2 * Copyright (C) 2011 Instituto Nokia de Tecnologia
3 * Copyright (C) 2012-2013 Tieto Poland
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License as published by
7 * the Free Software Foundation; either version 2 of the License, or
8 * (at your option) any later version.
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
15 * You should have received a copy of the GNU General Public License
16 * along with this program; if not, write to the
17 * Free Software Foundation, Inc.,
18 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
21 #include <linux/device.h>
22 #include <linux/kernel.h>
23 #include <linux/module.h>
24 #include <linux/slab.h>
25 #include <linux/usb.h>
26 #include <linux/nfc.h>
27 #include <linux/netdevice.h>
28 #include <net/nfc/nfc.h>
32 #define PN533_VENDOR_ID 0x4CC
33 #define PN533_PRODUCT_ID 0x2533
35 #define SCM_VENDOR_ID 0x4E6
36 #define SCL3711_PRODUCT_ID 0x5591
38 #define SONY_VENDOR_ID 0x054c
39 #define PASORI_PRODUCT_ID 0x02e1
41 #define ACS_VENDOR_ID 0x072f
42 #define ACR122U_PRODUCT_ID 0x2200
44 #define PN533_DEVICE_STD 0x1
45 #define PN533_DEVICE_PASORI 0x2
46 #define PN533_DEVICE_ACR122U 0x3
48 #define PN533_ALL_PROTOCOLS (NFC_PROTO_JEWEL_MASK | NFC_PROTO_MIFARE_MASK |\
49 NFC_PROTO_FELICA_MASK | NFC_PROTO_ISO14443_MASK |\
50 NFC_PROTO_NFC_DEP_MASK |\
51 NFC_PROTO_ISO14443_B_MASK)
53 #define PN533_NO_TYPE_B_PROTOCOLS (NFC_PROTO_JEWEL_MASK | \
54 NFC_PROTO_MIFARE_MASK | \
55 NFC_PROTO_FELICA_MASK | \
56 NFC_PROTO_ISO14443_MASK | \
57 NFC_PROTO_NFC_DEP_MASK)
59 static const struct usb_device_id pn533_table[] = {
60 { .match_flags = USB_DEVICE_ID_MATCH_DEVICE,
61 .idVendor = PN533_VENDOR_ID,
62 .idProduct = PN533_PRODUCT_ID,
63 .driver_info = PN533_DEVICE_STD,
65 { .match_flags = USB_DEVICE_ID_MATCH_DEVICE,
66 .idVendor = SCM_VENDOR_ID,
67 .idProduct = SCL3711_PRODUCT_ID,
68 .driver_info = PN533_DEVICE_STD,
70 { .match_flags = USB_DEVICE_ID_MATCH_DEVICE,
71 .idVendor = SONY_VENDOR_ID,
72 .idProduct = PASORI_PRODUCT_ID,
73 .driver_info = PN533_DEVICE_PASORI,
75 { .match_flags = USB_DEVICE_ID_MATCH_DEVICE,
76 .idVendor = ACS_VENDOR_ID,
77 .idProduct = ACR122U_PRODUCT_ID,
78 .driver_info = PN533_DEVICE_ACR122U,
82 MODULE_DEVICE_TABLE(usb, pn533_table);
84 /* How much time we spend listening for initiators */
85 #define PN533_LISTEN_TIME 2
86 /* Delay between each poll frame (ms) */
87 #define PN533_POLL_INTERVAL 10
89 /* Standard pn533 frame definitions (standard and extended)*/
90 #define PN533_STD_FRAME_HEADER_LEN (sizeof(struct pn533_std_frame) \
91 + 2) /* data[0] TFI, data[1] CC */
92 #define PN533_STD_FRAME_TAIL_LEN 2 /* data[len] DCS, data[len + 1] postamble*/
94 #define PN533_EXT_FRAME_HEADER_LEN (sizeof(struct pn533_ext_frame) \
95 + 2) /* data[0] TFI, data[1] CC */
97 #define PN533_CMD_DATAEXCH_DATA_MAXLEN 262
98 #define PN533_CMD_DATAFRAME_MAXLEN 240 /* max data length (send) */
101 * Max extended frame payload len, excluding TFI and CC
102 * which are already in PN533_FRAME_HEADER_LEN.
104 #define PN533_STD_FRAME_MAX_PAYLOAD_LEN 263
106 #define PN533_STD_FRAME_ACK_SIZE 6 /* Preamble (1), SoPC (2), ACK Code (2),
108 #define PN533_STD_FRAME_CHECKSUM(f) (f->data[f->datalen])
109 #define PN533_STD_FRAME_POSTAMBLE(f) (f->data[f->datalen + 1])
110 /* Half start code (3), LEN (4) should be 0xffff for extended frame */
111 #define PN533_STD_IS_EXTENDED(hdr) ((hdr)->datalen == 0xFF \
112 && (hdr)->datalen_checksum == 0xFF)
113 #define PN533_EXT_FRAME_CHECKSUM(f) (f->data[be16_to_cpu(f->datalen)])
116 #define PN533_STD_FRAME_SOF 0x00FF
118 /* standard frame identifier: in/out/error */
119 #define PN533_STD_FRAME_IDENTIFIER(f) (f->data[0]) /* TFI */
120 #define PN533_STD_FRAME_DIR_OUT 0xD4
121 #define PN533_STD_FRAME_DIR_IN 0xD5
123 /* ACS ACR122 pn533 frame definitions */
124 #define PN533_ACR122_TX_FRAME_HEADER_LEN (sizeof(struct pn533_acr122_tx_frame) \
126 #define PN533_ACR122_TX_FRAME_TAIL_LEN 0
127 #define PN533_ACR122_RX_FRAME_HEADER_LEN (sizeof(struct pn533_acr122_rx_frame) \
129 #define PN533_ACR122_RX_FRAME_TAIL_LEN 2
130 #define PN533_ACR122_FRAME_MAX_PAYLOAD_LEN PN533_STD_FRAME_MAX_PAYLOAD_LEN
132 /* CCID messages types */
133 #define PN533_ACR122_PC_TO_RDR_ICCPOWERON 0x62
134 #define PN533_ACR122_PC_TO_RDR_ESCAPE 0x6B
136 #define PN533_ACR122_RDR_TO_PC_ESCAPE 0x83
139 #define PN533_FRAME_CMD(f) (f->data[1])
141 #define PN533_CMD_GET_FIRMWARE_VERSION 0x02
142 #define PN533_CMD_RF_CONFIGURATION 0x32
143 #define PN533_CMD_IN_DATA_EXCHANGE 0x40
144 #define PN533_CMD_IN_COMM_THRU 0x42
145 #define PN533_CMD_IN_LIST_PASSIVE_TARGET 0x4A
146 #define PN533_CMD_IN_ATR 0x50
147 #define PN533_CMD_IN_RELEASE 0x52
148 #define PN533_CMD_IN_JUMP_FOR_DEP 0x56
150 #define PN533_CMD_TG_INIT_AS_TARGET 0x8c
151 #define PN533_CMD_TG_GET_DATA 0x86
152 #define PN533_CMD_TG_SET_DATA 0x8e
153 #define PN533_CMD_UNDEF 0xff
155 #define PN533_CMD_RESPONSE(cmd) (cmd + 1)
157 /* PN533 Return codes */
158 #define PN533_CMD_RET_MASK 0x3F
159 #define PN533_CMD_MI_MASK 0x40
160 #define PN533_CMD_RET_SUCCESS 0x00
164 typedef int (*pn533_send_async_complete_t) (struct pn533 *dev, void *arg,
165 struct sk_buff *resp);
167 /* structs for pn533 commands */
169 /* PN533_CMD_GET_FIRMWARE_VERSION */
170 struct pn533_fw_version {
177 /* PN533_CMD_RF_CONFIGURATION */
178 #define PN533_CFGITEM_RF_FIELD 0x01
179 #define PN533_CFGITEM_TIMING 0x02
180 #define PN533_CFGITEM_MAX_RETRIES 0x05
181 #define PN533_CFGITEM_PASORI 0x82
183 #define PN533_CFGITEM_RF_FIELD_AUTO_RFCA 0x2
184 #define PN533_CFGITEM_RF_FIELD_ON 0x1
185 #define PN533_CFGITEM_RF_FIELD_OFF 0x0
187 #define PN533_CONFIG_TIMING_102 0xb
188 #define PN533_CONFIG_TIMING_204 0xc
189 #define PN533_CONFIG_TIMING_409 0xd
190 #define PN533_CONFIG_TIMING_819 0xe
192 #define PN533_CONFIG_MAX_RETRIES_NO_RETRY 0x00
193 #define PN533_CONFIG_MAX_RETRIES_ENDLESS 0xFF
195 struct pn533_config_max_retries {
198 u8 mx_rty_passive_act;
201 struct pn533_config_timing {
207 /* PN533_CMD_IN_LIST_PASSIVE_TARGET */
209 /* felica commands opcode */
210 #define PN533_FELICA_OPC_SENSF_REQ 0
211 #define PN533_FELICA_OPC_SENSF_RES 1
212 /* felica SENSF_REQ parameters */
213 #define PN533_FELICA_SENSF_SC_ALL 0xFFFF
214 #define PN533_FELICA_SENSF_RC_NO_SYSTEM_CODE 0
215 #define PN533_FELICA_SENSF_RC_SYSTEM_CODE 1
216 #define PN533_FELICA_SENSF_RC_ADVANCED_PROTOCOL 2
218 /* type B initiator_data values */
219 #define PN533_TYPE_B_AFI_ALL_FAMILIES 0
220 #define PN533_TYPE_B_POLL_METHOD_TIMESLOT 0
221 #define PN533_TYPE_B_POLL_METHOD_PROBABILISTIC 1
223 union pn533_cmd_poll_initdata {
236 /* Poll modulations */
238 PN533_POLL_MOD_106KBPS_A,
239 PN533_POLL_MOD_212KBPS_FELICA,
240 PN533_POLL_MOD_424KBPS_FELICA,
241 PN533_POLL_MOD_106KBPS_JEWEL,
242 PN533_POLL_MOD_847KBPS_B,
245 __PN533_POLL_MOD_AFTER_LAST,
247 #define PN533_POLL_MOD_MAX (__PN533_POLL_MOD_AFTER_LAST - 1)
249 struct pn533_poll_modulations {
253 union pn533_cmd_poll_initdata initiator_data;
258 static const struct pn533_poll_modulations poll_mod[] = {
259 [PN533_POLL_MOD_106KBPS_A] = {
266 [PN533_POLL_MOD_212KBPS_FELICA] = {
270 .initiator_data.felica = {
271 .opcode = PN533_FELICA_OPC_SENSF_REQ,
272 .sc = PN533_FELICA_SENSF_SC_ALL,
273 .rc = PN533_FELICA_SENSF_RC_SYSTEM_CODE,
279 [PN533_POLL_MOD_424KBPS_FELICA] = {
283 .initiator_data.felica = {
284 .opcode = PN533_FELICA_OPC_SENSF_REQ,
285 .sc = PN533_FELICA_SENSF_SC_ALL,
286 .rc = PN533_FELICA_SENSF_RC_SYSTEM_CODE,
292 [PN533_POLL_MOD_106KBPS_JEWEL] = {
299 [PN533_POLL_MOD_847KBPS_B] = {
303 .initiator_data.type_b = {
304 .afi = PN533_TYPE_B_AFI_ALL_FAMILIES,
306 PN533_TYPE_B_POLL_METHOD_TIMESLOT,
311 [PN533_LISTEN_MOD] = {
316 /* PN533_CMD_IN_ATR */
318 struct pn533_cmd_activate_response {
330 struct pn533_cmd_jump_dep_response {
344 /* PN533_TG_INIT_AS_TARGET */
345 #define PN533_INIT_TARGET_PASSIVE 0x1
346 #define PN533_INIT_TARGET_DEP 0x2
348 #define PN533_INIT_TARGET_RESP_FRAME_MASK 0x3
349 #define PN533_INIT_TARGET_RESP_ACTIVE 0x1
350 #define PN533_INIT_TARGET_RESP_DEP 0x4
352 enum pn533_protocol_type {
353 PN533_PROTO_REQ_ACK_RESP = 0,
358 struct usb_device *udev;
359 struct usb_interface *interface;
360 struct nfc_dev *nfc_dev;
362 enum pn533_protocol_type protocol_type;
367 struct sk_buff_head resp_q;
368 struct sk_buff_head fragment_skb;
370 struct workqueue_struct *wq;
371 struct work_struct cmd_work;
372 struct work_struct cmd_complete_work;
