drivers/nfc/pn533.c

   1 /*
   2  * Copyright (C) 2011 Instituto Nokia de Tecnologia
   3  * Copyright (C) 2012-2013 Tieto Poland
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License as published by
   7  * the Free Software Foundation; either version 2 of the License, or
   8  * (at your option) any later version.
   9  *
  10  * This program is distributed in the hope that it will be useful,
  11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  13  * GNU General Public License for more details.
  14  *
  15  * You should have received a copy of the GNU General Public License
  16  * along with this program; if not, write to the
  17  * Free Software Foundation, Inc.,
  18  * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
  19  */
  20
  21 #include <linux/device.h>
  22 #include <linux/kernel.h>
  23 #include <linux/module.h>
  24 #include <linux/slab.h>
  25 #include <linux/usb.h>
  26 #include <linux/nfc.h>
  27 #include <linux/netdevice.h>
  28 #include <net/nfc/nfc.h>
  29
  30 #define VERSION "0.2"
  31
  32 #define PN533_VENDOR_ID 0x4CC
  33 #define PN533_PRODUCT_ID 0x2533
  34
  35 #define SCM_VENDOR_ID 0x4E6
  36 #define SCL3711_PRODUCT_ID 0x5591
  37
  38 #define SONY_VENDOR_ID         0x054c
  39 #define PASORI_PRODUCT_ID      0x02e1
  40
  41 #define ACS_VENDOR_ID 0x072f
  42 #define ACR122U_PRODUCT_ID 0x2200
  43
  44 #define PN533_DEVICE_STD     0x1
  45 #define PN533_DEVICE_PASORI  0x2
  46 #define PN533_DEVICE_ACR122U 0x3
  47
  48 #define PN533_ALL_PROTOCOLS (NFC_PROTO_JEWEL_MASK | NFC_PROTO_MIFARE_MASK |\
  49                              NFC_PROTO_FELICA_MASK | NFC_PROTO_ISO14443_MASK |\
  50                              NFC_PROTO_NFC_DEP_MASK |\
  51                              NFC_PROTO_ISO14443_B_MASK)
  52
  53 #define PN533_NO_TYPE_B_PROTOCOLS (NFC_PROTO_JEWEL_MASK | \
  54                                    NFC_PROTO_MIFARE_MASK | \
  55                                    NFC_PROTO_FELICA_MASK | \
  56                                    NFC_PROTO_ISO14443_MASK | \
  57                                    NFC_PROTO_NFC_DEP_MASK)
  58
  59 static const struct usb_device_id pn533_table[] = {
  60         { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE,
  61           .idVendor             = PN533_VENDOR_ID,
  62           .idProduct            = PN533_PRODUCT_ID,
  63           .driver_info          = PN533_DEVICE_STD,
  64         },
  65         { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE,
  66           .idVendor             = SCM_VENDOR_ID,
  67           .idProduct            = SCL3711_PRODUCT_ID,
  68           .driver_info          = PN533_DEVICE_STD,
  69         },
  70         { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE,
  71           .idVendor             = SONY_VENDOR_ID,
  72           .idProduct            = PASORI_PRODUCT_ID,
  73           .driver_info          = PN533_DEVICE_PASORI,
  74         },
  75         { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE,
  76           .idVendor             = ACS_VENDOR_ID,
  77           .idProduct            = ACR122U_PRODUCT_ID,
  78           .driver_info          = PN533_DEVICE_ACR122U,
  79         },
  80         { }
  81 };
  82 MODULE_DEVICE_TABLE(usb, pn533_table);
  83
  84 /* How much time we spend listening for initiators */
  85 #define PN533_LISTEN_TIME 2
  86
  87 /* Standard pn533 frame definitions */
  88 #define PN533_STD_FRAME_HEADER_LEN (sizeof(struct pn533_std_frame) \
  89                                         + 2) /* data[0] TFI, data[1] CC */
  90 #define PN533_STD_FRAME_TAIL_LEN 2 /* data[len] DCS, data[len + 1] postamble*/
  91
  92 /*
  93  * Max extended frame payload len, excluding TFI and CC
  94  * which are already in PN533_FRAME_HEADER_LEN.
  95  */
  96 #define PN533_STD_FRAME_MAX_PAYLOAD_LEN 263
  97
  98 #define PN533_STD_FRAME_ACK_SIZE 6 /* Preamble (1), SoPC (2), ACK Code (2),
  99                                   Postamble (1) */
 100 #define PN533_STD_FRAME_CHECKSUM(f) (f->data[f->datalen])
 101 #define PN533_STD_FRAME_POSTAMBLE(f) (f->data[f->datalen + 1])
 102
 103 /* start of frame */
 104 #define PN533_STD_FRAME_SOF 0x00FF
 105
 106 /* standard frame identifier: in/out/error */
 107 #define PN533_STD_FRAME_IDENTIFIER(f) (f->data[0]) /* TFI */
 108 #define PN533_STD_FRAME_DIR_OUT 0xD4
 109 #define PN533_STD_FRAME_DIR_IN 0xD5
 110
 111 /* ACS ACR122 pn533 frame definitions */
 112 #define PN533_ACR122_TX_FRAME_HEADER_LEN (sizeof(struct pn533_acr122_tx_frame) \
 113                                           + 2)
 114 #define PN533_ACR122_TX_FRAME_TAIL_LEN 0
 115 #define PN533_ACR122_RX_FRAME_HEADER_LEN (sizeof(struct pn533_acr122_rx_frame) \
 116                                           + 2)
 117 #define PN533_ACR122_RX_FRAME_TAIL_LEN 2
 118 #define PN533_ACR122_FRAME_MAX_PAYLOAD_LEN PN533_STD_FRAME_MAX_PAYLOAD_LEN
 119
 120 /* CCID messages types */
 121 #define PN533_ACR122_PC_TO_RDR_ICCPOWERON 0x62
 122 #define PN533_ACR122_PC_TO_RDR_ESCAPE 0x6B
 123
 124 #define PN533_ACR122_RDR_TO_PC_ESCAPE 0x83
 125
 126 /* PN533 Commands */
 127 #define PN533_STD_FRAME_CMD(f) (f->data[1])
 128
 129 #define PN533_CMD_GET_FIRMWARE_VERSION 0x02
 130 #define PN533_CMD_RF_CONFIGURATION 0x32
 131 #define PN533_CMD_IN_DATA_EXCHANGE 0x40
 132 #define PN533_CMD_IN_COMM_THRU     0x42
 133 #define PN533_CMD_IN_LIST_PASSIVE_TARGET 0x4A
 134 #define PN533_CMD_IN_ATR 0x50
 135 #define PN533_CMD_IN_RELEASE 0x52
 136 #define PN533_CMD_IN_JUMP_FOR_DEP 0x56
 137
 138 #define PN533_CMD_TG_INIT_AS_TARGET 0x8c
 139 #define PN533_CMD_TG_GET_DATA 0x86
 140 #define PN533_CMD_TG_SET_DATA 0x8e
 141 #define PN533_CMD_UNDEF 0xff
 142
 143 #define PN533_CMD_RESPONSE(cmd) (cmd + 1)
 144
 145 /* PN533 Return codes */
 146 #define PN533_CMD_RET_MASK 0x3F
 147 #define PN533_CMD_MI_MASK 0x40
 148 #define PN533_CMD_RET_SUCCESS 0x00
 149
 150 struct pn533;
 151
 152 typedef int (*pn533_send_async_complete_t) (struct pn533 *dev, void *arg,
 153                                         struct sk_buff *resp);
 154
 155 /* structs for pn533 commands */
 156
 157 /* PN533_CMD_GET_FIRMWARE_VERSION */
 158 struct pn533_fw_version {
 159         u8 ic;
 160         u8 ver;
 161         u8 rev;
 162         u8 support;
 163 };
 164
 165 /* PN533_CMD_RF_CONFIGURATION */
 166 #define PN533_CFGITEM_RF_FIELD    0x01
 167 #define PN533_CFGITEM_TIMING      0x02
 168 #define PN533_CFGITEM_MAX_RETRIES 0x05
 169 #define PN533_CFGITEM_PASORI      0x82
 170
 171 #define PN533_CFGITEM_RF_FIELD_AUTO_RFCA 0x2
 172 #define PN533_CFGITEM_RF_FIELD_ON        0x1
 173 #define PN533_CFGITEM_RF_FIELD_OFF       0x0
 174
 175 #define PN533_CONFIG_TIMING_102 0xb
 176 #define PN533_CONFIG_TIMING_204 0xc
 177 #define PN533_CONFIG_TIMING_409 0xd
 178 #define PN533_CONFIG_TIMING_819 0xe
 179
 180 #define PN533_CONFIG_MAX_RETRIES_NO_RETRY 0x00
 181 #define PN533_CONFIG_MAX_RETRIES_ENDLESS 0xFF
 182
 183 struct pn533_config_max_retries {
 184         u8 mx_rty_atr;
 185         u8 mx_rty_psl;
 186         u8 mx_rty_passive_act;
 187 } __packed;
 188
 189 struct pn533_config_timing {
 190         u8 rfu;
 191         u8 atr_res_timeout;
 192         u8 dep_timeout;
 193 } __packed;
 194
 195 /* PN533_CMD_IN_LIST_PASSIVE_TARGET */
 196
 197 /* felica commands opcode */
 198 #define PN533_FELICA_OPC_SENSF_REQ 0
 199 #define PN533_FELICA_OPC_SENSF_RES 1
 200 /* felica SENSF_REQ parameters */
 201 #define PN533_FELICA_SENSF_SC_ALL 0xFFFF
 202 #define PN533_FELICA_SENSF_RC_NO_SYSTEM_CODE 0
 203 #define PN533_FELICA_SENSF_RC_SYSTEM_CODE 1
 204 #define PN533_FELICA_SENSF_RC_ADVANCED_PROTOCOL 2
 205
 206 /* type B initiator_data values */
 207 #define PN533_TYPE_B_AFI_ALL_FAMILIES 0
 208 #define PN533_TYPE_B_POLL_METHOD_TIMESLOT 0
 209 #define PN533_TYPE_B_POLL_METHOD_PROBABILISTIC 1
 210
 211 union pn533_cmd_poll_initdata {
 212         struct {
 213                 u8 afi;
 214                 u8 polling_method;
 215         } __packed type_b;
 216         struct {
 217                 u8 opcode;
 218                 __be16 sc;
 219                 u8 rc;
 220                 u8 tsn;
 221         } __packed felica;
 222 };
 223
 224 /* Poll modulations */
 225 enum {
 226         PN533_POLL_MOD_106KBPS_A,
 227         PN533_POLL_MOD_212KBPS_FELICA,
 228         PN533_POLL_MOD_424KBPS_FELICA,
 229         PN533_POLL_MOD_106KBPS_JEWEL,
 230         PN533_POLL_MOD_847KBPS_B,
 231         PN533_LISTEN_MOD,
 232
 233         __PN533_POLL_MOD_AFTER_LAST,
 234 };
 235 #define PN533_POLL_MOD_MAX (__PN533_POLL_MOD_AFTER_LAST - 1)
 236
 237 struct pn533_poll_modulations {
 238         struct {
 239                 u8 maxtg;
 240                 u8 brty;
 241                 union pn533_cmd_poll_initdata initiator_data;
 242         } __packed data;
 243         u8 len;
 244 };
 245
 246 static const struct pn533_poll_modulations poll_mod[] = {
 247         [PN533_POLL_MOD_106KBPS_A] = {
 248                 .data = {
 249                         .maxtg = 1,
 250                         .brty = 0,
 251                 },
 252                 .len = 2,
 253         },
 254         [PN533_POLL_MOD_212KBPS_FELICA] = {
 255                 .data = {
