev->device_type) {
2997         case PN533_DEVICE_STD:
2998         case PN533_DEVICE_PASORI:
2999         case PN533_DEVICE_ACR122U:
3000                 max_retries.mx_rty_atr = 0x2;
3001                 max_retries.mx_rty_psl = 0x1;
3002                 max_retries.mx_rty_passive_act =
3003                         PN533_CONFIG_MAX_RETRIES_NO_RETRY;
3004
3005                 timing.rfu = PN533_CONFIG_TIMING_102;
3006                 timing.atr_res_timeout = PN533_CONFIG_TIMING_102;
3007                 timing.dep_timeout = PN533_CONFIG_TIMING_204;
3008
3009                 break;
3010
3011         default:
3012                 nfc_err(&dev->interface->dev, "Unknown device type %d\n",
3013                         dev->device_type);
3014                 return -EINVAL;
3015         }
3016
3017         rc = pn533_set_configuration(dev, PN533_CFGITEM_MAX_RETRIES,
3018                                      (u8 *)&max_retries, sizeof(max_retries));
3019         if (rc) {
3020                 nfc_err(&dev->interface->dev,
3021                         "Error on setting MAX_RETRIES config\n");
3022                 return rc;
3023         }
3024
3025
3026         rc = pn533_set_configuration(dev, PN533_CFGITEM_TIMING,
3027                                      (u8 *)&timing, sizeof(timing));
3028         if (rc) {
3029                 nfc_err(&dev->interface->dev, "Error on setting RF timings\n");
3030                 return rc;
3031         }
3032
3033         switch (dev->device_type) {
3034         case PN533_DEVICE_STD:
3035                 break;
3036
3037         case PN533_DEVICE_PASORI:
3038                 pn533_pasori_fw_reset(dev);
3039
3040                 rc = pn533_set_configuration(dev, PN533_CFGITEM_PASORI,
3041                                              pasori_cfg, 3);
3042                 if (rc) {
3043                         nfc_err(&dev->interface->dev,
3044                                 "Error while settings PASORI config\n");
3045                         return rc;
3046                 }
3047
3048                 pn533_pasori_fw_reset(dev);
3049
3050                 break;
3051         }
3052
3053         return 0;
3054 }
3055
3056 static int pn533_probe(struct usb_interface *interface,
3057                         const struct usb_device_id *id)
3058 {
3059         struct pn533_fw_version fw_ver;
3060         struct pn533 *dev;
3061         struct usb_host_interface *iface_desc;
3062         struct usb_endpoint_descriptor *endpoint;
3063         int in_endpoint = 0;
3064         int out_endpoint = 0;
3065         int rc = -ENOMEM;
3066         int i;
3067         u32 protocols;
3068
3069         dev = kzalloc(sizeof(*dev), GFP_KERNEL);
3070         if (!dev)
3071                 return -ENOMEM;
3072
3073         dev->udev = usb_get_dev(interface_to_usbdev(interface));
3074         dev->interface = interface;
3075         mutex_init(&dev->cmd_lock);
3076
3077         iface_desc = interface->cur_altsetting;
3078         for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
3079                 endpoint = &iface_desc->endpoint[i].desc;
3080
3081                 if (!in_endpoint && usb_endpoint_is_bulk_in(endpoint))
3082                         in_endpoint = endpoint->bEndpointAddress;
3083
3084                 if (!out_endpoint && usb_endpoint_is_bulk_out(endpoint))
3085                         out_endpoint = endpoint->bEndpointAddress;
3086         }
3087
3088         if (!in_endpoint || !out_endpoint) {
3089                 nfc_err(&interface->dev,
3090                         "Could not find bulk-in or bulk-out endpoint\n");
3091                 rc = -ENODEV;
3092                 goto error;
3093         }
3094
3095         dev->in_urb = usb_alloc_urb(0, GFP_KERNEL);
3096         dev->out_urb = usb_alloc_urb(0, GFP_KERNEL);
3097
3098         if (!dev->in_urb || !dev->out_urb)
3099                 goto error;
3100
3101         usb_fill_bulk_urb(dev->in_urb, dev->udev,
3102                           usb_rcvbulkpipe(dev->udev, in_endpoint),
3103                           NULL, 0, NULL, dev);
3104         usb_fill_bulk_urb(dev->out_urb, dev->udev,
3105                           usb_sndbulkpipe(dev->udev, out_endpoint),
3106                           NULL, 0, pn533_send_complete, dev);
3107
3108         INIT_WORK(&dev->cmd_work, pn533_wq_cmd);
3109         INIT_WORK(&dev->cmd_complete_work, pn533_wq_cmd_complete);
3110         INIT_WORK(&dev->mi_rx_work, pn533_wq_mi_recv);
3111         INIT_WORK(&dev->mi_tx_work, pn533_wq_mi_send);
3112         INIT_WORK(&dev->tg_work, pn533_wq_tg_get_data);
3113         INIT_WORK(&dev->mi_tm_rx_work, pn533_wq_tm_mi_recv);
3114         INIT_DELAYED_WORK(&dev->poll_work, pn533_wq_poll);
3115         INIT_WORK(&dev->rf_work, pn533_wq_rf);
3116         dev->wq = alloc_ordered_workqueue("pn533", 0);
3117         if (dev->wq == NULL)