373 struct delayed_work poll_work;
374 struct work_struct mi_rx_work;
375 struct work_struct mi_tx_work;
376 struct work_struct tg_work;
377 struct work_struct rf_work;
379 struct list_head cmd_queue;
380 struct pn533_cmd *cmd;
382 struct mutex cmd_lock; /* protects cmd queue */
384 void *cmd_complete_mi_arg;
385 void *cmd_complete_dep_arg;
387 struct pn533_poll_modulations *poll_mod_active[PN533_POLL_MOD_MAX + 1];
392 u32 listen_protocols;
393 struct timer_list listen_timer;
399 u8 tgt_available_prots;
403 struct pn533_frame_ops *ops;
407 struct list_head queue;
411 struct sk_buff *resp;
413 pn533_send_async_complete_t complete_cb;
414 void *complete_cb_context;
417 struct pn533_std_frame {
425 struct pn533_ext_frame { /* Extended Information frame */
428 __be16 eif_flag; /* fixed to 0xFFFF */
434 struct pn533_frame_ops {
435 void (*tx_frame_init)(void *frame, u8 cmd_code);
436 void (*tx_frame_finish)(void *frame);
437 void (*tx_update_payload_len)(void *frame, int len);
441 bool (*rx_is_frame_valid)(void *frame, struct pn533 *dev);
442 int (*rx_frame_size)(void *frame);
447 u8 (*get_cmd_code)(void *frame);
450 struct pn533_acr122_ccid_hdr {
455 u8 params[3]; /* 3 msg specific bytes or status, error and 1 specific
456 byte for reposnse msg */
457 u8 data[]; /* payload */
460 struct pn533_acr122_apdu_hdr {
467 struct pn533_acr122_tx_frame {
468 struct pn533_acr122_ccid_hdr ccid;
469 struct pn533_acr122_apdu_hdr apdu;
471 u8 data[]; /* pn533 frame: TFI ... */
474 struct pn533_acr122_rx_frame {
475 struct pn533_acr122_ccid_hdr ccid;
476 u8 data[]; /* pn533 frame : TFI ... */
479 static void pn533_acr122_tx_frame_init(void *_frame, u8 cmd_code)
481 struct pn533_acr122_tx_frame *frame = _frame;
483 frame->ccid.type = PN533_ACR122_PC_TO_RDR_ESCAPE;
484 frame->ccid.datalen = sizeof(frame->apdu) + 1; /* sizeof(apdu_hdr) +
486 frame->ccid.slot = 0;
488 frame->ccid.params[0] = 0;
489 frame->ccid.params[1] = 0;
490 frame->ccid.params[2] = 0;
492 frame->data[0] = PN533_STD_FRAME_DIR_OUT;
493 frame->data[1] = cmd_code;
494 frame->datalen = 2; /* data[0] + data[1] */
496 frame->apdu.class = 0xFF;
502 static void pn533_acr122_tx_frame_finish(void *_frame)
504 struct pn533_acr122_tx_frame *frame = _frame;
506 frame->ccid.datalen += frame->datalen;
509 static void pn533_acr122_tx_update_payload_len(void *_frame, int len)
511 struct pn533_acr122_tx_frame *frame = _frame;
513 frame->datalen += len;
516 static bool pn533_acr122_is_rx_frame_valid(void *_frame, struct pn533 *dev)
518 struct pn533_acr122_rx_frame *frame = _frame;
520 if (frame->ccid.type != 0x83)
523 if (frame->data[frame->ccid.datalen - 2] == 0x63)
529 static int pn533_acr122_rx_frame_size(void *frame)
531 struct pn533_acr122_rx_frame *f = frame;
533 /* f->ccid.datalen already includes tail length */
534 return sizeof(struct pn533_acr122_rx_frame) + f->ccid.datalen;
537 static u8 pn533_acr122_get_cmd_code(void *frame)
539 struct pn533_acr122_rx_frame *f = frame;
541 return PN533_FRAME_CMD(f);
544 static struct pn533_frame_ops pn533_acr122_frame_ops = {
545 .tx_frame_init = pn533_acr122_tx_frame_init,
546 .tx_frame_finish = pn533_acr122_tx_frame_finish,
547 .tx_update_payload_len = pn533_acr122_tx_update_payload_len,
548 .tx_header_len = PN533_ACR122_TX_FRAME_HEADER_LEN,
549 .tx_tail_len = PN533_ACR122_TX_FRAME_TAIL_LEN,
551 .rx_is_frame_valid = pn533_acr122_is_rx_frame_valid,
552 .rx_header_len = PN533_ACR122_RX_FRAME_HEADER_LEN,
553 .rx_tail_len = PN533_ACR122_RX_FRAME_TAIL_LEN,
554 .rx_frame_size = pn533_acr122_rx_frame_size,
556 .max_payload_len = PN533_ACR122_FRAME_MAX_PAYLOAD_LEN,
557 .get_cmd_code = pn533_acr122_get_cmd_code,
560 /* The rule: value(high byte) + value(low byte) + checksum = 0 */
561 static inline u8 pn533_ext_checksum(u16 value)
563 return ~(u8)(((value & 0xFF00) >> 8) + (u8)(value & 0xFF)) + 1;
566 /* The rule: value + checksum = 0 */
567 static inline u8 pn533_std_checksum(u8 value)
572 /* The rule: sum(data elements) + checksum = 0 */
573 static u8 pn533_std_data_checksum(u8 *data, int datalen)
578 for (i = 0; i < datalen; i++)
581 return pn533_std_checksum(sum);
584 static void pn533_std_tx_frame_init(void *_frame, u8 cmd_code)
586 struct pn533_std_frame *frame = _frame;
589 frame->start_frame = cpu_to_be16(PN533_STD_FRAME_SOF);
590 PN533_STD_FRAME_IDENTIFIER(frame) = PN533_STD_FRAME_DIR_OUT;
591 PN533_FRAME_CMD(frame) = cmd_code;
595 static void pn533_std_tx_frame_finish(void *_frame)
597 struct pn533_std_frame *frame = _frame;
599 frame->datalen_checksum = pn533_std_checksum(frame->datalen);
601 PN533_STD_FRAME_CHECKSUM(frame) =
602 pn533_std_data_checksum(frame->data, frame->datalen);
604 PN533_STD_FRAME_POSTAMBLE(frame) = 0;
607 static void pn533_std_tx_update_payload_len(void *_frame, int len)
609 struct pn533_std_frame *frame = _frame;
611 frame->datalen += len;
614 static bool pn533_std_rx_frame_is_valid(void *_frame, struct pn533 *dev)
617 struct pn533_std_frame *stdf = _frame;
619 if (stdf->start_frame != cpu_to_be16(PN533_STD_FRAME_SOF))
622 if (likely(!PN533_STD_IS_EXTENDED(stdf))) {
623 /* Standard frame code */
624 dev->ops->rx_header_len = PN533_STD_FRAME_HEADER_LEN;
626 checksum = pn533_std_checksum(stdf->datalen);
627 if (checksum != stdf->datalen_checksum)
630 checksum = pn533_std_data_checksum(stdf->data, stdf->datalen);
631 if (checksum != PN533_STD_FRAME_CHECKSUM(stdf))
635 struct pn533_ext_frame *eif = _frame;
637 dev->ops->rx_header_len = PN533_EXT_FRAME_HEADER_LEN;
639 checksum = pn533_ext_checksum(be16_to_cpu(eif->datalen));
640 if (checksum != eif->datalen_checksum)
643 /* check data checksum */
644 checksum = pn533_std_data_checksum(eif->data,
645 be16_to_cpu(eif->datalen));
646 if (checksum != PN533_EXT_FRAME_CHECKSUM(eif))
653 static bool pn533_std_rx_frame_is_ack(struct pn533_std_frame *frame)
655 if (frame->start_frame != cpu_to_be16(PN533_STD_FRAME_SOF))
658 if (frame->datalen != 0 || frame->datalen_checksum != 0xFF)
664 static inline int pn533_std_rx_frame_size(void *frame)
666 struct pn533_std_frame *f = frame;
668 /* check for Extended Information frame */
669 if (PN533_STD_IS_EXTENDED(f)) {
670 struct pn533_ext_frame *eif = frame;
672 return sizeof(struct pn533_ext_frame)
673 + be16_to_cpu(eif->datalen) + PN533_STD_FRAME_TAIL_LEN;
676 return sizeof(struct pn533_std_frame) + f->datalen +
677 PN533_STD_FRAME_TAIL_LEN;
680 static u8 pn533_std_get_cmd_code(void *frame)
682 struct pn533_std_frame *f = frame;
683 struct pn533_ext_frame *eif = frame;
685 if (PN533_STD_IS_EXTENDED(f))
686 return PN533_FRAME_CMD(eif);
688 return PN533_FRAME_CMD(f);
691 static struct pn533_frame_ops pn533_std_frame_ops = {
692 .tx_frame_init = pn533_std_tx_frame_init,
693 .tx_frame_finish = pn533_std_tx_frame_finish,
694 .tx_update_payload_len = pn533_std_tx_update_payload_len,
695 .tx_header_len = PN533_STD_FRAME_HEADER_LEN,
696 .tx_tail_len = PN533_STD_FRAME_TAIL_LEN,
698 .rx_is_frame_valid = pn533_std_rx_frame_is_valid,
699 .rx_frame_size = pn533_std_rx_frame_size,
700 .rx_header_len = PN533_STD_FRAME_HEADER_LEN,
701 .rx_tail_len = PN533_STD_FRAME_TAIL_LEN,
703 .max_payload_len = PN533_STD_FRAME_MAX_PAYLOAD_LEN,
704 .get_cmd_code = pn533_std_get_cmd_code,
707 static bool pn533_rx_frame_is_cmd_response(struct pn533 *dev, void *frame)
709 return (dev->ops->get_cmd_code(frame) ==
710 PN533_CMD_RESPONSE(dev->cmd->code));
713 static void pn533_recv_response(struct urb *urb)
715 struct pn533 *dev = urb->context;
716 struct pn533_cmd *cmd = dev->cmd;
719 cmd->status = urb->status;
721 switch (urb->status) {
726 dev_dbg(&dev->interface->dev,
727 "The urb has been canceled (status %d)\n",
732 nfc_err(&dev->interface->dev,
733 "Urb failure (status %d)\n", urb->status);
737 in_frame = dev->in_urb->transfer_buffer;
739 dev_dbg(&dev->interface->dev, "Received a frame\n");
740 print_hex_dump_debug("PN533 RX: ", DUMP_PREFIX_NONE, 16, 1, in_frame,
741 dev->ops->rx_frame_size(in_frame), false);
743 if (!dev->ops->rx_is_frame_valid(in_frame, dev)) {
744 nfc_err(&dev->interface->dev, "Received an invalid frame\n");
749 if (!pn533_rx_frame_is_cmd_response(dev, in_frame)) {
750 nfc_err(&dev->interface->dev,
751 "It it not the response to the last command\n");
757 queue_work(dev->wq, &dev->cmd_complete_work);
760 static int pn533_submit_urb_for_response(struct pn533 *dev, gfp_t flags)
762 dev->in_urb->complete = pn533_recv_response;