 256                         .maxtg = 1,
 257                         .brty = 1,
 258                         .initiator_data.felica = {
 259                                 .opcode = PN533_FELICA_OPC_SENSF_REQ,
 260                                 .sc = PN533_FELICA_SENSF_SC_ALL,
 261                                 .rc = PN533_FELICA_SENSF_RC_SYSTEM_CODE,
 262                                 .tsn = 0x03,
 263                         },
 264                 },
 265                 .len = 7,
 266         },
 267         [PN533_POLL_MOD_424KBPS_FELICA] = {
 268                 .data = {
 269                         .maxtg = 1,
 270                         .brty = 2,
 271                         .initiator_data.felica = {
 272                                 .opcode = PN533_FELICA_OPC_SENSF_REQ,
 273                                 .sc = PN533_FELICA_SENSF_SC_ALL,
 274                                 .rc = PN533_FELICA_SENSF_RC_SYSTEM_CODE,
 275                                 .tsn = 0x03,
 276                         },
 277                  },
 278                 .len = 7,
 279         },
 280         [PN533_POLL_MOD_106KBPS_JEWEL] = {
 281                 .data = {
 282                         .maxtg = 1,
 283                         .brty = 4,
 284                 },
 285                 .len = 2,
 286         },
 287         [PN533_POLL_MOD_847KBPS_B] = {
 288                 .data = {
 289                         .maxtg = 1,
 290                         .brty = 8,
 291                         .initiator_data.type_b = {
 292                                 .afi = PN533_TYPE_B_AFI_ALL_FAMILIES,
 293                                 .polling_method =
 294                                         PN533_TYPE_B_POLL_METHOD_TIMESLOT,
 295                         },
 296                 },
 297                 .len = 3,
 298         },
 299         [PN533_LISTEN_MOD] = {
 300                 .len = 0,
 301         },
 302 };
 303
 304 /* PN533_CMD_IN_ATR */
 305
 306 struct pn533_cmd_activate_response {
 307         u8 status;
 308         u8 nfcid3t[10];
 309         u8 didt;
 310         u8 bst;
 311         u8 brt;
 312         u8 to;
 313         u8 ppt;
 314         /* optional */
 315         u8 gt[];
 316 } __packed;
 317
 318 struct pn533_cmd_jump_dep_response {
 319         u8 status;
 320         u8 tg;
 321         u8 nfcid3t[10];
 322         u8 didt;
 323         u8 bst;
 324         u8 brt;
 325         u8 to;
 326         u8 ppt;
 327         /* optional */
 328         u8 gt[];
 329 } __packed;
 330
 331
 332 /* PN533_TG_INIT_AS_TARGET */
 333 #define PN533_INIT_TARGET_PASSIVE 0x1
 334 #define PN533_INIT_TARGET_DEP 0x2
 335
 336 #define PN533_INIT_TARGET_RESP_FRAME_MASK 0x3
 337 #define PN533_INIT_TARGET_RESP_ACTIVE     0x1
 338 #define PN533_INIT_TARGET_RESP_DEP        0x4
 339
 340 enum  pn533_protocol_type {
 341         PN533_PROTO_REQ_ACK_RESP = 0,
 342         PN533_PROTO_REQ_RESP
 343 };
 344
 345 struct pn533 {
 346         struct usb_device *udev;
 347         struct usb_interface *interface;
 348         struct nfc_dev *nfc_dev;
 349         u32 device_type;
 350         enum pn533_protocol_type protocol_type;
 351
 352         struct urb *out_urb;
 353         struct urb *in_urb;
 354
 355         struct sk_buff_head resp_q;
 356
 357         struct workqueue_struct *wq;
 358         struct work_struct cmd_work;
 359         struct work_struct cmd_complete_work;
 360         struct work_struct poll_work;
 361         struct work_struct mi_work;
 362         struct work_struct tg_work;
 363         struct work_struct rf_work;
 364
 365         struct list_head cmd_queue;
 366         struct pn533_cmd *cmd;
 367         u8 cmd_pending;
 368         struct mutex cmd_lock;  /* protects cmd queue */
 369
 370         void *cmd_complete_mi_arg;
 371
 372         struct pn533_poll_modulations *poll_mod_active[PN533_POLL_MOD_MAX + 1];
 373         u8 poll_mod_count;
 374         u8 poll_mod_curr;
 375         u32 poll_protocols;
 376         u32 listen_protocols;
 377         struct timer_list listen_timer;
 378         int cancel_listen;
 379
 380         u8 *gb;
 381         size_t gb_len;
 382
 383         u8 tgt_available_prots;
 384         u8 tgt_active_prot;
 385         u8 tgt_mode;
 386
 387         struct pn533_frame_ops *ops;
 388 };
 389
 390 struct pn533_cmd {
 391         struct list_head queue;
 392         u8 code;
 393         int status;
 394         struct sk_buff *req;
 395         struct sk_buff *resp;
 396         int resp_len;
 397         pn533_send_async_complete_t  complete_cb;
 398         void *complete_cb_context;
 399 };
 400
 401 struct pn533_std_frame {
 402         u8 preamble;
 403         __be16 start_frame;
 404         u8 datalen;
 405         u8 datalen_checksum;
 406         u8 data[];
 407 } __packed;
 408
 409 struct pn533_frame_ops {
 410         void (*tx_frame_init)(void *frame, u8 cmd_code);
 411         void (*tx_frame_finish)(void *frame);
 412         void (*tx_update_payload_len)(void *frame, int len);
 413         int tx_header_len;
 414         int tx_tail_len;
 415
 416         bool (*rx_is_frame_valid)(void *frame);
 417         int (*rx_frame_size)(void *frame);
 418         int rx_header_len;
 419         int rx_tail_len;
 420
 421         int max_payload_len;
 422         u8 (*get_cmd_code)(void *frame);
 423 };
 424
 425 struct pn533_acr122_ccid_hdr {
 426         u8 type;
 427         u32 datalen;
 428         u8 slot;
 429         u8 seq;
 430         u8 params[3]; /* 3 msg specific bytes or status, error and 1 specific
 431                          byte for reposnse msg */
 432         u8 data[]; /* payload */
 433 } __packed;
 434
 435 struct pn533_acr122_apdu_hdr {
 436         u8 class;
 437         u8 ins;
 438         u8 p1;
 439         u8 p2;
 440 } __packed;
 441
 442 struct pn533_acr122_tx_frame {
 443         struct pn533_acr122_ccid_hdr ccid;
 444         struct pn533_acr122_apdu_hdr apdu;
 445         u8 datalen;
 446         u8 data[]; /* pn533 frame: TFI ... */
 447 } __packed;
 448
 449 struct pn533_acr122_rx_frame {
 450         struct pn533_acr122_ccid_hdr ccid;
 451         u8 data[]; /* pn533 frame : TFI ... */
 452 } __packed;
 453
 454 static void pn533_acr122_tx_frame_init(void *_frame, u8 cmd_code)
 455 {
 456         struct pn533_acr122_tx_frame *frame = _frame;
 457
 458         frame->ccid.type = PN533_ACR122_PC_TO_RDR_ESCAPE;
 459         frame->ccid.datalen = sizeof(frame->apdu) + 1; /* sizeof(apdu_hdr) +
 460                                                           sizeof(datalen) */
 461         frame->ccid.slot = 0;
 462         frame->ccid.seq = 0;
 463         frame->ccid.params[0] = 0;
 464         frame->ccid.params[1] = 0;
 465         frame->ccid.params[2] = 0;
 466
 467         frame->data[0] = PN533_STD_FRAME_DIR_OUT;
 468         frame->data[1] = cmd_code;
 469         frame->datalen = 2;  /* data[0] + data[1] */
 470
 471         frame->apdu.class = 0xFF;
 472         frame->apdu.ins = 0;
 473         frame->apdu.p1 = 0;
 474         frame->apdu.p2 = 0;
 475 }
 476
 477 static void pn533_acr122_tx_frame_finish(void *_frame)
 478 {
 479         struct pn533_acr122_tx_frame *frame = _frame;
 480
 481         frame->ccid.datalen += frame->datalen;
 482 }
 483
 484 static void pn533_acr122_tx_update_payload_len(void *_frame, int len)
 485 {
 486         struct pn533_acr122_tx_frame *frame = _frame;
 487
 488         frame->datalen += len;
 489 }
 490
 491 static bool pn533_acr122_is_rx_frame_valid(void *_frame)
 492 {
 493         struct pn533_acr122_rx_frame *frame = _frame;
 494
 495         if (frame->ccid.type != 0x83)
 496                 return false;
 497
 498         if (frame->data[frame->ccid.datalen - 2] == 0x63)
 499                 return false;
 500
 501         return true;
 502 }
 503
 504 static int pn533_acr122_rx_frame_size(void *frame)
 505 {
 506         struct pn533_acr122_rx_frame *f = frame;
 507
 508         /* f->ccid.datalen already includes tail length */
 509         return sizeof(struct pn533_acr122_rx_frame) + f->ccid.datalen;
 510 }
 511
 512 static u8 pn533_acr122_get_cmd_code(void *frame)
 513 {
 514         struct pn533_acr122_rx_frame *f = frame;
 515
 516         return PN533_STD_FRAME_CMD(f);
 517 }
 518
 519 static struct pn533_frame_ops pn533_acr122_frame_ops = {
 520         .tx_frame_init = pn533_acr122_tx_frame_init,
 521         .tx_frame_finish = pn533_acr122_tx_frame_finish,
 522         .tx_update_payload_len = pn533_acr122_tx_update_payload_len,
 523         .tx_header_len = PN533_ACR122_TX_FRAME_HEADER_LEN,
 524         .tx_tail_len = PN533_ACR122_TX_FRAME_TAIL_LEN,
 525
 526         .rx_is_frame_valid = pn533_acr122_is_rx_frame_valid,
 527         .rx_header_len = PN533_ACR122_RX_FRAME_HEADER_LEN,
 528         .rx_tail_len = PN533_ACR122_RX_FRAME_TAIL_LEN,
 529         .rx_frame_size = pn533_acr122_rx_frame_size,
 530
 531         .max_payload_len = PN533_ACR122_FRAME_MAX_PAYLOAD_LEN,
 532         .get_cmd_code = pn533_acr122_get_cmd_code,
 533 };
 534
 535 /* The rule: value + checksum = 0 */
 536 static inline u8 pn533_std_checksum(u8 value)
 537 {
 538         return ~value + 1;