3118                 goto error;
3119
3120         init_timer(&dev->listen_timer);
3121         dev->listen_timer.data = (unsigned long) dev;
3122         dev->listen_timer.function = pn533_listen_mode_timer;
3123
3124         skb_queue_head_init(&dev->resp_q);
3125         skb_queue_head_init(&dev->fragment_skb);
3126
3127         INIT_LIST_HEAD(&dev->cmd_queue);
3128
3129         usb_set_intfdata(interface, dev);
3130
3131         dev->ops = &pn533_std_frame_ops;
3132
3133         dev->protocol_type = PN533_PROTO_REQ_ACK_RESP;
3134         dev->device_type = id->driver_info;
3135         switch (dev->device_type) {
3136         case PN533_DEVICE_STD:
3137                 protocols = PN533_ALL_PROTOCOLS;
3138                 break;
3139
3140         case PN533_DEVICE_PASORI:
3141                 protocols = PN533_NO_TYPE_B_PROTOCOLS;
3142                 break;
3143
3144         case PN533_DEVICE_ACR122U:
3145                 protocols = PN533_NO_TYPE_B_PROTOCOLS;
3146                 dev->ops = &pn533_acr122_frame_ops;
3147                 dev->protocol_type = PN533_PROTO_REQ_RESP,
3148
3149                 rc = pn533_acr122_poweron_rdr(dev);
3150                 if (rc < 0) {
3151                         nfc_err(&dev->interface->dev,
3152                                 "Couldn't poweron the reader (error %d)\n", rc);
3153                         goto destroy_wq;
3154                 }
3155                 break;
3156
3157         default:
3158                 nfc_err(&dev->interface->dev, "Unknown device type %d\n",
3159                         dev->device_type);
3160                 rc = -EINVAL;
3161                 goto destroy_wq;
3162         }
3163
3164         memset(&fw_ver, 0, sizeof(fw_ver));
3165         rc = pn533_get_firmware_version(dev, &fw_ver);
3166         if (rc < 0)
3167                 goto destroy_wq;
3168
3169         nfc_info(&dev->interface->dev,
3170                  "NXP PN5%02X firmware ver %d.%d now attached\n",
3171                  fw_ver.ic, fw_ver.ver, fw_ver.rev);
3172
3173
3174         dev->nfc_dev = nfc_allocate_device(&pn533_nfc_ops, protocols,
3175                                            dev->ops->tx_header_len +
3176                                            PN533_CMD_DATAEXCH_HEAD_LEN,
3177                                            dev->ops->tx_tail_len);
3178         if (!dev->nfc_dev) {
3179                 rc = -ENOMEM;
3180                 goto destroy_wq;
3181         }
3182
3183         nfc_set_parent_dev(dev->nfc_dev, &interface->dev);
3184         nfc_set_drvdata(dev->nfc_dev, dev);
3185
3186         rc = nfc_register_device(dev->nfc_dev);
3187         if (rc)
3188                 goto free_nfc_dev;
3189
3190         rc = pn533_setup(dev);
3191         if (rc)
3192                 goto unregister_nfc_dev;
3193
3194         return 0;
3195
3196 unregister_nfc_dev:
3197         nfc_unregister_device(dev->nfc_dev);
3198
3199 free_nfc_dev:
3200         nfc_free_device(dev->nfc_dev);
3201
3202 destroy_wq:
3203         destroy_workqueue(dev->wq);
3204 error:
3205         usb_free_urb(dev->in_urb);
3206         usb_free_urb(dev->out_urb);
3207         usb_put_dev(dev->udev);
3208         kfree(dev);
3209         return rc;
3210 }
3211
3212 static void pn533_disconnect(struct usb_interface *interface)
3213 {
3214         struct pn533 *dev;
3215         struct pn533_cmd *cmd, *n;
3216
3217         dev = usb_get_intfdata(interface);
3218         usb_set_intfdata(interface, NULL);
3219
3220         nfc_unregister_device(dev->nfc_dev);
3221         nfc_free_device(dev->nfc_dev);
3222
3223         usb_kill_urb(dev->in_urb);
3224         usb_kill_urb(dev->out_urb);
3225
3226         flush_delayed_work(&dev->poll_work);
3227         destroy_workqueue(dev->wq);
3228
3229         skb_queue_purge(&dev->resp_q);
3230
3231         del_timer(&dev->listen_timer);
3232
3233         list_for_each_entry_safe(cmd, n, &dev->cmd_queue, queue) {
3234                 list_del(&cmd->queue);
3235                 kfree(cmd);
3236         }
3237
3238         usb_free_urb(dev->in_urb);
3239         usb_free_urb(dev->out_urb);
3240         kfree(dev);
3241
3242         nfc_info(&interface->dev, "NXP PN533 NFC device disconnected\n");
3243 }
3244
3245 static struct usb_driver pn533_driver = {
3246         .name =         "pn533",
3247         .probe =        pn533_probe,
3248         .disconnect =   pn533_disconnect,
3249         .id_table =     pn533_table,
3250 };
3251
3252 module_usb_driver(pn533_driver);
3253
3254 MODULE_AUTHOR("Lauro Ramos Venancio <lauro.venancio@openbossa.org>");
3255 MODULE_AUTHOR("Aloisio Almeida Jr <aloisio.almeida@openbossa.org>");
3256 MODULE_AUTHOR("Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>");
3257 MODULE_DESCRIPTION("PN533 usb driver ver " VERSION);
3258 MODULE_VERSION(VERSION);
3259 MODULE_LICENSE("GPL");