764 return usb_submit_urb(dev->in_urb, flags);
767 static void pn533_recv_ack(struct urb *urb)
769 struct pn533 *dev = urb->context;
770 struct pn533_cmd *cmd = dev->cmd;
771 struct pn533_std_frame *in_frame;
774 cmd->status = urb->status;
776 switch (urb->status) {
781 dev_dbg(&dev->interface->dev,
782 "The urb has been stopped (status %d)\n",
787 nfc_err(&dev->interface->dev,
788 "Urb failure (status %d)\n", urb->status);
792 in_frame = dev->in_urb->transfer_buffer;
794 if (!pn533_std_rx_frame_is_ack(in_frame)) {
795 nfc_err(&dev->interface->dev, "Received an invalid ack\n");
800 rc = pn533_submit_urb_for_response(dev, GFP_ATOMIC);
802 nfc_err(&dev->interface->dev,
803 "usb_submit_urb failed with result %d\n", rc);
811 queue_work(dev->wq, &dev->cmd_complete_work);
814 static int pn533_submit_urb_for_ack(struct pn533 *dev, gfp_t flags)
816 dev->in_urb->complete = pn533_recv_ack;
818 return usb_submit_urb(dev->in_urb, flags);
821 static int pn533_send_ack(struct pn533 *dev, gfp_t flags)
823 u8 ack[PN533_STD_FRAME_ACK_SIZE] = {0x00, 0x00, 0xff, 0x00, 0xff, 0x00};
824 /* spec 7.1.1.3: Preamble, SoPC (2), ACK Code (2), Postamble */
827 dev->out_urb->transfer_buffer = ack;
828 dev->out_urb->transfer_buffer_length = sizeof(ack);
829 rc = usb_submit_urb(dev->out_urb, flags);
834 static int __pn533_send_frame_async(struct pn533 *dev,
841 dev->out_urb->transfer_buffer = out->data;
842 dev->out_urb->transfer_buffer_length = out->len;
844 dev->in_urb->transfer_buffer = in->data;
845 dev->in_urb->transfer_buffer_length = in_len;
847 print_hex_dump_debug("PN533 TX: ", DUMP_PREFIX_NONE, 16, 1,
848 out->data, out->len, false);
850 rc = usb_submit_urb(dev->out_urb, GFP_KERNEL);
854 if (dev->protocol_type == PN533_PROTO_REQ_RESP) {
855 /* request for response for sent packet directly */
856 rc = pn533_submit_urb_for_response(dev, GFP_ATOMIC);
859 } else if (dev->protocol_type == PN533_PROTO_REQ_ACK_RESP) {
860 /* request for ACK if that's the case */
861 rc = pn533_submit_urb_for_ack(dev, GFP_KERNEL);
869 usb_unlink_urb(dev->out_urb);
873 static void pn533_build_cmd_frame(struct pn533 *dev, u8 cmd_code,
876 /* payload is already there, just update datalen */
877 int payload_len = skb->len;
878 struct pn533_frame_ops *ops = dev->ops;
881 skb_push(skb, ops->tx_header_len);
882 skb_put(skb, ops->tx_tail_len);
884 ops->tx_frame_init(skb->data, cmd_code);
885 ops->tx_update_payload_len(skb->data, payload_len);
886 ops->tx_frame_finish(skb->data);
889 static int pn533_send_async_complete(struct pn533 *dev)
891 struct pn533_cmd *cmd = dev->cmd;
892 int status = cmd->status;
894 struct sk_buff *req = cmd->req;
895 struct sk_buff *resp = cmd->resp;
902 rc = cmd->complete_cb(dev, cmd->complete_cb_context,
908 skb_put(resp, dev->ops->rx_frame_size(resp->data));
909 skb_pull(resp, dev->ops->rx_header_len);
910 skb_trim(resp, resp->len - dev->ops->rx_tail_len);
912 rc = cmd->complete_cb(dev, cmd->complete_cb_context, resp);
920 static int __pn533_send_async(struct pn533 *dev, u8 cmd_code,
921 struct sk_buff *req, struct sk_buff *resp,
923 pn533_send_async_complete_t complete_cb,
924 void *complete_cb_context)
926 struct pn533_cmd *cmd;
929 dev_dbg(&dev->interface->dev, "Sending command 0x%x\n", cmd_code);
931 cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
935 cmd->code = cmd_code;
938 cmd->resp_len = resp_len;
939 cmd->complete_cb = complete_cb;
940 cmd->complete_cb_context = complete_cb_context;
942 pn533_build_cmd_frame(dev, cmd_code, req);
944 mutex_lock(&dev->cmd_lock);
946 if (!dev->cmd_pending) {
947 rc = __pn533_send_frame_async(dev, req, resp, resp_len);
951 dev->cmd_pending = 1;
956 dev_dbg(&dev->interface->dev, "%s Queueing command 0x%x\n",
959 INIT_LIST_HEAD(&cmd->queue);
960 list_add_tail(&cmd->queue, &dev->cmd_queue);
967 mutex_unlock(&dev->cmd_lock);
971 static int pn533_send_data_async(struct pn533 *dev, u8 cmd_code,
973 pn533_send_async_complete_t complete_cb,
974 void *complete_cb_context)
976 struct sk_buff *resp;
978 int resp_len = dev->ops->rx_header_len +
979 dev->ops->max_payload_len +
980 dev->ops->rx_tail_len;
982 resp = nfc_alloc_recv_skb(resp_len, GFP_KERNEL);
986 rc = __pn533_send_async(dev, cmd_code, req, resp, resp_len, complete_cb,
987 complete_cb_context);
994 static int pn533_send_cmd_async(struct pn533 *dev, u8 cmd_code,
996 pn533_send_async_complete_t complete_cb,
997 void *complete_cb_context)
999 struct sk_buff *resp;
1001 int resp_len = dev->ops->rx_header_len +
1002 dev->ops->max_payload_len +
1003 dev->ops->rx_tail_len;
1005 resp = alloc_skb(resp_len, GFP_KERNEL);
1009 rc = __pn533_send_async(dev, cmd_code, req, resp, resp_len, complete_cb,
1010 complete_cb_context);
1012 dev_kfree_skb(resp);
1018 * pn533_send_cmd_direct_async
1020 * The function sends a piority cmd directly to the chip omiting the cmd
1021 * queue. It's intended to be used by chaining mechanism of received responses
1022 * where the host has to request every single chunk of data before scheduling
1023 * next cmd from the queue.
1025 static int pn533_send_cmd_direct_async(struct pn533 *dev, u8 cmd_code,
1026 struct sk_buff *req,
1027 pn533_send_async_complete_t complete_cb,
1028 void *complete_cb_context)
1030 struct sk_buff *resp;
1031 struct pn533_cmd *cmd;
1033 int resp_len = dev->ops->rx_header_len +
1034 dev->ops->max_payload_len +
1035 dev->ops->rx_tail_len;
1037 resp = alloc_skb(resp_len, GFP_KERNEL);
1041 cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
1043 dev_kfree_skb(resp);
1047 cmd->code = cmd_code;
1050 cmd->resp_len = resp_len;
1051 cmd->complete_cb = complete_cb;
1052 cmd->complete_cb_context = complete_cb_context;
1054 pn533_build_cmd_frame(dev, cmd_code, req);
1056 rc = __pn533_send_frame_async(dev, req, resp, resp_len);
1058 dev_kfree_skb(resp);
1067 static void pn533_wq_cmd_complete(struct work_struct *work)
1069 struct pn533 *dev = container_of(work, struct pn533, cmd_complete_work);
1072 rc = pn533_send_async_complete(dev);
1073 if (rc != -EINPROGRESS)
1074 queue_work(dev->wq, &dev->cmd_work);
1077 static void pn533_wq_cmd(struct work_struct *work)
1079 struct pn533 *dev = container_of(work, struct pn533, cmd_work);
1080 struct pn533_cmd *cmd;
1083 mutex_lock(&dev->cmd_lock);
1085 if (list_empty(&dev->cmd_queue)) {
1086 dev->cmd_pending = 0;
1087 mutex_unlock(&dev->cmd_lock);
1091 cmd = list_first_entry(&dev->cmd_queue, struct pn533_cmd, queue);
1093 list_del(&cmd->queue);
1095 mutex_unlock(&dev->cmd_lock);
1097 rc = __pn533_send_frame_async(dev, cmd->req, cmd->resp, cmd->resp_len);
1099 dev_kfree_skb(cmd->req);
1100 dev_kfree_skb(cmd->resp);
1108 struct pn533_sync_cmd_response {
1109 struct sk_buff *resp;
1110 struct completion done;
1113 static int pn533_send_sync_complete(struct pn533 *dev, void *_arg,
1114 struct sk_buff *resp)
1116 struct pn533_sync_cmd_response *arg = _arg;
1119 complete(&arg->done);
1124 /* pn533_send_cmd_sync
1126 * Please note the req parameter is freed inside the function to
1127 * limit a number of return value interpretations by the caller.
1129 * 1. negative in case of error during TX path -> req should be freed
1131 * 2. negative in case of error during RX path -> req should not be freed
1132 * as it's been already freed at the begining of RX path by
1133 * async_complete_cb.
1135 * 3. valid pointer in case of succesfult RX path
1137 * A caller has to check a return value with IS_ERR macro. If the test pass,
1138 * the returned pointer is valid.
1141 static struct sk_buff *pn533_send_cmd_sync(struct pn533 *dev, u8 cmd_code,
1142 struct sk_buff *req)
1145 struct pn533_sync_cmd_response arg;
1147 init_completion(&arg.done);
1149 rc = pn533_send_cmd_async(dev, cmd_code, req,
1150 pn533_send_sync_complete, &arg);
1156 wait_for_completion(&arg.done);
1161 static void pn533_send_complete(struct urb *urb)
1163 struct pn533 *dev = urb->context;
1165 switch (urb->status) {
1167 break; /* success */
1170 dev_dbg(&dev->interface->dev,
1171 "The urb has been stopped (status %d)\n",
1176 nfc_err(&dev->interface->dev, "Urb failure (status %d)\n",
1181 static void pn533_abort_cmd(struct pn533 *dev, gfp_t flags)
1183 /* ACR122U does not support any command which aborts last
1184 * issued command i.e. as ACK for standard PN533. Additionally,
1185 * it behaves stange, sending broken or incorrect responses,
1186 * when we cancel urb before the chip will send response.