 539 }
 540
 541 /* The rule: sum(data elements) + checksum = 0 */
 542 static u8 pn533_std_data_checksum(u8 *data, int datalen)
 543 {
 544         u8 sum = 0;
 545         int i;
 546
 547         for (i = 0; i < datalen; i++)
 548                 sum += data[i];
 549
 550         return pn533_std_checksum(sum);
 551 }
 552
 553 static void pn533_std_tx_frame_init(void *_frame, u8 cmd_code)
 554 {
 555         struct pn533_std_frame *frame = _frame;
 556
 557         frame->preamble = 0;
 558         frame->start_frame = cpu_to_be16(PN533_STD_FRAME_SOF);
 559         PN533_STD_FRAME_IDENTIFIER(frame) = PN533_STD_FRAME_DIR_OUT;
 560         PN533_STD_FRAME_CMD(frame) = cmd_code;
 561         frame->datalen = 2;
 562 }
 563
 564 static void pn533_std_tx_frame_finish(void *_frame)
 565 {
 566         struct pn533_std_frame *frame = _frame;
 567
 568         frame->datalen_checksum = pn533_std_checksum(frame->datalen);
 569
 570         PN533_STD_FRAME_CHECKSUM(frame) =
 571                 pn533_std_data_checksum(frame->data, frame->datalen);
 572
 573         PN533_STD_FRAME_POSTAMBLE(frame) = 0;
 574 }
 575
 576 static void pn533_std_tx_update_payload_len(void *_frame, int len)
 577 {
 578         struct pn533_std_frame *frame = _frame;
 579
 580         frame->datalen += len;
 581 }
 582
 583 static bool pn533_std_rx_frame_is_valid(void *_frame)
 584 {
 585         u8 checksum;
 586         struct pn533_std_frame *frame = _frame;
 587
 588         if (frame->start_frame != cpu_to_be16(PN533_STD_FRAME_SOF))
 589                 return false;
 590
 591         checksum = pn533_std_checksum(frame->datalen);
 592         if (checksum != frame->datalen_checksum)
 593                 return false;
 594
 595         checksum = pn533_std_data_checksum(frame->data, frame->datalen);
 596         if (checksum != PN533_STD_FRAME_CHECKSUM(frame))
 597                 return false;
 598
 599         return true;
 600 }
 601
 602 static bool pn533_std_rx_frame_is_ack(struct pn533_std_frame *frame)
 603 {
 604         if (frame->start_frame != cpu_to_be16(PN533_STD_FRAME_SOF))
 605                 return false;
 606
 607         if (frame->datalen != 0 || frame->datalen_checksum != 0xFF)
 608                 return false;
 609
 610         return true;
 611 }
 612
 613 static inline int pn533_std_rx_frame_size(void *frame)
 614 {
 615         struct pn533_std_frame *f = frame;
 616
 617         return sizeof(struct pn533_std_frame) + f->datalen +
 618                PN533_STD_FRAME_TAIL_LEN;
 619 }
 620
 621 static u8 pn533_std_get_cmd_code(void *frame)
 622 {
 623         struct pn533_std_frame *f = frame;
 624
 625         return PN533_STD_FRAME_CMD(f);
 626 }
 627
 628 static struct pn533_frame_ops pn533_std_frame_ops = {
 629         .tx_frame_init = pn533_std_tx_frame_init,
 630         .tx_frame_finish = pn533_std_tx_frame_finish,
 631         .tx_update_payload_len = pn533_std_tx_update_payload_len,
 632         .tx_header_len = PN533_STD_FRAME_HEADER_LEN,
 633         .tx_tail_len = PN533_STD_FRAME_TAIL_LEN,
 634
 635         .rx_is_frame_valid = pn533_std_rx_frame_is_valid,
 636         .rx_frame_size = pn533_std_rx_frame_size,
 637         .rx_header_len = PN533_STD_FRAME_HEADER_LEN,
 638         .rx_tail_len = PN533_STD_FRAME_TAIL_LEN,
 639
 640         .max_payload_len =  PN533_STD_FRAME_MAX_PAYLOAD_LEN,
 641         .get_cmd_code = pn533_std_get_cmd_code,
 642 };
 643
 644 static bool pn533_rx_frame_is_cmd_response(struct pn533 *dev, void *frame)
 645 {
 646         return (dev->ops->get_cmd_code(frame) ==
 647                                 PN533_CMD_RESPONSE(dev->cmd->code));
 648 }
 649
 650 static void pn533_recv_response(struct urb *urb)
 651 {
 652         struct pn533 *dev = urb->context;
 653         struct pn533_cmd *cmd = dev->cmd;
 654         u8 *in_frame;
 655
 656         cmd->status = urb->status;
 657
 658         switch (urb->status) {
 659         case 0:
 660                 break; /* success */
 661         case -ECONNRESET:
 662         case -ENOENT:
 663                 nfc_dev_dbg(&dev->interface->dev,
 664                             "The urb has been canceled (status %d)",
 665                             urb->status);
 666                 goto sched_wq;
 667         case -ESHUTDOWN:
 668         default:
 669                 nfc_dev_err(&dev->interface->dev,
 670                             "Urb failure (status %d)", urb->status);
 671                 goto sched_wq;
 672         }
 673
 674         in_frame = dev->in_urb->transfer_buffer;
 675
 676         nfc_dev_dbg(&dev->interface->dev, "Received a frame.");
 677         print_hex_dump_debug("PN533 RX: ", DUMP_PREFIX_NONE, 16, 1, in_frame,
 678                              dev->ops->rx_frame_size(in_frame), false);
 679
 680         if (!dev->ops->rx_is_frame_valid(in_frame)) {
 681                 nfc_dev_err(&dev->interface->dev, "Received an invalid frame");
 682                 cmd->status = -EIO;
 683                 goto sched_wq;
 684         }
 685
 686         if (!pn533_rx_frame_is_cmd_response(dev, in_frame)) {
 687                 nfc_dev_err(&dev->interface->dev,
 688                             "It it not the response to the last command");
 689                 cmd->status = -EIO;
 690                 goto sched_wq;
 691         }
 692
 693 sched_wq:
 694         queue_work(dev->wq, &dev->cmd_complete_work);
 695 }
 696
 697 static int pn533_submit_urb_for_response(struct pn533 *dev, gfp_t flags)
 698 {
 699         dev->in_urb->complete = pn533_recv_response;
 700
 701         return usb_submit_urb(dev->in_urb, flags);
 702 }
 703
 704 static void pn533_recv_ack(struct urb *urb)
 705 {
 706         struct pn533 *dev = urb->context;
 707         struct pn533_cmd *cmd = dev->cmd;
 708         struct pn533_std_frame *in_frame;
 709         int rc;
 710
 711         cmd->status = urb->status;
 712
 713         switch (urb->status) {
 714         case 0:
 715                 break; /* success */
 716         case -ECONNRESET:
 717         case -ENOENT:
 718                 nfc_dev_dbg(&dev->interface->dev,
 719                             "The urb has been stopped (status %d)",
 720                             urb->status);
 721                 goto sched_wq;
 722         case -ESHUTDOWN:
 723         default:
 724                 nfc_dev_err(&dev->interface->dev,
 725                             "Urb failure (status %d)", urb->status);
 726                 goto sched_wq;
 727         }
 728
 729         in_frame = dev->in_urb->transfer_buffer;
 730
 731         if (!pn533_std_rx_frame_is_ack(in_frame)) {
 732                 nfc_dev_err(&dev->interface->dev, "Received an invalid ack");
 733                 cmd->status = -EIO;
 734                 goto sched_wq;
 735         }
 736
 737         rc = pn533_submit_urb_for_response(dev, GFP_ATOMIC);
 738         if (rc) {
 739                 nfc_dev_err(&dev->interface->dev,
 740                             "usb_submit_urb failed with result %d", rc);
 741                 cmd->status = rc;
 742                 goto sched_wq;
 743         }
 744
 745         return;
 746
 747 sched_wq:
 748         queue_work(dev->wq, &dev->cmd_complete_work);
 749 }
 750
 751 static int pn533_submit_urb_for_ack(struct pn533 *dev, gfp_t flags)
 752 {
 753         dev->in_urb->complete = pn533_recv_ack;
 754
 755         return usb_submit_urb(dev->in_urb, flags);
 756 }
 757
 758 static int pn533_send_ack(struct pn533 *dev, gfp_t flags)
 759 {
 760         u8 ack[PN533_STD_FRAME_ACK_SIZE] = {0x00, 0x00, 0xff, 0x00, 0xff, 0x00};
 761         /* spec 7.1.1.3:  Preamble, SoPC (2), ACK Code (2), Postamble */
 762         int rc;
 763
 764         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
 765
 766         dev->out_urb->transfer_buffer = ack;
 767         dev->out_urb->transfer_buffer_length = sizeof(ack);
 768         rc = usb_submit_urb(dev->out_urb, flags);
 769
 770         return rc;
 771 }
 772
 773 static int __pn533_send_frame_async(struct pn533 *dev,
 774                                         struct sk_buff *out,
 775                                         struct sk_buff *in,
 776                                         int in_len)
 777 {
 778         int rc;
 779
 780         dev->out_urb->transfer_buffer = out->data;
 781         dev->out_urb->transfer_buffer_length = out->len;
 782
 783         dev->in_urb->transfer_buffer = in->data;
 784         dev->in_urb->transfer_buffer_length = in_len;
 785
 786         print_hex_dump_debug("PN533 TX: ", DUMP_PREFIX_NONE, 16, 1,
 787                              out->data, out->len, false);
 788
 789         rc = usb_submit_urb(dev->out_urb, GFP_KERNEL);
 790         if (rc)
 791                 return rc;
 792
 793         if (dev->protocol_type == PN533_PROTO_REQ_RESP) {
 794                 /* request for response for sent packet directly */
 795                 rc = pn533_submit_urb_for_response(dev, GFP_ATOMIC);
 796                 if (rc)
 797                         goto error;
 798         } else if (dev->protocol_type == PN533_PROTO_REQ_ACK_RESP) {
 799                 /* request for ACK if that's the case */