1188 if (dev->device_type == PN533_DEVICE_ACR122U)
1191 /* An ack will cancel the last issued command */
1192 pn533_send_ack(dev, flags);
1194 /* cancel the urb request */
1195 usb_kill_urb(dev->in_urb);
1198 static struct sk_buff *pn533_alloc_skb(struct pn533 *dev, unsigned int size)
1200 struct sk_buff *skb;
1202 skb = alloc_skb(dev->ops->tx_header_len +
1204 dev->ops->tx_tail_len, GFP_KERNEL);
1207 skb_reserve(skb, dev->ops->tx_header_len);
1212 struct pn533_target_type_a {
1220 #define PN533_TYPE_A_SENS_RES_NFCID1(x) ((u8)((be16_to_cpu(x) & 0x00C0) >> 6))
1221 #define PN533_TYPE_A_SENS_RES_SSD(x) ((u8)((be16_to_cpu(x) & 0x001F) >> 0))
1222 #define PN533_TYPE_A_SENS_RES_PLATCONF(x) ((u8)((be16_to_cpu(x) & 0x0F00) >> 8))
1224 #define PN533_TYPE_A_SENS_RES_SSD_JEWEL 0x00
1225 #define PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL 0x0C
1227 #define PN533_TYPE_A_SEL_PROT(x) (((x) & 0x60) >> 5)
1228 #define PN533_TYPE_A_SEL_CASCADE(x) (((x) & 0x04) >> 2)
1230 #define PN533_TYPE_A_SEL_PROT_MIFARE 0
1231 #define PN533_TYPE_A_SEL_PROT_ISO14443 1
1232 #define PN533_TYPE_A_SEL_PROT_DEP 2
1233 #define PN533_TYPE_A_SEL_PROT_ISO14443_DEP 3
1235 static bool pn533_target_type_a_is_valid(struct pn533_target_type_a *type_a,
1236 int target_data_len)
1241 if (target_data_len < sizeof(struct pn533_target_type_a))
1244 /* The lenght check of nfcid[] and ats[] are not being performed because
1245 the values are not being used */
1247 /* Requirement 4.6.3.3 from NFC Forum Digital Spec */
1248 ssd = PN533_TYPE_A_SENS_RES_SSD(type_a->sens_res);
1249 platconf = PN533_TYPE_A_SENS_RES_PLATCONF(type_a->sens_res);
1251 if ((ssd == PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
1252 platconf != PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL) ||
1253 (ssd != PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
1254 platconf == PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL))
1257 /* Requirements 4.8.2.1, 4.8.2.3, 4.8.2.5 and 4.8.2.7 from NFC Forum */
1258 if (PN533_TYPE_A_SEL_CASCADE(type_a->sel_res) != 0)
1264 static int pn533_target_found_type_a(struct nfc_target *nfc_tgt, u8 *tgt_data,
1267 struct pn533_target_type_a *tgt_type_a;
1269 tgt_type_a = (struct pn533_target_type_a *)tgt_data;
1271 if (!pn533_target_type_a_is_valid(tgt_type_a, tgt_data_len))
1274 switch (PN533_TYPE_A_SEL_PROT(tgt_type_a->sel_res)) {
1275 case PN533_TYPE_A_SEL_PROT_MIFARE:
1276 nfc_tgt->supported_protocols = NFC_PROTO_MIFARE_MASK;
1278 case PN533_TYPE_A_SEL_PROT_ISO14443:
1279 nfc_tgt->supported_protocols = NFC_PROTO_ISO14443_MASK;
1281 case PN533_TYPE_A_SEL_PROT_DEP:
1282 nfc_tgt->supported_protocols = NFC_PROTO_NFC_DEP_MASK;
1284 case PN533_TYPE_A_SEL_PROT_ISO14443_DEP:
1285 nfc_tgt->supported_protocols = NFC_PROTO_ISO14443_MASK |
1286 NFC_PROTO_NFC_DEP_MASK;
1290 nfc_tgt->sens_res = be16_to_cpu(tgt_type_a->sens_res);
1291 nfc_tgt->sel_res = tgt_type_a->sel_res;
1292 nfc_tgt->nfcid1_len = tgt_type_a->nfcid_len;
1293 memcpy(nfc_tgt->nfcid1, tgt_type_a->nfcid_data, nfc_tgt->nfcid1_len);
1298 struct pn533_target_felica {
1301 u8 nfcid2[NFC_NFCID2_MAXSIZE];
1307 #define PN533_FELICA_SENSF_NFCID2_DEP_B1 0x01
1308 #define PN533_FELICA_SENSF_NFCID2_DEP_B2 0xFE
1310 static bool pn533_target_felica_is_valid(struct pn533_target_felica *felica,
1311 int target_data_len)
1313 if (target_data_len < sizeof(struct pn533_target_felica))
1316 if (felica->opcode != PN533_FELICA_OPC_SENSF_RES)
1322 static int pn533_target_found_felica(struct nfc_target *nfc_tgt, u8 *tgt_data,
1325 struct pn533_target_felica *tgt_felica;
1327 tgt_felica = (struct pn533_target_felica *)tgt_data;
1329 if (!pn533_target_felica_is_valid(tgt_felica, tgt_data_len))
1332 if ((tgt_felica->nfcid2[0] == PN533_FELICA_SENSF_NFCID2_DEP_B1) &&
1333 (tgt_felica->nfcid2[1] == PN533_FELICA_SENSF_NFCID2_DEP_B2))
1334 nfc_tgt->supported_protocols = NFC_PROTO_NFC_DEP_MASK;
1336 nfc_tgt->supported_protocols = NFC_PROTO_FELICA_MASK;
1338 memcpy(nfc_tgt->sensf_res, &tgt_felica->opcode, 9);
1339 nfc_tgt->sensf_res_len = 9;
1341 memcpy(nfc_tgt->nfcid2, tgt_felica->nfcid2, NFC_NFCID2_MAXSIZE);
1342 nfc_tgt->nfcid2_len = NFC_NFCID2_MAXSIZE;
1347 struct pn533_target_jewel {
1352 static bool pn533_target_jewel_is_valid(struct pn533_target_jewel *jewel,
1353 int target_data_len)
1358 if (target_data_len < sizeof(struct pn533_target_jewel))
1361 /* Requirement 4.6.3.3 from NFC Forum Digital Spec */
1362 ssd = PN533_TYPE_A_SENS_RES_SSD(jewel->sens_res);
1363 platconf = PN533_TYPE_A_SENS_RES_PLATCONF(jewel->sens_res);
1365 if ((ssd == PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
1366 platconf != PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL) ||
1367 (ssd != PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
1368 platconf == PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL))
1374 static int pn533_target_found_jewel(struct nfc_target *nfc_tgt, u8 *tgt_data,
1377 struct pn533_target_jewel *tgt_jewel;
1379 tgt_jewel = (struct pn533_target_jewel *)tgt_data;
1381 if (!pn533_target_jewel_is_valid(tgt_jewel, tgt_data_len))
1384 nfc_tgt->supported_protocols = NFC_PROTO_JEWEL_MASK;
1385 nfc_tgt->sens_res = be16_to_cpu(tgt_jewel->sens_res);
1386 nfc_tgt->nfcid1_len = 4;
1387 memcpy(nfc_tgt->nfcid1, tgt_jewel->jewelid, nfc_tgt->nfcid1_len);
1392 struct pn533_type_b_prot_info {
1398 #define PN533_TYPE_B_PROT_FCSI(x) (((x) & 0xF0) >> 4)
1399 #define PN533_TYPE_B_PROT_TYPE(x) (((x) & 0x0F) >> 0)
1400 #define PN533_TYPE_B_PROT_TYPE_RFU_MASK 0x8
1402 struct pn533_type_b_sens_res {
1406 struct pn533_type_b_prot_info prot_info;
1409 #define PN533_TYPE_B_OPC_SENSB_RES 0x50
1411 struct pn533_target_type_b {
1412 struct pn533_type_b_sens_res sensb_res;
1417 static bool pn533_target_type_b_is_valid(struct pn533_target_type_b *type_b,
1418 int target_data_len)
1420 if (target_data_len < sizeof(struct pn533_target_type_b))
1423 if (type_b->sensb_res.opcode != PN533_TYPE_B_OPC_SENSB_RES)
1426 if (PN533_TYPE_B_PROT_TYPE(type_b->sensb_res.prot_info.fsci_type) &
1427 PN533_TYPE_B_PROT_TYPE_RFU_MASK)
1433 static int pn533_target_found_type_b(struct nfc_target *nfc_tgt, u8 *tgt_data,
1436 struct pn533_target_type_b *tgt_type_b;
1438 tgt_type_b = (struct pn533_target_type_b *)tgt_data;
1440 if (!pn533_target_type_b_is_valid(tgt_type_b, tgt_data_len))
1443 nfc_tgt->supported_protocols = NFC_PROTO_ISO14443_B_MASK;
1448 static int pn533_target_found(struct pn533 *dev, u8 tg, u8 *tgdata,
1451 struct nfc_target nfc_tgt;
1454 dev_dbg(&dev->interface->dev, "%s: modulation=%d\n",
1455 __func__, dev->poll_mod_curr);
1460 memset(&nfc_tgt, 0, sizeof(struct nfc_target));
1462 switch (dev->poll_mod_curr) {
1463 case PN533_POLL_MOD_106KBPS_A:
1464 rc = pn533_target_found_type_a(&nfc_tgt, tgdata, tgdata_len);
1466 case PN533_POLL_MOD_212KBPS_FELICA:
1467 case PN533_POLL_MOD_424KBPS_FELICA:
1468 rc = pn533_target_found_felica(&nfc_tgt, tgdata, tgdata_len);
1470 case PN533_POLL_MOD_106KBPS_JEWEL:
1471 rc = pn533_target_found_jewel(&nfc_tgt, tgdata, tgdata_len);
1473 case PN533_POLL_MOD_847KBPS_B:
1474 rc = pn533_target_found_type_b(&nfc_tgt, tgdata, tgdata_len);
1477 nfc_err(&dev->interface->dev,
1478 "Unknown current poll modulation\n");
1485 if (!(nfc_tgt.supported_protocols & dev->poll_protocols)) {
1486 dev_dbg(&dev->interface->dev,
1487 "The Tg found doesn't have the desired protocol\n");
1491 dev_dbg(&dev->interface->dev,
1492 "Target found - supported protocols: 0x%x\n",
1493 nfc_tgt.supported_protocols);
1495 dev->tgt_available_prots = nfc_tgt.supported_protocols;
1497 nfc_targets_found(dev->nfc_dev, &nfc_tgt, 1);
1502 static inline void pn533_poll_next_mod(struct pn533 *dev)
1504 dev->poll_mod_curr = (dev->poll_mod_curr + 1) % dev->poll_mod_count;
1507 static void pn533_poll_reset_mod_list(struct pn533 *dev)
1509 dev->poll_mod_count = 0;
1512 static void pn533_poll_add_mod(struct pn533 *dev, u8 mod_index)
1514 dev->poll_mod_active[dev->poll_mod_count] =
1515 (struct pn533_poll_modulations *)&poll_mod[mod_index];
1516 dev->poll_mod_count++;
1519 static void pn533_poll_create_mod_list(struct pn533 *dev,
1520 u32 im_protocols, u32 tm_protocols)
1522 pn533_poll_reset_mod_list(dev);
1524 if ((im_protocols & NFC_PROTO_MIFARE_MASK) ||
1525 (im_protocols & NFC_PROTO_ISO14443_MASK) ||
1526 (im_protocols & NFC_PROTO_NFC_DEP_MASK))
1527 pn533_poll_add_mod(dev, PN533_POLL_MOD_106KBPS_A);
1529 if (im_protocols & NFC_PROTO_FELICA_MASK ||
1530 im_protocols & NFC_PROTO_NFC_DEP_MASK) {
1531 pn533_poll_add_mod(dev, PN533_POLL_MOD_212KBPS_FELICA);
1532 pn533_poll_add_mod(dev, PN533_POLL_MOD_424KBPS_FELICA);
1535 if (im_protocols & NFC_PROTO_JEWEL_MASK)
1536 pn533_poll_add_mod(dev, PN533_POLL_MOD_106KBPS_JEWEL);
1538 if (im_protocols & NFC_PROTO_ISO14443_B_MASK)
1539 pn533_poll_add_mod(dev, PN533_POLL_MOD_847KBPS_B);
1542 pn533_poll_add_mod(dev, PN533_LISTEN_MOD);
1545 static int pn533_start_poll_complete(struct pn533 *dev, struct sk_buff *resp)
1547 u8 nbtg, tg, *tgdata;
1550 /* Toggle the DEP polling */
1553 nbtg = resp->data[0];
1555 tgdata = &resp->data[2];
1556 tgdata_len = resp->len - 2; /* nbtg + tg */
1559 rc = pn533_target_found(dev, tg, tgdata, tgdata_len);
1561 /* We must stop the poll after a valid target found */
1563 pn533_poll_reset_mod_list(dev);
1571 static struct sk_buff *pn533_alloc_poll_tg_frame(struct pn533 *dev)
1573 struct sk_buff *skb;
1574 u8 *felica, *nfcid3, *gb;
1576 u8 *gbytes = dev->gb;
1577 size_t gbytes_len = dev->gb_len;
1579 u8 felica_params[18] = {0x1, 0xfe, /* DEP */
1580 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, /* random */
1581 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
1582 0xff, 0xff}; /* System code */
1584 u8 mifare_params[6] = {0x1, 0x1, /* SENS_RES */
1586 0x40}; /* SEL_RES for DEP */
1588 unsigned int skb_len = 36 + /* mode (1), mifare (6),
1589 felica (18), nfcid3 (10), gb_len (1) */
1593 skb = pn533_alloc_skb(dev, skb_len);
1597 /* DEP support only */
1598 *skb_put(skb, 1) = PN533_INIT_TARGET_DEP;
1601 memcpy(skb_put(skb, 6), mifare_params, 6);
1604 felica = skb_put(skb, 18);
1605 memcpy(felica, felica_params, 18);
1606 get_random_bytes(felica + 2, 6);
1609 nfcid3 = skb_put(skb, 10);
1610 memset(nfcid3, 0, 10);
1611 memcpy(nfcid3, felica, 8);
1614 *skb_put(skb, 1) = gbytes_len;
1616 gb = skb_put(skb, gbytes_len);
1617 memcpy(gb, gbytes, gbytes_len);
1620 *skb_put(skb, 1) = 0;
1625 #define PN533_CMD_DATAEXCH_HEAD_LEN 1
1626 #define PN533_CMD_DATAEXCH_DATA_MAXLEN 262
1627 static int pn533_tm_get_data_complete(struct pn533 *dev, void *arg,
1628 struct sk_buff *resp)
1632 dev_dbg(&dev->interface->dev, "%s\n", __func__);
1635 return PTR_ERR(resp);
1637 status = resp->data[0];
1638 skb_pull(resp, sizeof(status));
1641 nfc_tm_deactivated(dev->nfc_dev);
1643 dev_kfree_skb(resp);
1647 return nfc_tm_data_received(dev->nfc_dev, resp);
1650 static void pn533_wq_tg_get_data(struct work_struct *work)
1652 struct pn533 *dev = container_of(work, struct pn533, tg_work);
1653 struct sk_buff *skb;
1656 dev_dbg(&dev->interface->dev, "%s\n", __func__);
1658 skb = pn533_alloc_skb(dev, 0);
1662 rc = pn533_send_data_async(dev, PN533_CMD_TG_GET_DATA, skb,
1663 pn533_tm_get_data_complete, NULL);
1671 #define ATR_REQ_GB_OFFSET 17
1672 static int pn533_init_target_complete(struct pn533 *dev, struct sk_buff *resp)
1674 u8 mode, *cmd, comm_mode = NFC_COMM_PASSIVE, *gb;
1678 dev_dbg(&dev->interface->dev, "%s\n", __func__);
1680 if (resp->len < ATR_REQ_GB_OFFSET + 1)
1683 mode = resp->data[0];
1684 cmd = &resp->data[1];
1686 dev_dbg(&dev->interface->dev, "Target mode 0x%x len %d\n",
1689 if ((mode & PN533_INIT_TARGET_RESP_FRAME_MASK) ==
1690 PN533_INIT_TARGET_RESP_ACTIVE)
1691 comm_mode = NFC_COMM_ACTIVE;
1693 if ((mode & PN533_INIT_TARGET_RESP_DEP) == 0) /* Only DEP supported */
1696 gb = cmd + ATR_REQ_GB_OFFSET;
1697 gb_len = resp->len - (ATR_REQ_GB_OFFSET + 1);
1699 rc = nfc_tm_activated(dev->nfc_dev, NFC_PROTO_NFC_DEP_MASK,
1700 comm_mode, gb, gb_len);
1702 nfc_err(&dev->interface->dev,
1703 "Error when signaling target activation\n");
1708 queue_work(dev->wq, &dev->tg_work);
1713 static void pn533_listen_mode_timer(unsigned long data)
1715 struct pn533 *dev = (struct pn533 *)data;
1717 dev_dbg(&dev->interface->dev, "Listen mode timeout\n");
1719 dev->cancel_listen = 1;
1721 pn533_poll_next_mod(dev);
1723 queue_delayed_work(dev->wq, &dev->poll_work,
1724 msecs_to_jiffies(PN533_POLL_INTERVAL));
1727 static int pn533_rf_complete(struct pn533 *dev, void *arg,
1728 struct sk_buff *resp)
1732 dev_dbg(&dev->interface->dev, "%s\n", __func__);
1737 nfc_err(&dev->interface->dev, "RF setting error %d", rc);
1742 queue_delayed_work(dev->wq, &dev->poll_work,
1743 msecs_to_jiffies(PN533_POLL_INTERVAL));
1745 dev_kfree_skb(resp);
1749 static void pn533_wq_rf(struct work_struct *work)
1751 struct pn533 *dev = container_of(work, struct pn533, rf_work);
1752 struct sk_buff *skb;
1755 dev_dbg(&dev->interface->dev, "%s\n", __func__);
1757 skb = pn533_alloc_skb(dev, 2);
1761 *skb_put(skb, 1) = PN533_CFGITEM_RF_FIELD;
1762 *skb_put(skb, 1) = PN533_CFGITEM_RF_FIELD_AUTO_RFCA;
1764 rc = pn533_send_cmd_async(dev, PN533_CMD_RF_CONFIGURATION, skb,
1765 pn533_rf_complete, NULL);
1768 nfc_err(&dev->interface->dev, "RF setting error %d\n", rc);
1774 static int pn533_poll_dep_complete(struct pn533 *dev, void *arg,
1775 struct sk_buff *resp)
1777 struct pn533_cmd_jump_dep_response *rsp;
1778 struct nfc_target nfc_target;
1783 return PTR_ERR(resp);
1785 rsp = (struct pn533_cmd_jump_dep_response *)resp->data;
1787 rc = rsp->status & PN533_CMD_RET_MASK;
1788 if (rc != PN533_CMD_RET_SUCCESS) {
1789 /* Not target found, turn radio off */
1790 queue_work(dev->wq, &dev->rf_work);
1792 dev_kfree_skb(resp);
1796 dev_dbg(&dev->interface->dev, "Creating new target");
1798 nfc_target.supported_protocols = NFC_PROTO_NFC_DEP_MASK;
1799 nfc_target.nfcid1_len = 10;
1800 memcpy(nfc_target.nfcid1, rsp->nfcid3t, nfc_target.nfcid1_len);
1801 rc = nfc_targets_found(dev->nfc_dev, &nfc_target, 1);
1805 dev->tgt_available_prots = 0;
1806 dev->tgt_active_prot = NFC_PROTO_NFC_DEP;
1808 /* ATR_RES general bytes are located at offset 17 */
1809 target_gt_len = resp->len - 17;
1810 rc = nfc_set_remote_general_bytes(dev->nfc_dev,
1811 rsp->gt, target_gt_len);
1813 rc = nfc_dep_link_is_up(dev->nfc_dev,
1814 dev->nfc_dev->targets[0].idx,
1815 0, NFC_RF_INITIATOR);
1818 pn533_poll_reset_mod_list(dev);
1821 dev_kfree_skb(resp);
1825 #define PASSIVE_DATA_LEN 5
1826 static int pn533_poll_dep(struct nfc_dev *nfc_dev)
1828 struct pn533 *dev = nfc_get_drvdata(nfc_dev);
1829 struct sk_buff *skb;
1831 u8 *next, nfcid3[NFC_NFCID3_MAXSIZE];
1832 u8 passive_data[PASSIVE_DATA_LEN] = {0x00, 0xff, 0xff, 0x00, 0x3};
1834 dev_dbg(&dev->interface->dev, "%s", __func__);
1837 dev->gb = nfc_get_local_general_bytes(nfc_dev, &dev->gb_len);
1839 if (!dev->gb || !dev->gb_len) {
1841 queue_work(dev->wq, &dev->rf_work);
1845 skb_len = 3 + dev->gb_len; /* ActPass + BR + Next */
1846 skb_len += PASSIVE_DATA_LEN;
1849 skb_len += NFC_NFCID3_MAXSIZE;
1852 get_random_bytes(nfcid3 + 2, 6);
1854 skb = pn533_alloc_skb(dev, skb_len);
1858 *skb_put(skb, 1) = 0x01; /* Active */
1859 *skb_put(skb, 1) = 0x02; /* 424 kbps */
1861 next = skb_put(skb, 1); /* Next */
1864 /* Copy passive data */
1865 memcpy(skb_put(skb, PASSIVE_DATA_LEN), passive_data, PASSIVE_DATA_LEN);
1868 /* Copy NFCID3 (which is NFCID2 from SENSF_RES) */
1869 memcpy(skb_put(skb, NFC_NFCID3_MAXSIZE), nfcid3,
1870 NFC_NFCID3_MAXSIZE);
1873 memcpy(skb_put(skb, dev->gb_len), dev->gb, dev->gb_len);
1874 *next |= 4; /* We have some Gi */
1876 rc = pn533_send_cmd_async(dev, PN533_CMD_IN_JUMP_FOR_DEP, skb,
1877 pn533_poll_dep_complete, NULL);
1885 static int pn533_poll_complete(struct pn533 *dev, void *arg,
1886 struct sk_buff *resp)
1888 struct pn533_poll_modulations *cur_mod;
1891 dev_dbg(&dev->interface->dev, "%s\n", __func__);
1896 nfc_err(&dev->interface->dev, "%s Poll complete error %d\n",
1899 if (rc == -ENOENT) {
1900 if (dev->poll_mod_count != 0)
1904 } else if (rc < 0) {
1905 nfc_err(&dev->interface->dev,
1906 "Error %d when running poll\n", rc);
1911 cur_mod = dev->poll_mod_active[dev->poll_mod_curr];
1913 if (cur_mod->len == 0) { /* Target mode */
1914 del_timer(&dev->listen_timer);
1915 rc = pn533_init_target_complete(dev, resp);
1919 /* Initiator mode */
1920 rc = pn533_start_poll_complete(dev, resp);
1924 if (!dev->poll_mod_count) {
1925 dev_dbg(&dev->interface->dev, "Polling has been stopped\n");
1929 pn533_poll_next_mod(dev);
1930 /* Not target found, turn radio off */
1931 queue_work(dev->wq, &dev->rf_work);
1934 dev_kfree_skb(resp);
1938 nfc_err(&dev->interface->dev, "Polling operation has been stopped\n");
1940 pn533_poll_reset_mod_list(dev);
1941 dev->poll_protocols = 0;
1945 static struct sk_buff *pn533_alloc_poll_in_frame(struct pn533 *dev,
1946 struct pn533_poll_modulations *mod)
1948 struct sk_buff *skb;
1950 skb = pn533_alloc_skb(dev, mod->len);
1954 memcpy(skb_put(skb, mod->len), &mod->data, mod->len);
1959 static int pn533_send_poll_frame(struct pn533 *dev)
1961 struct pn533_poll_modulations *mod;
1962 struct sk_buff *skb;
1966 mod = dev->poll_mod_active[dev->poll_mod_curr];