 800                 rc = pn533_submit_urb_for_ack(dev, GFP_KERNEL);
 801                 if (rc)
 802                         goto error;
 803         }
 804
 805         return 0;
 806
 807 error:
 808         usb_unlink_urb(dev->out_urb);
 809         return rc;
 810 }
 811
 812 static void pn533_build_cmd_frame(struct pn533 *dev, u8 cmd_code,
 813                                   struct sk_buff *skb)
 814 {
 815         /* payload is already there, just update datalen */
 816         int payload_len = skb->len;
 817         struct pn533_frame_ops *ops = dev->ops;
 818
 819
 820         skb_push(skb, ops->tx_header_len);
 821         skb_put(skb, ops->tx_tail_len);
 822
 823         ops->tx_frame_init(skb->data, cmd_code);
 824         ops->tx_update_payload_len(skb->data, payload_len);
 825         ops->tx_frame_finish(skb->data);
 826 }
 827
 828 static int pn533_send_async_complete(struct pn533 *dev)
 829 {
 830         struct pn533_cmd *cmd = dev->cmd;
 831         int status = cmd->status;
 832
 833         struct sk_buff *req = cmd->req;
 834         struct sk_buff *resp = cmd->resp;
 835
 836         int rc;
 837
 838         dev_kfree_skb(req);
 839
 840         if (status < 0) {
 841                 rc = cmd->complete_cb(dev, cmd->complete_cb_context,
 842                                       ERR_PTR(status));
 843                 dev_kfree_skb(resp);
 844                 goto done;
 845         }
 846
 847         skb_put(resp, dev->ops->rx_frame_size(resp->data));
 848         skb_pull(resp, dev->ops->rx_header_len);
 849         skb_trim(resp, resp->len - dev->ops->rx_tail_len);
 850
 851         rc = cmd->complete_cb(dev, cmd->complete_cb_context, resp);
 852
 853 done:
 854         kfree(cmd);
 855         dev->cmd = NULL;
 856         return rc;
 857 }
 858
 859 static int __pn533_send_async(struct pn533 *dev, u8 cmd_code,
 860                               struct sk_buff *req, struct sk_buff *resp,
 861                               int resp_len,
 862                               pn533_send_async_complete_t complete_cb,
 863                               void *complete_cb_context)
 864 {
 865         struct pn533_cmd *cmd;
 866         int rc = 0;
 867
 868         nfc_dev_dbg(&dev->interface->dev, "Sending command 0x%x", cmd_code);
 869
 870         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
 871         if (!cmd)
 872                 return -ENOMEM;
 873
 874         cmd->code = cmd_code;
 875         cmd->req = req;
 876         cmd->resp = resp;
 877         cmd->resp_len = resp_len;
 878         cmd->complete_cb = complete_cb;
 879         cmd->complete_cb_context = complete_cb_context;
 880
 881         pn533_build_cmd_frame(dev, cmd_code, req);
 882
 883         mutex_lock(&dev->cmd_lock);
 884
 885         if (!dev->cmd_pending) {
 886                 rc = __pn533_send_frame_async(dev, req, resp, resp_len);
 887                 if (rc)
 888                         goto error;
 889
 890                 dev->cmd_pending = 1;
 891                 dev->cmd = cmd;
 892                 goto unlock;
 893         }
 894
 895         nfc_dev_dbg(&dev->interface->dev, "%s Queueing command 0x%x", __func__,
 896                     cmd_code);
 897
 898         INIT_LIST_HEAD(&cmd->queue);
 899         list_add_tail(&cmd->queue, &dev->cmd_queue);
 900
 901         goto unlock;
 902
 903 error:
 904         kfree(cmd);
 905 unlock:
 906         mutex_unlock(&dev->cmd_lock);
 907         return rc;
 908 }
 909
 910 static int pn533_send_data_async(struct pn533 *dev, u8 cmd_code,
 911                                  struct sk_buff *req,
 912                                  pn533_send_async_complete_t complete_cb,
 913                                  void *complete_cb_context)
 914 {
 915         struct sk_buff *resp;
 916         int rc;
 917         int  resp_len = dev->ops->rx_header_len +
 918                         dev->ops->max_payload_len +
 919                         dev->ops->rx_tail_len;
 920
 921         resp = nfc_alloc_recv_skb(resp_len, GFP_KERNEL);
 922         if (!resp)
 923                 return -ENOMEM;
 924
 925         rc = __pn533_send_async(dev, cmd_code, req, resp, resp_len, complete_cb,
 926                                 complete_cb_context);
 927         if (rc)
 928                 dev_kfree_skb(resp);
 929
 930         return rc;
 931 }
 932
 933 static int pn533_send_cmd_async(struct pn533 *dev, u8 cmd_code,
 934                                 struct sk_buff *req,
 935                                 pn533_send_async_complete_t complete_cb,
 936                                 void *complete_cb_context)
 937 {
 938         struct sk_buff *resp;
 939         int rc;
 940         int  resp_len = dev->ops->rx_header_len +
 941                         dev->ops->max_payload_len +
 942                         dev->ops->rx_tail_len;
 943
 944         resp = alloc_skb(resp_len, GFP_KERNEL);
 945         if (!resp)
 946                 return -ENOMEM;
 947
 948         rc = __pn533_send_async(dev, cmd_code, req, resp, resp_len, complete_cb,
 949                                 complete_cb_context);
 950         if (rc)
 951                 dev_kfree_skb(resp);
 952
 953         return rc;
 954 }
 955
 956 /*
 957  * pn533_send_cmd_direct_async
 958  *
 959  * The function sends a piority cmd directly to the chip omiting the cmd
 960  * queue. It's intended to be used by chaining mechanism of received responses
 961  * where the host has to request every single chunk of data before scheduling
 962  * next cmd from the queue.
 963  */
 964 static int pn533_send_cmd_direct_async(struct pn533 *dev, u8 cmd_code,
 965                                        struct sk_buff *req,
 966                                        pn533_send_async_complete_t complete_cb,
 967                                        void *complete_cb_context)
 968 {
 969         struct sk_buff *resp;
 970         struct pn533_cmd *cmd;
 971         int rc;
 972         int resp_len = dev->ops->rx_header_len +
 973                        dev->ops->max_payload_len +
 974                        dev->ops->rx_tail_len;
 975
 976         resp = alloc_skb(resp_len, GFP_KERNEL);
 977         if (!resp)
 978                 return -ENOMEM;
 979
 980         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
 981         if (!cmd) {
 982                 dev_kfree_skb(resp);
 983                 return -ENOMEM;
 984         }
 985
 986         cmd->code = cmd_code;
 987         cmd->req = req;
 988         cmd->resp = resp;
 989         cmd->resp_len = resp_len;
 990         cmd->complete_cb = complete_cb;
 991         cmd->complete_cb_context = complete_cb_context;
 992
 993         pn533_build_cmd_frame(dev, cmd_code, req);
 994
 995         rc = __pn533_send_frame_async(dev, req, resp, resp_len);
 996         if (rc < 0) {
 997                 dev_kfree_skb(resp);
 998                 kfree(cmd);
 999         } else {
1000                 dev->cmd = cmd;
1001         }
1002
1003         return rc;
1004 }
1005
1006 static void pn533_wq_cmd_complete(struct work_struct *work)
1007 {
1008         struct pn533 *dev = container_of(work, struct pn533, cmd_complete_work);
1009         int rc;
1010
1011         rc = pn533_send_async_complete(dev);
1012         if (rc != -EINPROGRESS)
1013                 queue_work(dev->wq, &dev->cmd_work);
1014 }
1015
1016 static void pn533_wq_cmd(struct work_struct *work)
1017 {
1018         struct pn533 *dev = container_of(work, struct pn533, cmd_work);
1019         struct pn533_cmd *cmd;
1020         int rc;
1021
1022         mutex_lock(&dev->cmd_lock);
1023
1024         if (list_empty(&dev->cmd_queue)) {
1025                 dev->cmd_pending = 0;
1026                 mutex_unlock(&dev->cmd_lock);
1027                 return;
1028         }
1029
1030         cmd = list_first_entry(&dev->cmd_queue, struct pn533_cmd, queue);
1031
1032         list_del(&cmd->queue);
1033
1034         mutex_unlock(&dev->cmd_lock);
1035
1036         rc = __pn533_send_frame_async(dev, cmd->req, cmd->resp, cmd->resp_len);
1037         if (rc < 0) {
1038                 dev_kfree_skb(cmd->req);
1039                 dev_kfree_skb(cmd->resp);
1040                 kfree(cmd);
1041                 return;
1042         }
1043
1044         dev->cmd = cmd;
1045 }
1046
1047 struct pn533_sync_cmd_response {
1048         struct sk_buff *resp;
1049         struct completion done;
1050 };
1051
1052 static int pn533_send_sync_complete(struct pn533 *dev, void *_arg,
1053                                     struct sk_buff *resp)
1054 {
1055         struct pn533_sync_cmd_response *arg = _arg;
1056
1057         arg->resp = resp;
1058         complete(&arg->done);
1059
1060         return 0;
1061 }
1062
1063 /*  pn533_send_cmd_sync
1064  *
1065  *  Please note the req parameter is freed inside the function to
1066  *  limit a number of return value interpretations by the caller.
1067  *
1068  *  1. negative in case of error during TX path -> req should be freed
1069  *
1070  *  2. negative in case of error during RX path -> req should not be freed
1071  *     as it's been already freed at the begining of RX path by
1072  *     async_complete_cb.
1073  *
1074  *  3. valid pointer in case of succesfult RX path
1075  *
1076  *  A caller has to check a return value with IS_ERR macro. If the test pass,
1077  *  the returned pointer is valid.
1078  *
1079  * */
1080 static struct sk_buff *pn533_send_cmd_sync(struct pn533 *dev, u8 cmd_code,
1081                                                struct sk_buff *req)
1082 {
1083         int rc;
1084         struct pn533_sync_cmd_response arg;
1085
1086         init_completion(&arg.done);
1087
1088         rc = pn533_send_cmd_async(dev, cmd_code, req,
1089                                   pn533_send_sync_complete, &arg);
1090         if (rc) {
1091                 dev_kfree_skb(req);
1092                 return ERR_PTR(rc);
1093         }
1094
1095         wait_for_completion(&arg.done);
1096
1097         return arg.resp;
1098 }
1099
1100 static void pn533_send_complete(struct urb *urb)
1101 {
1102         struct pn533 *dev = urb->context;
1103
1104         switch (urb->status) {
1105         case 0:
1106                 break; /* success */
1107         case -ECONNRESET:
1108         case -ENOENT:
1109                 nfc_dev_dbg(&dev->interface->dev,
1110                             "The urb has been stopped (status %d)",
1111                             urb->status);
1112                 break;
1113         case -ESHUTDOWN:
1114         default:
1115                 nfc_dev_err(&dev->interface->dev,
1116                             "Urb failure (status %d)", urb->status);
1117         }
1118 }
1119
1120 static void pn533_abort_cmd(struct pn533 *dev, gfp_t flags)
1121 {
1122         /* ACR122U does not support any command which aborts last
1123          * issued command i.e. as ACK for standard PN533. Additionally,
1124          * it behaves stange, sending broken or incorrect responses,
1125          * when we cancel urb before the chip will send response.
1126          */
1127         if (dev->device_type == PN533_DEVICE_ACR122U)
1128                 return;
1129
1130         /* An ack will cancel the last issued command */
1131         pn533_send_ack(dev, flags);
1132
1133         /* cancel the urb request */
1134         usb_kill_urb(dev->in_urb);
1135 }
1136
1137 static struct sk_buff *pn533_alloc_skb(struct pn533 *dev, unsigned int size)
1138 {
1139         struct sk_buff *skb;
1140
1141         skb = alloc_skb(dev->ops->tx_header_len +
1142                         size +
1143                         dev->ops->tx_tail_len, GFP_KERNEL);
1144
1145         if (skb)
1146                 skb_reserve(skb, dev->ops->tx_header_len);
1147
1148         return skb;
1149 }
1150
1151 struct pn533_target_type_a {
1152         __be16 sens_res;
1153         u8 sel_res;
1154         u8 nfcid_len;
1155         u8 nfcid_data[];
1156 } __packed;
1157
1158
1159 #define PN533_TYPE_A_SENS_RES_NFCID1(x) ((u8)((be16_to_cpu(x) & 0x00C0) >> 6))
1160 #define PN533_TYPE_A_SENS_RES_SSD(x) ((u8)((be16_to_cpu(x) & 0x001F) >> 0))
1161 #define PN533_TYPE_A_SENS_RES_PLATCONF(x) ((u8)((be16_to_cpu(x) & 0x0F00) >> 8))
1162
1163 #define PN533_TYPE_A_SENS_RES_SSD_JEWEL 0x00
1164 #define PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL 0x0C
1165
1166 #define PN533_TYPE_A_SEL_PROT(x) (((x) & 0x60) >> 5)
1167 #define PN533_TYPE_A_SEL_CASCADE(x) (((x) & 0x04) >> 2)
1168
1169 #define PN533_TYPE_A_SEL_PROT_MIFARE 0
1170 #define PN533_TYPE_A_SEL_PROT_ISO14443 1
1171 #define PN533_TYPE_A_SEL_PROT_DEP 2
1172 #define PN533_TYPE_A_SEL_PROT_ISO14443_DEP 3
1173
1174 static bool pn533_target_type_a_is_valid(struct pn533_target_type_a *type_a,
1175                                                         int target_data_len)
1176 {
1177         u8 ssd;
1178         u8 platconf;
1179
1180         if (target_data_len < sizeof(struct pn533_target_type_a))
1181                 return false;
1182
1183         /* The lenght check of nfcid[] and ats[] are not being performed because
1184            the values are not being used */
1185
1186         /* Requirement 4.6.3.3 from NFC Forum Digital Spec */
1187         ssd = PN533_TYPE_A_SENS_RES_SSD(type_a->sens_res);
1188         platconf = PN533_TYPE_A_SENS_RES_PLATCONF(type_a->sens_res);
1189
1190         if ((ssd == PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
1191              platconf != PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL) ||
1192             (ssd != PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
1193              platconf == PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL))
1194                 return false;
1195
1196         /* Requirements 4.8.2.1, 4.8.2.3, 4.8.2.5 and 4.8.2.7 from NFC Forum */
1197         if (PN533_TYPE_A_SEL_CASCADE(type_a->sel_res) != 0)
1198                 return false;
1199
1200         return true;
1201 }
1202
1203 static int pn533_target_found_type_a(struct nfc_target *nfc_tgt, u8 *tgt_data,
1204                                                         int tgt_data_len)
1205 {
1206         struct pn533_target_type_a *tgt_type_a;
1207
1208         tgt_type_a = (struct pn533_target_type_a *)tgt_data;
1209
1210         if (!pn533_target_type_a_is_valid(tgt_type_a, tgt_data_len))
1211                 return -EPROTO;
1212
1213         switch (PN533_TYPE_A_SEL_PROT(tgt_type_a->sel_res)) {
1214         case PN533_TYPE_A_SEL_PROT_MIFARE:
1215                 nfc_tgt->supported_protocols = NFC_PROTO_MIFARE_MASK;
1216                 break;
1217         case PN533_TYPE_A_SEL_PROT_ISO14443:
1218                 nfc_tgt->supported_protocols = NFC_PROTO_ISO14443_MASK;
1219                 break;
1220         case PN533_TYPE_A_SEL_PROT_DEP:
1221                 nfc_tgt->supported_protocols = NFC_PROTO_NFC_DEP_MASK;
1222                 break;
1223         case PN533_TYPE_A_SEL_PROT_ISO14443_DEP:
1224                 nfc_tgt->supported_protocols = NFC_PROTO_ISO14443_MASK |
1225                                                         NFC_PROTO_NFC_DEP_MASK;
1226                 break;
1227         }
1228
1229         nfc_tgt->sens_res = be16_to_cpu(tgt_type_a->sens_res);
1230         nfc_tgt->sel_res = tgt_type_a->sel_res;
1231         nfc_tgt->nfcid1_len = tgt_type_a->nfcid_len;
1232         memcpy(nfc_tgt->nfcid1, tgt_type_a->nfcid_data, nfc_tgt->nfcid1_len);
1233
1234         return 0;
1235 }
1236
1237 struct pn533_target_felica {
1238         u8 pol_res;
1239         u8 opcode;
1240         u8 nfcid2[NFC_NFCID2_MAXSIZE];
1241         u8 pad[8];
1242         /* optional */
1243         u8 syst_code[];
1244 } __packed;
1245
1246 #define PN533_FELICA_SENSF_NFCID2_DEP_B1 0x01
1247 #define PN533_FELICA_SENSF_NFCID2_DEP_B2 0xFE
1248
1249 static bool pn533_target_felica_is_valid(struct pn533_target_felica *felica,
1250                                                         int target_data_len)
1251 {
1252         if (target_data_len < sizeof(struct pn533_target_felica))
1253                 return false;
1254
1255         if (felica->opcode != PN533_FELICA_OPC_SENSF_RES)
1256                 return false;
1257
1258         return true;
1259 }
1260
1261 static int pn533_target_found_felica(struct nfc_target *nfc_tgt, u8 *tgt_data,
1262                                                         int tgt_data_len)
1263 {
1264         struct pn533_target_felica *tgt_felica;
1265
1266         tgt_felica = (struct pn533_target_felica *)tgt_data;
1267
1268         if (!pn533_target_felica_is_valid(tgt_felica, tgt_data_len))
1269                 return -EPROTO;
1270
1271         if ((tgt_felica->nfcid2[0] == PN533_FELICA_SENSF_NFCID2_DEP_B1) &&
1272             (tgt_felica->nfcid2[1] == PN533_FELICA_SENSF_NFCID2_DEP_B2))
1273                 nfc_tgt->supported_protocols = NFC_PROTO_NFC_DEP_MASK;
1274         else
1275                 nfc_tgt->supported_protocols = NFC_PROTO_FELICA_MASK;
1276
1277         memcpy(nfc_tgt->sensf_res, &tgt_felica->opcode, 9);
1278         nfc_tgt->sensf_res_len = 9;
1279
1280         memcpy(nfc_tgt->nfcid2, tgt_felica->nfcid2, NFC_NFCID2_MAXSIZE);
1281         nfc_tgt->nfcid2_len = NFC_NFCID2_MAXSIZE;
1282
1283         return 0;
1284 }
1285
1286 struct pn533_target_jewel {
1287         __be16 sens_res;
1288         u8 jewelid[4];
1289 } __packed;
1290
1291 static bool pn533_target_jewel_is_valid(struct pn533_target_jewel *jewel,
1292                                                         int target_data_len)
1293 {
1294         u8 ssd;
1295         u8 platconf;
1296
1297         if (target_data_len < sizeof(struct pn533_target_jewel))
1298                 return false;
1299
1300         /* Requirement 4.6.3.3 from NFC Forum Digital Spec */
1301         ssd = PN533_TYPE_A_SENS_RES_SSD(jewel->sens_res);
1302         platconf = PN533_TYPE_A_SENS_RES_PLATCONF(jewel->sens_res);
1303
1304         if ((ssd == PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
1305              platconf != PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL) ||
1306             (ssd != PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
1307              platconf == PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL))
1308                 return false;
1309
1310         return true;
1311 }
1312
1313 static int pn533_target_found_jewel(struct nfc_target *nfc_tgt, u8 *tgt_data,
1314                                                         int tgt_data_len)
1315 {
1316         struct pn533_target_jewel *tgt_jewel;
1317
1318         tgt_jewel = (struct pn533_target_jewel *)tgt_data;
1319
1320         if (!pn533_target_jewel_is_valid(tgt_jewel, tgt_data_len))
1321                 return -EPROTO;
1322
1323         nfc_tgt->supported_protocols = NFC_PROTO_JEWEL_MASK;
1324         nfc_tgt->sens_res = be16_to_cpu(tgt_jewel->sens_res);