1968 dev_dbg(&dev->interface->dev, "%s mod len %d\n",
1969 __func__, mod->len);
1971 if (dev->poll_dep) {
1973 return pn533_poll_dep(dev->nfc_dev);
1976 if (mod->len == 0) { /* Listen mode */
1977 cmd_code = PN533_CMD_TG_INIT_AS_TARGET;
1978 skb = pn533_alloc_poll_tg_frame(dev);
1979 } else { /* Polling mode */
1980 cmd_code = PN533_CMD_IN_LIST_PASSIVE_TARGET;
1981 skb = pn533_alloc_poll_in_frame(dev, mod);
1985 nfc_err(&dev->interface->dev, "Failed to allocate skb\n");
1989 rc = pn533_send_cmd_async(dev, cmd_code, skb, pn533_poll_complete,
1993 nfc_err(&dev->interface->dev, "Polling loop error %d\n", rc);
1999 static void pn533_wq_poll(struct work_struct *work)
2001 struct pn533 *dev = container_of(work, struct pn533, poll_work.work);
2002 struct pn533_poll_modulations *cur_mod;
2005 cur_mod = dev->poll_mod_active[dev->poll_mod_curr];
2007 dev_dbg(&dev->interface->dev,
2008 "%s cancel_listen %d modulation len %d\n",
2009 __func__, dev->cancel_listen, cur_mod->len);
2011 if (dev->cancel_listen == 1) {
2012 dev->cancel_listen = 0;
2013 pn533_abort_cmd(dev, GFP_ATOMIC);
2016 rc = pn533_send_poll_frame(dev);
2020 if (cur_mod->len == 0 && dev->poll_mod_count > 1)
2021 mod_timer(&dev->listen_timer, jiffies + PN533_LISTEN_TIME * HZ);
2026 static int pn533_start_poll(struct nfc_dev *nfc_dev,
2027 u32 im_protocols, u32 tm_protocols)
2029 struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2030 struct pn533_poll_modulations *cur_mod;
2034 dev_dbg(&dev->interface->dev,
2035 "%s: im protocols 0x%x tm protocols 0x%x\n",
2036 __func__, im_protocols, tm_protocols);
2038 if (dev->tgt_active_prot) {
2039 nfc_err(&dev->interface->dev,
2040 "Cannot poll with a target already activated\n");
2044 if (dev->tgt_mode) {
2045 nfc_err(&dev->interface->dev,
2046 "Cannot poll while already being activated\n");
2051 dev->gb = nfc_get_local_general_bytes(nfc_dev, &dev->gb_len);
2052 if (dev->gb == NULL)
2056 pn533_poll_create_mod_list(dev, im_protocols, tm_protocols);
2057 dev->poll_protocols = im_protocols;
2058 dev->listen_protocols = tm_protocols;
2060 /* Do not always start polling from the same modulation */
2061 get_random_bytes(&rand_mod, sizeof(rand_mod));
2062 rand_mod %= dev->poll_mod_count;
2063 dev->poll_mod_curr = rand_mod;
2065 cur_mod = dev->poll_mod_active[dev->poll_mod_curr];
2067 rc = pn533_send_poll_frame(dev);
2069 /* Start listen timer */
2070 if (!rc && cur_mod->len == 0 && dev->poll_mod_count > 1)
2071 mod_timer(&dev->listen_timer, jiffies + PN533_LISTEN_TIME * HZ);
2076 static void pn533_stop_poll(struct nfc_dev *nfc_dev)
2078 struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2080 del_timer(&dev->listen_timer);
2082 if (!dev->poll_mod_count) {
2083 dev_dbg(&dev->interface->dev,
2084 "Polling operation was not running\n");
2088 pn533_abort_cmd(dev, GFP_KERNEL);
2089 flush_delayed_work(&dev->poll_work);
2090 pn533_poll_reset_mod_list(dev);
2093 static int pn533_activate_target_nfcdep(struct pn533 *dev)
2095 struct pn533_cmd_activate_response *rsp;
2098 struct sk_buff *skb;
2099 struct sk_buff *resp;
2101 dev_dbg(&dev->interface->dev, "%s\n", __func__);
2103 skb = pn533_alloc_skb(dev, sizeof(u8) * 2); /*TG + Next*/
2107 *skb_put(skb, sizeof(u8)) = 1; /* TG */
2108 *skb_put(skb, sizeof(u8)) = 0; /* Next */
2110 resp = pn533_send_cmd_sync(dev, PN533_CMD_IN_ATR, skb);
2112 return PTR_ERR(resp);
2114 rsp = (struct pn533_cmd_activate_response *)resp->data;
2115 rc = rsp->status & PN533_CMD_RET_MASK;
2116 if (rc != PN533_CMD_RET_SUCCESS) {
2117 nfc_err(&dev->interface->dev,
2118 "Target activation failed (error 0x%x)\n", rc);
2119 dev_kfree_skb(resp);
2123 /* ATR_RES general bytes are located at offset 16 */
2124 gt_len = resp->len - 16;
2125 rc = nfc_set_remote_general_bytes(dev->nfc_dev, rsp->gt, gt_len);
2127 dev_kfree_skb(resp);
2131 static int pn533_activate_target(struct nfc_dev *nfc_dev,
2132 struct nfc_target *target, u32 protocol)
2134 struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2137 dev_dbg(&dev->interface->dev, "%s: protocol=%u\n", __func__, protocol);
2139 if (dev->poll_mod_count) {
2140 nfc_err(&dev->interface->dev,
2141 "Cannot activate while polling\n");
2145 if (dev->tgt_active_prot) {
2146 nfc_err(&dev->interface->dev,
2147 "There is already an active target\n");
2151 if (!dev->tgt_available_prots) {
2152 nfc_err(&dev->interface->dev,
2153 "There is no available target to activate\n");
2157 if (!(dev->tgt_available_prots & (1 << protocol))) {
2158 nfc_err(&dev->interface->dev,
2159 "Target doesn't support requested proto %u\n",
2164 if (protocol == NFC_PROTO_NFC_DEP) {
2165 rc = pn533_activate_target_nfcdep(dev);
2167 nfc_err(&dev->interface->dev,
2168 "Activating target with DEP failed %d\n", rc);
2173 dev->tgt_active_prot = protocol;
2174 dev->tgt_available_prots = 0;
2179 static void pn533_deactivate_target(struct nfc_dev *nfc_dev,
2180 struct nfc_target *target)
2182 struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2183 struct sk_buff *skb;
2184 struct sk_buff *resp;
2187 dev_dbg(&dev->interface->dev, "%s\n", __func__);
2189 if (!dev->tgt_active_prot) {
2190 nfc_err(&dev->interface->dev, "There is no active target\n");
2194 dev->tgt_active_prot = 0;
2195 skb_queue_purge(&dev->resp_q);
2197 skb = pn533_alloc_skb(dev, sizeof(u8));
2201 *skb_put(skb, 1) = 1; /* TG*/
2203 resp = pn533_send_cmd_sync(dev, PN533_CMD_IN_RELEASE, skb);
2207 rc = resp->data[0] & PN533_CMD_RET_MASK;
2208 if (rc != PN533_CMD_RET_SUCCESS)
2209 nfc_err(&dev->interface->dev,
2210 "Error 0x%x when releasing the target\n", rc);
2212 dev_kfree_skb(resp);
2217 static int pn533_in_dep_link_up_complete(struct pn533 *dev, void *arg,
2218 struct sk_buff *resp)
2220 struct pn533_cmd_jump_dep_response *rsp;
2223 u8 active = *(u8 *)arg;
2228 return PTR_ERR(resp);
2230 if (dev->tgt_available_prots &&
2231 !(dev->tgt_available_prots & (1 << NFC_PROTO_NFC_DEP))) {
2232 nfc_err(&dev->interface->dev,
2233 "The target does not support DEP\n");
2238 rsp = (struct pn533_cmd_jump_dep_response *)resp->data;
2240 rc = rsp->status & PN533_CMD_RET_MASK;
2241 if (rc != PN533_CMD_RET_SUCCESS) {
2242 nfc_err(&dev->interface->dev,
2243 "Bringing DEP link up failed (error 0x%x)\n", rc);
2247 if (!dev->tgt_available_prots) {
2248 struct nfc_target nfc_target;
2250 dev_dbg(&dev->interface->dev, "Creating new target\n");
2252 nfc_target.supported_protocols = NFC_PROTO_NFC_DEP_MASK;
2253 nfc_target.nfcid1_len = 10;
2254 memcpy(nfc_target.nfcid1, rsp->nfcid3t, nfc_target.nfcid1_len);
2255 rc = nfc_targets_found(dev->nfc_dev, &nfc_target, 1);
2259 dev->tgt_available_prots = 0;
2262 dev->tgt_active_prot = NFC_PROTO_NFC_DEP;
2264 /* ATR_RES general bytes are located at offset 17 */
2265 target_gt_len = resp->len - 17;
2266 rc = nfc_set_remote_general_bytes(dev->nfc_dev,
2267 rsp->gt, target_gt_len);
2269 rc = nfc_dep_link_is_up(dev->nfc_dev,
2270 dev->nfc_dev->targets[0].idx,
2271 !active, NFC_RF_INITIATOR);
2274 dev_kfree_skb(resp);
2278 static int pn533_rf_field(struct nfc_dev *nfc_dev, u8 rf);
2279 static int pn533_dep_link_up(struct nfc_dev *nfc_dev, struct nfc_target *target,
2280 u8 comm_mode, u8 *gb, size_t gb_len)
2282 struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2283 struct sk_buff *skb;
2285 u8 *next, *arg, nfcid3[NFC_NFCID3_MAXSIZE];
2286 u8 passive_data[PASSIVE_DATA_LEN] = {0x00, 0xff, 0xff, 0x00, 0x3};
2288 dev_dbg(&dev->interface->dev, "%s\n", __func__);
2290 if (dev->poll_mod_count) {
2291 nfc_err(&dev->interface->dev,
2292 "Cannot bring the DEP link up while polling\n");
2296 if (dev->tgt_active_prot) {
2297 nfc_err(&dev->interface->dev,
2298 "There is already an active target\n");
2302 skb_len = 3 + gb_len; /* ActPass + BR + Next */
2303 skb_len += PASSIVE_DATA_LEN;
2306 skb_len += NFC_NFCID3_MAXSIZE;
2307 if (target && !target->nfcid2_len) {
2310 get_random_bytes(nfcid3 + 2, 6);
2313 skb = pn533_alloc_skb(dev, skb_len);
2317 *skb_put(skb, 1) = !comm_mode; /* ActPass */
2318 *skb_put(skb, 1) = 0x02; /* 424 kbps */
2320 next = skb_put(skb, 1); /* Next */
2323 /* Copy passive data */
2324 memcpy(skb_put(skb, PASSIVE_DATA_LEN), passive_data, PASSIVE_DATA_LEN);
2327 /* Copy NFCID3 (which is NFCID2 from SENSF_RES) */
2328 if (target && target->nfcid2_len)
2329 memcpy(skb_put(skb, NFC_NFCID3_MAXSIZE), target->nfcid2,
2330 target->nfcid2_len);
2332 memcpy(skb_put(skb, NFC_NFCID3_MAXSIZE), nfcid3,
2333 NFC_NFCID3_MAXSIZE);
2336 if (gb != NULL && gb_len > 0) {
2337 memcpy(skb_put(skb, gb_len), gb, gb_len);
2338 *next |= 4; /* We have some Gi */
2343 arg = kmalloc(sizeof(*arg), GFP_KERNEL);