1325         nfc_tgt->nfcid1_len = 4;
1326         memcpy(nfc_tgt->nfcid1, tgt_jewel->jewelid, nfc_tgt->nfcid1_len);
1327
1328         return 0;
1329 }
1330
1331 struct pn533_type_b_prot_info {
1332         u8 bitrate;
1333         u8 fsci_type;
1334         u8 fwi_adc_fo;
1335 } __packed;
1336
1337 #define PN533_TYPE_B_PROT_FCSI(x) (((x) & 0xF0) >> 4)
1338 #define PN533_TYPE_B_PROT_TYPE(x) (((x) & 0x0F) >> 0)
1339 #define PN533_TYPE_B_PROT_TYPE_RFU_MASK 0x8
1340
1341 struct pn533_type_b_sens_res {
1342         u8 opcode;
1343         u8 nfcid[4];
1344         u8 appdata[4];
1345         struct pn533_type_b_prot_info prot_info;
1346 } __packed;
1347
1348 #define PN533_TYPE_B_OPC_SENSB_RES 0x50
1349
1350 struct pn533_target_type_b {
1351         struct pn533_type_b_sens_res sensb_res;
1352         u8 attrib_res_len;
1353         u8 attrib_res[];
1354 } __packed;
1355
1356 static bool pn533_target_type_b_is_valid(struct pn533_target_type_b *type_b,
1357                                                         int target_data_len)
1358 {
1359         if (target_data_len < sizeof(struct pn533_target_type_b))
1360                 return false;
1361
1362         if (type_b->sensb_res.opcode != PN533_TYPE_B_OPC_SENSB_RES)
1363                 return false;
1364
1365         if (PN533_TYPE_B_PROT_TYPE(type_b->sensb_res.prot_info.fsci_type) &
1366                                                 PN533_TYPE_B_PROT_TYPE_RFU_MASK)
1367                 return false;
1368
1369         return true;
1370 }
1371
1372 static int pn533_target_found_type_b(struct nfc_target *nfc_tgt, u8 *tgt_data,
1373                                                         int tgt_data_len)
1374 {
1375         struct pn533_target_type_b *tgt_type_b;
1376
1377         tgt_type_b = (struct pn533_target_type_b *)tgt_data;
1378
1379         if (!pn533_target_type_b_is_valid(tgt_type_b, tgt_data_len))
1380                 return -EPROTO;
1381
1382         nfc_tgt->supported_protocols = NFC_PROTO_ISO14443_B_MASK;
1383
1384         return 0;
1385 }
1386
1387 static int pn533_target_found(struct pn533 *dev, u8 tg, u8 *tgdata,
1388                               int tgdata_len)
1389 {
1390         struct nfc_target nfc_tgt;
1391         int rc;
1392
1393         nfc_dev_dbg(&dev->interface->dev, "%s - modulation=%d", __func__,
1394                     dev->poll_mod_curr);
1395
1396         if (tg != 1)
1397                 return -EPROTO;
1398
1399         memset(&nfc_tgt, 0, sizeof(struct nfc_target));
1400
1401         switch (dev->poll_mod_curr) {
1402         case PN533_POLL_MOD_106KBPS_A:
1403                 rc = pn533_target_found_type_a(&nfc_tgt, tgdata, tgdata_len);
1404                 break;
1405         case PN533_POLL_MOD_212KBPS_FELICA:
1406         case PN533_POLL_MOD_424KBPS_FELICA:
1407                 rc = pn533_target_found_felica(&nfc_tgt, tgdata, tgdata_len);
1408                 break;
1409         case PN533_POLL_MOD_106KBPS_JEWEL:
1410                 rc = pn533_target_found_jewel(&nfc_tgt, tgdata, tgdata_len);
1411                 break;
1412         case PN533_POLL_MOD_847KBPS_B:
1413                 rc = pn533_target_found_type_b(&nfc_tgt, tgdata, tgdata_len);
1414                 break;
1415         default:
1416                 nfc_dev_err(&dev->interface->dev,
1417                             "Unknown current poll modulation");
1418                 return -EPROTO;
1419         }
1420
1421         if (rc)
1422                 return rc;
1423
1424         if (!(nfc_tgt.supported_protocols & dev->poll_protocols)) {
1425                 nfc_dev_dbg(&dev->interface->dev,
1426                             "The Tg found doesn't have the desired protocol");
1427                 return -EAGAIN;
1428         }
1429
1430         nfc_dev_dbg(&dev->interface->dev,
1431                     "Target found - supported protocols: 0x%x",
1432                     nfc_tgt.supported_protocols);
1433
1434         dev->tgt_available_prots = nfc_tgt.supported_protocols;
1435
1436         nfc_targets_found(dev->nfc_dev, &nfc_tgt, 1);
1437
1438         return 0;
1439 }
1440
1441 static inline void pn533_poll_next_mod(struct pn533 *dev)
1442 {
1443         dev->poll_mod_curr = (dev->poll_mod_curr + 1) % dev->poll_mod_count;
1444 }
1445
1446 static void pn533_poll_reset_mod_list(struct pn533 *dev)
1447 {
1448         dev->poll_mod_count = 0;
1449 }
1450
1451 static void pn533_poll_add_mod(struct pn533 *dev, u8 mod_index)
1452 {
1453         dev->poll_mod_active[dev->poll_mod_count] =
1454                 (struct pn533_poll_modulations *)&poll_mod[mod_index];
1455         dev->poll_mod_count++;
1456 }
1457
1458 static void pn533_poll_create_mod_list(struct pn533 *dev,
1459                                        u32 im_protocols, u32 tm_protocols)
1460 {
1461         pn533_poll_reset_mod_list(dev);
1462
1463         if ((im_protocols & NFC_PROTO_MIFARE_MASK) ||
1464             (im_protocols & NFC_PROTO_ISO14443_MASK) ||
1465             (im_protocols & NFC_PROTO_NFC_DEP_MASK))
1466                 pn533_poll_add_mod(dev, PN533_POLL_MOD_106KBPS_A);
1467
1468         if (im_protocols & NFC_PROTO_FELICA_MASK ||
1469             im_protocols & NFC_PROTO_NFC_DEP_MASK) {
1470                 pn533_poll_add_mod(dev, PN533_POLL_MOD_212KBPS_FELICA);
1471                 pn533_poll_add_mod(dev, PN533_POLL_MOD_424KBPS_FELICA);
1472         }
1473
1474         if (im_protocols & NFC_PROTO_JEWEL_MASK)
1475                 pn533_poll_add_mod(dev, PN533_POLL_MOD_106KBPS_JEWEL);
1476
1477         if (im_protocols & NFC_PROTO_ISO14443_B_MASK)
1478                 pn533_poll_add_mod(dev, PN533_POLL_MOD_847KBPS_B);
1479
1480         if (tm_protocols)
1481                 pn533_poll_add_mod(dev, PN533_LISTEN_MOD);
1482 }
1483
1484 static int pn533_start_poll_complete(struct pn533 *dev, struct sk_buff *resp)
1485 {
1486         u8 nbtg, tg, *tgdata;
1487         int rc, tgdata_len;
1488
1489         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1490
1491         nbtg = resp->data[0];
1492         tg = resp->data[1];
1493         tgdata = &resp->data[2];
1494         tgdata_len = resp->len - 2;  /* nbtg + tg */
1495
1496         if (nbtg) {
1497                 rc = pn533_target_found(dev, tg, tgdata, tgdata_len);
1498
1499                 /* We must stop the poll after a valid target found */
1500                 if (rc == 0) {
1501                         pn533_poll_reset_mod_list(dev);
1502                         return 0;
1503                 }
1504         }
1505
1506         return -EAGAIN;
1507 }
1508
1509 static struct sk_buff *pn533_alloc_poll_tg_frame(struct pn533 *dev)
1510 {
1511         struct sk_buff *skb;
1512         u8 *felica, *nfcid3, *gb;
1513
1514         u8 *gbytes = dev->gb;
1515         size_t gbytes_len = dev->gb_len;
1516
1517         u8 felica_params[18] = {0x1, 0xfe, /* DEP */
1518                                 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, /* random */
1519                                 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
1520                                 0xff, 0xff}; /* System code */
1521
1522         u8 mifare_params[6] = {0x1, 0x1, /* SENS_RES */
1523                                0x0, 0x0, 0x0,
1524                                0x40}; /* SEL_RES for DEP */
1525
1526         unsigned int skb_len = 36 + /* mode (1), mifare (6),
1527                                        felica (18), nfcid3 (10), gb_len (1) */
1528                                gbytes_len +
1529                                1;  /* len Tk*/
1530
1531         skb = pn533_alloc_skb(dev, skb_len);
1532         if (!skb)
1533                 return NULL;
1534
1535         /* DEP support only */
1536         *skb_put(skb, 1) = PN533_INIT_TARGET_DEP;
1537
1538         /* MIFARE params */
1539         memcpy(skb_put(skb, 6), mifare_params, 6);
1540
1541         /* Felica params */
1542         felica = skb_put(skb, 18);
1543         memcpy(felica, felica_params, 18);
1544         get_random_bytes(felica + 2, 6);
1545
1546         /* NFCID3 */
1547         nfcid3 = skb_put(skb, 10);
1548         memset(nfcid3, 0, 10);
1549         memcpy(nfcid3, felica, 8);
1550
1551         /* General bytes */
1552         *skb_put(skb, 1) = gbytes_len;
1553
1554         gb = skb_put(skb, gbytes_len);
1555         memcpy(gb, gbytes, gbytes_len);
1556
1557         /* Len Tk */
1558         *skb_put(skb, 1) = 0;
1559
1560         return skb;
1561 }
1562
1563 #define PN533_CMD_DATAEXCH_HEAD_LEN 1
1564 #define PN533_CMD_DATAEXCH_DATA_MAXLEN 262
1565 static int pn533_tm_get_data_complete(struct pn533 *dev, void *arg,
1566                                       struct sk_buff *resp)
1567 {
1568         u8 status;
1569
1570         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1571
1572         if (IS_ERR(resp))
1573                 return PTR_ERR(resp);
1574
1575         status = resp->data[0];
1576         skb_pull(resp, sizeof(status));
1577
1578         if (status != 0) {
1579                 nfc_tm_deactivated(dev->nfc_dev);
1580                 dev->tgt_mode = 0;
1581                 dev_kfree_skb(resp);
1582                 return 0;
1583         }
1584
1585         return nfc_tm_data_received(dev->nfc_dev, resp);
1586 }
1587
1588 static void pn533_wq_tg_get_data(struct work_struct *work)
1589 {
1590         struct pn533 *dev = container_of(work, struct pn533, tg_work);
1591
1592         struct sk_buff *skb;
1593         int rc;
1594
1595         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1596
1597         skb = pn533_alloc_skb(dev, 0);
1598         if (!skb)
1599                 return;
1600
1601         rc = pn533_send_data_async(dev, PN533_CMD_TG_GET_DATA, skb,
1602                                    pn533_tm_get_data_complete, NULL);
1603
1604         if (rc < 0)
1605                 dev_kfree_skb(skb);
1606
1607         return;
1608 }
1609
1610 #define ATR_REQ_GB_OFFSET 17
1611 static int pn533_init_target_complete(struct pn533 *dev, struct sk_buff *resp)
1612 {
1613         u8 mode, *cmd, comm_mode = NFC_COMM_PASSIVE, *gb;
1614         size_t gb_len;
1615         int rc;
1616
1617         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1618
1619         if (resp->len < ATR_REQ_GB_OFFSET + 1)
1620                 return -EINVAL;
1621
1622         mode = resp->data[0];
1623         cmd = &resp->data[1];
1624
1625         nfc_dev_dbg(&dev->interface->dev, "Target mode 0x%x len %d\n",
1626                     mode, resp->len);
1627
1628         if ((mode & PN533_INIT_TARGET_RESP_FRAME_MASK) ==
1629             PN533_INIT_TARGET_RESP_ACTIVE)
1630                 comm_mode = NFC_COMM_ACTIVE;
1631
1632         if ((mode & PN533_INIT_TARGET_RESP_DEP) == 0)  /* Only DEP supported */
1633                 return -EOPNOTSUPP;
1634
1635         gb = cmd + ATR_REQ_GB_OFFSET;
1636         gb_len = resp->len - (ATR_REQ_GB_OFFSET + 1);
1637
1638         rc = nfc_tm_activated(dev->nfc_dev, NFC_PROTO_NFC_DEP_MASK,
1639                               comm_mode, gb, gb_len);
1640         if (rc < 0) {
1641                 nfc_dev_err(&dev->interface->dev,
1642                             "Error when signaling target activation");
1643                 return rc;
1644         }
1645
1646         dev->tgt_mode = 1;
1647         queue_work(dev->wq, &dev->tg_work);
1648
1649         return 0;
1650 }
1651
1652 static void pn533_listen_mode_timer(unsigned long data)
1653 {
1654         struct pn533 *dev = (struct pn533 *)data;
1655
1656         nfc_dev_dbg(&dev->interface->dev, "Listen mode timeout");
1657
1658         dev->cancel_listen = 1;
1659
1660         pn533_poll_next_mod(dev);
1661
1662         queue_work(dev->wq, &dev->poll_work);
1663 }
1664
1665 static int pn533_rf_complete(struct pn533 *dev, void *arg,
1666                              struct sk_buff *resp)
1667 {
1668         int rc = 0;
1669
1670         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1671
1672         if (IS_ERR(resp)) {
1673                 rc = PTR_ERR(resp);
1674
1675                 nfc_dev_err(&dev->interface->dev, "%s RF setting error %d",
1676                             __func__, rc);
1677
1678                 return rc;
1679         }
1680
1681         queue_work(dev->wq, &dev->poll_work);
1682
1683         dev_kfree_skb(resp);
1684         return rc;
1685 }
1686
1687 static void pn533_wq_rf(struct work_struct *work)
1688 {
1689         struct pn533 *dev = container_of(work, struct pn533, rf_work);
1690         struct sk_buff *skb;
1691         int rc;
1692
1693         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1694
1695         skb = pn533_alloc_skb(dev, 2);
1696         if (!skb)
1697                 return;
1698
1699         *skb_put(skb, 1) = PN533_CFGITEM_RF_FIELD;
1700         *skb_put(skb, 1) = PN533_CFGITEM_RF_FIELD_AUTO_RFCA;
1701
1702         rc = pn533_send_cmd_async(dev, PN533_CMD_RF_CONFIGURATION, skb,
1703                                   pn533_rf_complete, NULL);
1704         if (rc < 0) {
1705                 dev_kfree_skb(skb);
1706                 nfc_dev_err(&dev->interface->dev, "RF setting error %d", rc);
1707         }
1708
1709         return;
1710 }
1711
1712 static int pn533_poll_complete(struct pn533 *dev, void *arg,
1713                                struct sk_buff *resp)
1714 {
1715         struct pn533_poll_modulations *cur_mod;
1716         int rc;
1717
1718         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1719
1720         if (IS_ERR(resp)) {
1721                 rc = PTR_ERR(resp);
1722
1723                 nfc_dev_err(&dev->interface->dev, "%s  Poll complete error %d",
1724                             __func__, rc);
1725
1726                 if (rc == -ENOENT) {
1727                         if (dev->poll_mod_count != 0)
1728                                 return rc;
1729                         else
1730                                 goto stop_poll;
1731                 } else if (rc < 0) {
1732                         nfc_dev_err(&dev->interface->dev,
1733                                     "Error %d when running poll", rc);
1734                         goto stop_poll;
1735                 }
1736         }
1737
1738         cur_mod = dev->poll_mod_active[dev->poll_mod_curr];
1739
1740         if (cur_mod->len == 0) { /* Target mode */
1741                 del_timer(&dev->listen_timer);
1742                 rc = pn533_init_target_complete(dev, resp);
1743                 goto done;
1744         }
1745
1746         /* Initiator mode */
1747         rc = pn533_start_poll_complete(dev, resp);
1748         if (!rc)
1749                 goto done;
1750
1751         if (!dev->poll_mod_count) {
1752                 nfc_dev_dbg(&dev->interface->dev, "Polling has been stopped.");
1753                 goto done;
1754         }
1755
1756         pn533_poll_next_mod(dev);
1757         /* Not target found, turn radio off */
1758         queue_work(dev->wq, &dev->rf_work);
1759
1760 done:
1761         dev_kfree_skb(resp);
1762         return rc;
1763
1764 stop_poll:
1765         nfc_dev_err(&dev->interface->dev, "Polling operation has been stopped");
1766
1767         pn533_poll_reset_mod_list(dev);
1768         dev->poll_protocols = 0;
1769         return rc;
1770 }
1771
1772 static struct sk_buff *pn533_alloc_poll_in_frame(struct pn533 *dev,
1773                                         struct pn533_poll_modulations *mod)
1774 {
1775         struct sk_buff *skb;
1776
1777         skb = pn533_alloc_skb(dev, mod->len);
1778         if (!skb)
1779                 return NULL;
1780
1781         memcpy(skb_put(skb, mod->len), &mod->data, mod->len);
1782
1783         return skb;
1784 }
1785
1786 static int pn533_send_poll_frame(struct pn533 *dev)
1787 {
1788         struct pn533_poll_modulations *mod;
1789         struct sk_buff *skb;
1790         int rc;
1791         u8 cmd_code;
1792
1793         mod = dev->poll_mod_active[dev->poll_mod_curr];
1794
1795         nfc_dev_dbg(&dev->interface->dev, "%s mod len %d\n",
1796                     __func__, mod->len);
1797
1798         if (mod->len == 0) {  /* Listen mode */
1799                 cmd_code = PN533_CMD_TG_INIT_AS_TARGET;
1800                 skb = pn533_alloc_poll_tg_frame(dev);
1801         } else {  /* Polling mode */
1802                 cmd_code =  PN533_CMD_IN_LIST_PASSIVE_TARGET;
1803                 skb = pn533_alloc_poll_in_frame(dev, mod);
1804         }
1805
1806         if (!skb) {
1807                 nfc_dev_err(&dev->interface->dev, "Failed to allocate skb.");
1808                 return -ENOMEM;
1809         }
1810
1811         rc = pn533_send_cmd_async(dev, cmd_code, skb, pn533_poll_complete,
1812                                   NULL);
1813         if (rc < 0) {
1814                 dev_kfree_skb(skb);
1815                 nfc_dev_err(&dev->interface->dev, "Polling loop error %d", rc);
1816         }
1817
1818         return rc;
1819 }
1820
1821 static void pn533_wq_poll(struct work_struct *work)
1822 {
1823         struct pn533 *dev = container_of(work, struct pn533, poll_work);
1824         struct pn533_poll_modulations *cur_mod;
1825         int rc;
1826
1827         cur_mod = dev->poll_mod_active[dev->poll_mod_curr];
1828
1829         nfc_dev_dbg(&dev->interface->dev,
1830                     "%s cancel_listen %d modulation len %d",
1831                     __func__, dev->cancel_listen, cur_mod->len);
1832
1833         if (dev->cancel_listen == 1) {
1834                 dev->cancel_listen = 0;
1835                 pn533_abort_cmd(dev, GFP_ATOMIC);
1836         }
1837
1838         rc = pn533_send_poll_frame(dev);
1839         if (rc)
1840                 return;
1841
1842         if (cur_mod->len == 0 && dev->poll_mod_count > 1)
1843                 mod_timer(&dev->listen_timer, jiffies + PN533_LISTEN_TIME * HZ);
1844
1845         return;
1846 }
1847
1848 static int pn533_start_poll(struct nfc_dev *nfc_dev,
1849                             u32 im_protocols, u32 tm_protocols)
1850 {
1851         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
1852
1853         nfc_dev_dbg(&dev->interface->dev,
1854                     "%s: im protocols 0x%x tm protocols 0x%x",
1855                     __func__, im_protocols, tm_protocols);
1856
1857         if (dev->tgt_active_prot) {
1858                 nfc_dev_err(&dev->interface->dev,
1859                             "Cannot poll with a target already activated");
1860                 return -EBUSY;
1861         }
1862
1863         if (dev->tgt_mode) {
1864                 nfc_dev_err(&dev->interface->dev,
1865                             "Cannot poll while already being activated");
1866                 return -EBUSY;
1867         }
1868
1869         if (tm_protocols) {
1870                 dev->gb = nfc_get_local_general_bytes(nfc_dev, &dev->gb_len);
1871                 if (dev->gb == NULL)
1872                         tm_protocols = 0;
1873         }
1874
1875         dev->poll_mod_curr = 0;
1876         pn533_poll_create_mod_list(dev, im_protocols, tm_protocols);
1877         dev->poll_protocols = im_protocols;
1878         dev->listen_protocols = tm_protocols;
1879
1880         return pn533_send_poll_frame(dev);
1881 }
1882
1883 static void pn533_stop_poll(struct nfc_dev *nfc_dev)
1884 {
1885         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
1886