2351 pn533_rf_field(dev->nfc_dev, 0);
2353 rc = pn533_send_cmd_async(dev, PN533_CMD_IN_JUMP_FOR_DEP, skb,
2354 pn533_in_dep_link_up_complete, arg);
2364 static int pn533_dep_link_down(struct nfc_dev *nfc_dev)
2366 struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2368 dev_dbg(&dev->interface->dev, "%s\n", __func__);
2370 pn533_poll_reset_mod_list(dev);
2372 if (dev->tgt_mode || dev->tgt_active_prot)
2373 pn533_abort_cmd(dev, GFP_KERNEL);
2375 dev->tgt_active_prot = 0;
2378 skb_queue_purge(&dev->resp_q);
2383 struct pn533_data_exchange_arg {
2384 data_exchange_cb_t cb;
2388 static struct sk_buff *pn533_build_response(struct pn533 *dev)
2390 struct sk_buff *skb, *tmp, *t;
2391 unsigned int skb_len = 0, tmp_len = 0;
2393 dev_dbg(&dev->interface->dev, "%s\n", __func__);
2395 if (skb_queue_empty(&dev->resp_q))
2398 if (skb_queue_len(&dev->resp_q) == 1) {
2399 skb = skb_dequeue(&dev->resp_q);
2403 skb_queue_walk_safe(&dev->resp_q, tmp, t)
2404 skb_len += tmp->len;
2406 dev_dbg(&dev->interface->dev, "%s total length %d\n",
2409 skb = alloc_skb(skb_len, GFP_KERNEL);
2413 skb_put(skb, skb_len);
2415 skb_queue_walk_safe(&dev->resp_q, tmp, t) {
2416 memcpy(skb->data + tmp_len, tmp->data, tmp->len);
2417 tmp_len += tmp->len;
2421 skb_queue_purge(&dev->resp_q);
2426 static int pn533_data_exchange_complete(struct pn533 *dev, void *_arg,
2427 struct sk_buff *resp)
2429 struct pn533_data_exchange_arg *arg = _arg;
2430 struct sk_buff *skb;
2434 dev_dbg(&dev->interface->dev, "%s\n", __func__);
2441 status = resp->data[0];
2442 ret = status & PN533_CMD_RET_MASK;
2443 mi = status & PN533_CMD_MI_MASK;
2445 skb_pull(resp, sizeof(status));
2447 if (ret != PN533_CMD_RET_SUCCESS) {
2448 nfc_err(&dev->interface->dev,
2449 "Exchanging data failed (error 0x%x)\n", ret);
2454 skb_queue_tail(&dev->resp_q, resp);
2457 dev->cmd_complete_mi_arg = arg;
2458 queue_work(dev->wq, &dev->mi_rx_work);
2459 return -EINPROGRESS;
2462 /* Prepare for the next round */
2463 if (skb_queue_len(&dev->fragment_skb) > 0) {
2464 dev->cmd_complete_dep_arg = arg;
2465 queue_work(dev->wq, &dev->mi_tx_work);
2467 return -EINPROGRESS;
2470 skb = pn533_build_response(dev);
2474 arg->cb(arg->cb_context, skb, 0);
2479 dev_kfree_skb(resp);
2481 skb_queue_purge(&dev->resp_q);
2482 arg->cb(arg->cb_context, NULL, rc);
2487 /* Split the Tx skb into small chunks */
2488 static int pn533_fill_fragment_skbs(struct pn533 *dev, struct sk_buff *skb)
2490 struct sk_buff *frag;
2494 /* Remaining size */
2495 if (skb->len > PN533_CMD_DATAFRAME_MAXLEN)
2496 frag_size = PN533_CMD_DATAFRAME_MAXLEN;
2498 frag_size = skb->len;
2500 /* Allocate and reserve */
2501 frag = pn533_alloc_skb(dev, frag_size);
2503 skb_queue_purge(&dev->fragment_skb);
2507 /* Reserve the TG/MI byte */
2508 skb_reserve(frag, 1);
2511 if (frag_size == PN533_CMD_DATAFRAME_MAXLEN)
2512 *skb_push(frag, sizeof(u8)) = (PN533_CMD_MI_MASK | 1);
2514 *skb_push(frag, sizeof(u8)) = 1; /* TG */
2516 memcpy(skb_put(frag, frag_size), skb->data, frag_size);
2518 /* Reduce the size of incoming buffer */
2519 skb_pull(skb, frag_size);
2521 /* Add this to skb_queue */
2522 skb_queue_tail(&dev->fragment_skb, frag);
2524 } while (skb->len > 0);
2528 return skb_queue_len(&dev->fragment_skb);
2531 static int pn533_transceive(struct nfc_dev *nfc_dev,
2532 struct nfc_target *target, struct sk_buff *skb,
2533 data_exchange_cb_t cb, void *cb_context)
2535 struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2536 struct pn533_data_exchange_arg *arg = NULL;
2539 dev_dbg(&dev->interface->dev, "%s\n", __func__);
2541 if (!dev->tgt_active_prot) {
2542 nfc_err(&dev->interface->dev,
2543 "Can't exchange data if there is no active target\n");
2548 arg = kmalloc(sizeof(*arg), GFP_KERNEL);
2555 arg->cb_context = cb_context;
2557 switch (dev->device_type) {
2558 case PN533_DEVICE_PASORI:
2559 if (dev->tgt_active_prot == NFC_PROTO_FELICA) {
2560 rc = pn533_send_data_async(dev, PN533_CMD_IN_COMM_THRU,
2562 pn533_data_exchange_complete,
2569 if (skb->len > PN533_CMD_DATAEXCH_DATA_MAXLEN) {
2570 rc = pn533_fill_fragment_skbs(dev, skb);
2574 skb = skb_dequeue(&dev->fragment_skb);
2580 *skb_push(skb, sizeof(u8)) = 1; /* TG */
2583 rc = pn533_send_data_async(dev, PN533_CMD_IN_DATA_EXCHANGE,
2584 skb, pn533_data_exchange_complete,
2590 if (rc < 0) /* rc from send_async */
2601 static int pn533_tm_send_complete(struct pn533 *dev, void *arg,
2602 struct sk_buff *resp)
2606 dev_dbg(&dev->interface->dev, "%s\n", __func__);
2609 return PTR_ERR(resp);
2611 status = resp->data[0];
2613 dev_kfree_skb(resp);
2616 nfc_tm_deactivated(dev->nfc_dev);
2623 queue_work(dev->wq, &dev->tg_work);
2628 static int pn533_tm_send(struct nfc_dev *nfc_dev, struct sk_buff *skb)
2630 struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2633 dev_dbg(&dev->interface->dev, "%s\n", __func__);
2635 if (skb->len > PN533_CMD_DATAEXCH_DATA_MAXLEN) {
2636 nfc_err(&dev->interface->dev,
2637 "Data length greater than the max allowed: %d\n",
2638 PN533_CMD_DATAEXCH_DATA_MAXLEN);
2642 rc = pn533_send_data_async(dev, PN533_CMD_TG_SET_DATA, skb,
2643 pn533_tm_send_complete, NULL);
2650 static void pn533_wq_mi_recv(struct work_struct *work)
2652 struct pn533 *dev = container_of(work, struct pn533, mi_rx_work);
2653 struct sk_buff *skb;
2656 dev_dbg(&dev->interface->dev, "%s\n", __func__);
2658 skb = pn533_alloc_skb(dev, PN533_CMD_DATAEXCH_HEAD_LEN);
2662 switch (dev->device_type) {
2663 case PN533_DEVICE_PASORI:
2664 if (dev->tgt_active_prot == NFC_PROTO_FELICA) {
2665 rc = pn533_send_cmd_direct_async(dev,
2666 PN533_CMD_IN_COMM_THRU,
2668 pn533_data_exchange_complete,
2669 dev->cmd_complete_mi_arg);
2674 *skb_put(skb, sizeof(u8)) = 1; /*TG*/
2676 rc = pn533_send_cmd_direct_async(dev,
2677 PN533_CMD_IN_DATA_EXCHANGE,
2679 pn533_data_exchange_complete,
2680 dev->cmd_complete_mi_arg);
2685 if (rc == 0) /* success */
2688 nfc_err(&dev->interface->dev,
2689 "Error %d when trying to perform data_exchange\n", rc);
2692 kfree(dev->cmd_complete_mi_arg);
2695 pn533_send_ack(dev, GFP_KERNEL);
2696 queue_work(dev->wq, &dev->cmd_work);
2699 static void pn533_wq_mi_send(struct work_struct *work)
2701 struct pn533 *dev = container_of(work, struct pn533, mi_tx_work);
2702 struct sk_buff *skb;
2705 dev_dbg(&dev->interface->dev, "%s\n", __func__);
2707 /* Grab the first skb in the queue */
2708 skb = skb_dequeue(&dev->fragment_skb);
2710 if (skb == NULL) { /* No more data */
2711 /* Reset the queue for future use */
2712 skb_queue_head_init(&dev->fragment_skb);
2716 switch (dev->device_type) {
2717 case PN533_DEVICE_PASORI:
2718 if (dev->tgt_active_prot != NFC_PROTO_FELICA) {
2723 rc = pn533_send_cmd_direct_async(dev, PN533_CMD_IN_COMM_THRU,
2725 pn533_data_exchange_complete,
2726 dev->cmd_complete_dep_arg);
2731 /* Still some fragments? */
2732 rc = pn533_send_cmd_direct_async(dev,PN533_CMD_IN_DATA_EXCHANGE,
2734 pn533_data_exchange_complete,
2735 dev->cmd_complete_dep_arg);
2740 if (rc == 0) /* success */
2743 nfc_err(&dev->interface->dev,
2744 "Error %d when trying to perform data_exchange\n", rc);
2747 kfree(dev->cmd_complete_dep_arg);
2750 pn533_send_ack(dev, GFP_KERNEL);
2751 queue_work(dev->wq, &dev->cmd_work);
2754 static int pn533_set_configuration(struct pn533 *dev, u8 cfgitem, u8 *cfgdata,
2757 struct sk_buff *skb;
2758 struct sk_buff *resp;
2761 dev_dbg(&dev->interface->dev, "%s\n", __func__);
2763 skb_len = sizeof(cfgitem) + cfgdata_len; /* cfgitem + cfgdata */
2765 skb = pn533_alloc_skb(dev, skb_len);
2769 *skb_put(skb, sizeof(cfgitem)) = cfgitem;
2770 memcpy(skb_put(skb, cfgdata_len), cfgdata, cfgdata_len);
2772 resp = pn533_send_cmd_sync(dev, PN533_CMD_RF_CONFIGURATION, skb);
2774 return PTR_ERR(resp);
2776 dev_kfree_skb(resp);
2780 static int pn533_get_firmware_version(struct pn533 *dev,
2781 struct pn533_fw_version *fv)
2783 struct sk_buff *skb;
2784 struct sk_buff *resp;
2786 skb = pn533_alloc_skb(dev, 0);
2790 resp = pn533_send_cmd_sync(dev, PN533_CMD_GET_FIRMWARE_VERSION, skb);
2792 return PTR_ERR(resp);
2794 fv->ic = resp->data[0];
2795 fv->ver = resp->data[1];
2796 fv->rev = resp->data[2];
2797 fv->support = resp->data[3];
2799 dev_kfree_skb(resp);
2803 static int pn533_pasori_fw_reset(struct pn533 *dev)
2805 struct sk_buff *skb;
2806 struct sk_buff *resp;
2808 dev_dbg(&dev->interface->dev, "%s\n", __func__);
2810 skb = pn533_alloc_skb(dev, sizeof(u8));
2814 *skb_put(skb, sizeof(u8)) = 0x1;
2816 resp = pn533_send_cmd_sync(dev, 0x18, skb);
2818 return PTR_ERR(resp);
2820 dev_kfree_skb(resp);
2825 struct pn533_acr122_poweron_rdr_arg {
2827 struct completion done;
2830 static void pn533_acr122_poweron_rdr_resp(struct urb *urb)
2832 struct pn533_acr122_poweron_rdr_arg *arg = urb->context;
2834 dev_dbg(&urb->dev->dev, "%s\n", __func__);
2836 print_hex_dump_debug("ACR122 RX: ", DUMP_PREFIX_NONE, 16, 1,
2837 urb->transfer_buffer, urb->transfer_buffer_length,
2840 arg->rc = urb->status;
2841 complete(&arg->done);
2844 static int pn533_acr122_poweron_rdr(struct pn533 *dev)
2846 /* Power on th reader (CCID cmd) */
2847 u8 cmd[10] = {PN533_ACR122_PC_TO_RDR_ICCPOWERON,
2848 0, 0, 0, 0, 0, 0, 3, 0, 0};
2852 struct pn533_acr122_poweron_rdr_arg arg;
2854 dev_dbg(&dev->interface->dev, "%s\n", __func__);
2856 init_completion(&arg.done);
2857 cntx = dev->in_urb->context; /* backup context */
2859 dev->in_urb->transfer_buffer = buf;
2860 dev->in_urb->transfer_buffer_length = 255;
2861 dev->in_urb->complete = pn533_acr122_poweron_rdr_resp;
2862 dev->in_urb->context = &arg;
2864 dev->out_urb->transfer_buffer = cmd;
2865 dev->out_urb->transfer_buffer_length = sizeof(cmd);
2867 print_hex_dump_debug("ACR122 TX: ", DUMP_PREFIX_NONE, 16, 1,
2868 cmd, sizeof(cmd), false);
2870 rc = usb_submit_urb(dev->out_urb, GFP_KERNEL);
2872 nfc_err(&dev->interface->dev,
2873 "Reader power on cmd error %d\n", rc);
2877 rc = usb_submit_urb(dev->in_urb, GFP_KERNEL);
2879 nfc_err(&dev->interface->dev,
2880 "Can't submit reader poweron cmd response %d\n", rc);
2884 wait_for_completion(&arg.done);
2885 dev->in_urb->context = cntx; /* restore context */
2890 static int pn533_rf_field(struct nfc_dev *nfc_dev, u8 rf)
2892 struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2896 rf_field |= PN533_CFGITEM_RF_FIELD_AUTO_RFCA;
2898 rc = pn533_set_configuration(dev, PN533_CFGITEM_RF_FIELD,
2899 (u8 *)&rf_field, 1);
2901 nfc_err(&dev->interface->dev, "Error on setting RF field\n");
2908 int pn533_dev_up(struct nfc_dev *nfc_dev)
2910 return pn533_rf_field(nfc_dev, 1);
2913 int pn533_dev_down(struct nfc_dev *nfc_dev)
2915 return pn533_rf_field(nfc_dev, 0);
2918 static struct nfc_ops pn533_nfc_ops = {
2919 .dev_up = pn533_dev_up,
2920 .dev_down = pn533_dev_down,
2921 .dep_link_up = pn533_dep_link_up,
2922 .dep_link_down = pn533_dep_link_down,
2923 .start_poll = pn533_start_poll,
2924 .stop_poll = pn533_stop_poll,
2925 .activate_target = pn533_activate_target,
2926 .deactivate_target = pn533_deactivate_target,
2927 .im_transceive = pn533_transceive,
2928 .tm_send = pn533_tm_send,
2931 static int pn533_setup(struct pn533 *dev)
2933 struct pn533_config_max_retries max_retries;
2934 struct pn533_config_timing timing;
2935 u8 pasori_cfg[3] = {0x08, 0x01, 0x08};
2938 switch (dev->device_type) {
2939 case PN533_DEVICE_STD:
2940 case PN533_DEVICE_PASORI:
2941 case PN533_DEVICE_ACR122U:
2942 max_retries.mx_rty_atr = 0x2;
2943 max_retries.mx_rty_psl = 0x1;
2944 max_retries.mx_rty_passive_act =
2945 PN533_CONFIG_MAX_RETRIES_NO_RETRY;
2947 timing.rfu = PN533_CONFIG_TIMING_102;
2948 timing.atr_res_timeout = PN533_CONFIG_TIMING_102;
2949 timing.dep_timeout = PN533_CONFIG_TIMING_204;
2954 nfc_err(&dev->interface->dev, "Unknown device type %d\n",
2959 rc = pn533_set_configuration(dev, PN533_CFGITEM_MAX_RETRIES,
2960 (u8 *)&max_retries, sizeof(max_retries));
2962 nfc_err(&dev->interface->dev,
2963 "Error on setting MAX_RETRIES config\n");
2968 rc = pn533_set_configuration(dev, PN533_CFGITEM_TIMING,
2969 (u8 *)&timing, sizeof(timing));
2971 nfc_err(&dev->interface->dev, "Error on setting RF timings\n");
2975 switch (dev->device_type) {
2976 case PN533_DEVICE_STD:
2979 case PN533_DEVICE_PASORI:
2980 pn533_pasori_fw_reset(dev);
2982 rc = pn533_set_configuration(dev, PN533_CFGITEM_PASORI,
2985 nfc_err(&dev->interface->dev,
2986 "Error while settings PASORI config\n");
2990 pn533_pasori_fw_reset(dev);
2998 static int pn533_probe(struct usb_interface *interface,
2999 const struct usb_device_id *id)
3001 struct pn533_fw_version fw_ver;
3003 struct usb_host_interface *iface_desc;
3004 struct usb_endpoint_descriptor *endpoint;
3005 int in_endpoint = 0;
3006 int out_endpoint = 0;
3011 dev = kzalloc(sizeof(*dev), GFP_KERNEL);
3015 dev->udev = usb_get_dev(interface_to_usbdev(interface));
3016 dev->interface = interface;
3017 mutex_init(&dev->cmd_lock);
3019 iface_desc = interface->cur_altsetting;
3020 for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
3021 endpoint = &iface_desc->endpoint[i].desc;
3023 if (!in_endpoint && usb_endpoint_is_bulk_in(endpoint))
3024 in_endpoint = endpoint->bEndpointAddress;
3026 if (!out_endpoint && usb_endpoint_is_bulk_out(endpoint))
3027 out_endpoint = endpoint->bEndpointAddress;
3030 if (!in_endpoint || !out_endpoint) {
3031 nfc_err(&interface->dev,
3032 "Could not find bulk-in or bulk-out endpoint\n");
3037 dev->in_urb = usb_alloc_urb(0, GFP_KERNEL);
3038 dev->out_urb = usb_alloc_urb(0, GFP_KERNEL);
3040 if (!dev->in_urb || !dev->out_urb)
3043 usb_fill_bulk_urb(dev->in_urb, dev->udev,
3044 usb_rcvbulkpipe(dev->udev, in_endpoint),
3045 NULL, 0, NULL, dev);
3046 usb_fill_bulk_urb(dev->out_urb, dev->udev,
3047 usb_sndbulkpipe(dev->udev, out_endpoint),
3048 NULL, 0, pn533_send_complete, dev);
3050 INIT_WORK(&dev->cmd_work, pn533_wq_cmd);
3051 INIT_WORK(&dev->cmd_complete_work, pn533_wq_cmd_complete);
3052 INIT_WORK(&dev->mi_rx_work, pn533_wq_mi_recv);
3053 INIT_WORK(&dev->mi_tx_work, pn533_wq_mi_send);
3054 INIT_WORK(&dev->tg_work, pn533_wq_tg_get_data);
3055 INIT_DELAYED_WORK(&dev->poll_work, pn533_wq_poll);
3056 INIT_WORK(&dev->rf_work, pn533_wq_rf);
3057 dev->wq = alloc_ordered_workqueue("pn533", 0);
3058 if (dev->wq == NULL)
3061 init_timer(&dev->listen_timer);
3062 dev->listen_timer.data = (unsigned long) dev;
3063 dev->listen_timer.function = pn533_listen_mode_timer;
3065 skb_queue_head_init(&dev->resp_q);
3066 skb_queue_head_init(&dev->fragment_skb);
3068 INIT_LIST_HEAD(&dev->cmd_queue);
3070 usb_set_intfdata(interface, dev);
3072 dev->ops = &pn533_std_frame_ops;
3074 dev->protocol_type = PN533_PROTO_REQ_ACK_RESP;
3075 dev->device_type = id->driver_info;
3076 switch (dev->device_type) {
3077 case PN533_DEVICE_STD:
3078 protocols = PN533_ALL_PROTOCOLS;
3081 case PN533_DEVICE_PASORI:
3082 protocols = PN533_NO_TYPE_B_PROTOCOLS;
3085 case PN533_DEVICE_ACR122U:
3086 protocols = PN533_NO_TYPE_B_PROTOCOLS;
3087 dev->ops = &pn533_acr122_frame_ops;
3088 dev->protocol_type = PN533_PROTO_REQ_RESP,
3090 rc = pn533_acr122_poweron_rdr(dev);
3092 nfc_err(&dev->interface->dev,
3093 "Couldn't poweron the reader (error %d)\n", rc);
3099 nfc_err(&dev->interface->dev, "Unknown device type %d\n",
3105 memset(&fw_ver, 0, sizeof(fw_ver));
3106 rc = pn533_get_firmware_version(dev, &fw_ver);
3110 nfc_info(&dev->interface->dev,
3111 "NXP PN5%02X firmware ver %d.%d now attached\n",
3112 fw_ver.ic, fw_ver.ver, fw_ver.rev);
3115 dev->nfc_dev = nfc_allocate_device(&pn533_nfc_ops, protocols,
3116 dev->ops->tx_header_len +
3117 PN533_CMD_DATAEXCH_HEAD_LEN,
3118 dev->ops->tx_tail_len);
3119 if (!dev->nfc_dev) {
3124 nfc_set_parent_dev(dev->nfc_dev, &interface->dev);
3125 nfc_set_drvdata(dev->nfc_dev, dev);
3127 rc = nfc_register_device(dev->nfc_dev);
3131 rc = pn533_setup(dev);
3133 goto unregister_nfc_dev;
3138 nfc_unregister_device(dev->nfc_dev);
3141 nfc_free_device(dev->nfc_dev);
3144 destroy_workqueue(dev->wq);
3146 usb_free_urb(dev->in_urb);
3147 usb_free_urb(dev->out_urb);
3148 usb_put_dev(dev->udev);
3153 static void pn533_disconnect(struct usb_interface *interface)
3156 struct pn533_cmd *cmd, *n;
3158 dev = usb_get_intfdata(interface);
3159 usb_set_intfdata(interface, NULL);
3161 nfc_unregister_device(dev->nfc_dev);
3162 nfc_free_device(dev->nfc_dev);
3164 usb_kill_urb(dev->in_urb);
3165 usb_kill_urb(dev->out_urb);
3167 flush_delayed_work(&dev->poll_work);
3168 destroy_workqueue(dev->wq);
3170 skb_queue_purge(&dev->resp_q);
3172 del_timer(&dev->listen_timer);
3174 list_for_each_entry_safe(cmd, n, &dev->cmd_queue, queue) {
3175 list_del(&cmd->queue);
3179 usb_free_urb(dev->in_urb);
3180 usb_free_urb(dev->out_urb);
3183 nfc_info(&interface->dev, "NXP PN533 NFC device disconnected\n");
3186 static struct usb_driver pn533_driver = {
3188 .probe = pn533_probe,
3189 .disconnect = pn533_disconnect,
3190 .id_table = pn533_table,
3193 module_usb_driver(pn533_driver);
3195 MODULE_AUTHOR("Lauro Ramos Venancio <lauro.venancio@openbossa.org>");
3196 MODULE_AUTHOR("Aloisio Almeida Jr <aloisio.almeida@openbossa.org>");
3197 MODULE_AUTHOR("Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>");
3198 MODULE_DESCRIPTION("PN533 usb driver ver " VERSION);
3199 MODULE_VERSION(VERSION);
3200 MODULE_LICENSE("GPL");