1887         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1888
1889         del_timer(&dev->listen_timer);
1890
1891         if (!dev->poll_mod_count) {
1892                 nfc_dev_dbg(&dev->interface->dev,
1893                             "Polling operation was not running");
1894                 return;
1895         }
1896
1897         pn533_abort_cmd(dev, GFP_KERNEL);
1898         pn533_poll_reset_mod_list(dev);
1899 }
1900
1901 static int pn533_activate_target_nfcdep(struct pn533 *dev)
1902 {
1903         struct pn533_cmd_activate_response *rsp;
1904         u16 gt_len;
1905         int rc;
1906
1907         struct sk_buff *skb;
1908         struct sk_buff *resp;
1909
1910         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1911
1912         skb = pn533_alloc_skb(dev, sizeof(u8) * 2); /*TG + Next*/
1913         if (!skb)
1914                 return -ENOMEM;
1915
1916         *skb_put(skb, sizeof(u8)) = 1; /* TG */
1917         *skb_put(skb, sizeof(u8)) = 0; /* Next */
1918
1919         resp = pn533_send_cmd_sync(dev, PN533_CMD_IN_ATR, skb);
1920         if (IS_ERR(resp))
1921                 return PTR_ERR(resp);
1922
1923         rsp = (struct pn533_cmd_activate_response *)resp->data;
1924         rc = rsp->status & PN533_CMD_RET_MASK;
1925         if (rc != PN533_CMD_RET_SUCCESS) {
1926                 nfc_dev_err(&dev->interface->dev,
1927                             "Target activation failed (error 0x%x)", rc);
1928                 dev_kfree_skb(resp);
1929                 return -EIO;
1930         }
1931
1932         /* ATR_RES general bytes are located at offset 16 */
1933         gt_len = resp->len - 16;
1934         rc = nfc_set_remote_general_bytes(dev->nfc_dev, rsp->gt, gt_len);
1935
1936         dev_kfree_skb(resp);
1937         return rc;
1938 }
1939
1940 static int pn533_activate_target(struct nfc_dev *nfc_dev,
1941                                  struct nfc_target *target, u32 protocol)
1942 {
1943         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
1944         int rc;
1945
1946         nfc_dev_dbg(&dev->interface->dev, "%s - protocol=%u", __func__,
1947                     protocol);
1948
1949         if (dev->poll_mod_count) {
1950                 nfc_dev_err(&dev->interface->dev,
1951                             "Cannot activate while polling");
1952                 return -EBUSY;
1953         }
1954
1955         if (dev->tgt_active_prot) {
1956                 nfc_dev_err(&dev->interface->dev,
1957                             "There is already an active target");
1958                 return -EBUSY;
1959         }
1960
1961         if (!dev->tgt_available_prots) {
1962                 nfc_dev_err(&dev->interface->dev,
1963                             "There is no available target to activate");
1964                 return -EINVAL;
1965         }
1966
1967         if (!(dev->tgt_available_prots & (1 << protocol))) {
1968                 nfc_dev_err(&dev->interface->dev,
1969                             "Target doesn't support requested proto %u",
1970                             protocol);
1971                 return -EINVAL;
1972         }
1973
1974         if (protocol == NFC_PROTO_NFC_DEP) {
1975                 rc = pn533_activate_target_nfcdep(dev);
1976                 if (rc) {
1977                         nfc_dev_err(&dev->interface->dev,
1978                                     "Activating target with DEP failed %d", rc);
1979                         return rc;
1980                 }
1981         }
1982
1983         dev->tgt_active_prot = protocol;
1984         dev->tgt_available_prots = 0;
1985
1986         return 0;
1987 }
1988
1989 static void pn533_deactivate_target(struct nfc_dev *nfc_dev,
1990                                     struct nfc_target *target)
1991 {
1992         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
1993
1994         struct sk_buff *skb;
1995         struct sk_buff *resp;
1996
1997         int rc;
1998
1999         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
2000
2001         if (!dev->tgt_active_prot) {
2002                 nfc_dev_err(&dev->interface->dev, "There is no active target");
2003                 return;
2004         }
2005
2006         dev->tgt_active_prot = 0;
2007         skb_queue_purge(&dev->resp_q);
2008
2009         skb = pn533_alloc_skb(dev, sizeof(u8));
2010         if (!skb)
2011                 return;
2012
2013         *skb_put(skb, 1) = 1; /* TG*/
2014
2015         resp = pn533_send_cmd_sync(dev, PN533_CMD_IN_RELEASE, skb);
2016         if (IS_ERR(resp))
2017                 return;
2018
2019         rc = resp->data[0] & PN533_CMD_RET_MASK;
2020         if (rc != PN533_CMD_RET_SUCCESS)
2021                 nfc_dev_err(&dev->interface->dev,
2022                             "Error 0x%x when releasing the target", rc);
2023
2024         dev_kfree_skb(resp);
2025         return;
2026 }
2027
2028
2029 static int pn533_in_dep_link_up_complete(struct pn533 *dev, void *arg,
2030                                          struct sk_buff *resp)
2031 {
2032         struct pn533_cmd_jump_dep_response *rsp;
2033         u8 target_gt_len;
2034         int rc;
2035         u8 active = *(u8 *)arg;
2036
2037         kfree(arg);
2038
2039         if (IS_ERR(resp))
2040                 return PTR_ERR(resp);
2041
2042         if (dev->tgt_available_prots &&
2043             !(dev->tgt_available_prots & (1 << NFC_PROTO_NFC_DEP))) {
2044                 nfc_dev_err(&dev->interface->dev,
2045                             "The target does not support DEP");
2046                 rc =  -EINVAL;
2047                 goto error;
2048         }
2049
2050         rsp = (struct pn533_cmd_jump_dep_response *)resp->data;
2051
2052         rc = rsp->status & PN533_CMD_RET_MASK;
2053         if (rc != PN533_CMD_RET_SUCCESS) {
2054                 nfc_dev_err(&dev->interface->dev,
2055                             "Bringing DEP link up failed (error 0x%x)", rc);
2056                 goto error;
2057         }
2058
2059         if (!dev->tgt_available_prots) {
2060                 struct nfc_target nfc_target;
2061
2062                 nfc_dev_dbg(&dev->interface->dev, "Creating new target");
2063
2064                 nfc_target.supported_protocols = NFC_PROTO_NFC_DEP_MASK;
2065                 nfc_target.nfcid1_len = 10;
2066                 memcpy(nfc_target.nfcid1, rsp->nfcid3t, nfc_target.nfcid1_len);
2067                 rc = nfc_targets_found(dev->nfc_dev, &nfc_target, 1);
2068                 if (rc)
2069                         goto error;
2070
2071                 dev->tgt_available_prots = 0;
2072         }
2073
2074         dev->tgt_active_prot = NFC_PROTO_NFC_DEP;
2075
2076         /* ATR_RES general bytes are located at offset 17 */
2077         target_gt_len = resp->len - 17;
2078         rc = nfc_set_remote_general_bytes(dev->nfc_dev,
2079                                           rsp->gt, target_gt_len);
2080         if (rc == 0)
2081                 rc = nfc_dep_link_is_up(dev->nfc_dev,
2082                                         dev->nfc_dev->targets[0].idx,
2083                                         !active, NFC_RF_INITIATOR);
2084
2085 error:
2086         dev_kfree_skb(resp);
2087         return rc;
2088 }
2089
2090 static int pn533_rf_field(struct nfc_dev *nfc_dev, u8 rf);
2091 #define PASSIVE_DATA_LEN 5
2092 static int pn533_dep_link_up(struct nfc_dev *nfc_dev, struct nfc_target *target,
2093                              u8 comm_mode, u8 *gb, size_t gb_len)
2094 {
2095         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2096         struct sk_buff *skb;
2097         int rc, skb_len;
2098         u8 *next, *arg, nfcid3[NFC_NFCID3_MAXSIZE];
2099
2100         u8 passive_data[PASSIVE_DATA_LEN] = {0x00, 0xff, 0xff, 0x00, 0x3};
2101
2102         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
2103
2104         if (dev->poll_mod_count) {
2105                 nfc_dev_err(&dev->interface->dev,
2106                             "Cannot bring the DEP link up while polling");
2107                 return -EBUSY;
2108         }
2109
2110         if (dev->tgt_active_prot) {
2111                 nfc_dev_err(&dev->interface->dev,
2112                             "There is already an active target");
2113                 return -EBUSY;
2114         }
2115
2116         skb_len = 3 + gb_len; /* ActPass + BR + Next */
2117         skb_len += PASSIVE_DATA_LEN;
2118
2119         /* NFCID3 */
2120         skb_len += NFC_NFCID3_MAXSIZE;
2121         if (target && !target->nfcid2_len) {
2122                 nfcid3[0] = 0x1;
2123                 nfcid3[1] = 0xfe;
2124                 get_random_bytes(nfcid3 + 2, 6);
2125         }
2126
2127         skb = pn533_alloc_skb(dev, skb_len);
2128         if (!skb)
2129                 return -ENOMEM;
2130
2131         *skb_put(skb, 1) = !comm_mode;  /* ActPass */
2132         *skb_put(skb, 1) = 0x02;  /* 424 kbps */
2133
2134         next = skb_put(skb, 1);  /* Next */
2135         *next = 0;
2136
2137         /* Copy passive data */
2138         memcpy(skb_put(skb, PASSIVE_DATA_LEN), passive_data, PASSIVE_DATA_LEN);
2139         *next |= 1;
2140
2141         /* Copy NFCID3 (which is NFCID2 from SENSF_RES) */
2142         if (target && target->nfcid2_len)
2143                 memcpy(skb_put(skb, NFC_NFCID3_MAXSIZE), target->nfcid2,
2144                        target->nfcid2_len);
2145         else
2146                 memcpy(skb_put(skb, NFC_NFCID3_MAXSIZE), nfcid3,
2147                        NFC_NFCID3_MAXSIZE);
2148         *next |= 2;
2149
2150         if (gb != NULL && gb_len > 0) {
2151                 memcpy(skb_put(skb, gb_len), gb, gb_len);
2152                 *next |= 4; /* We have some Gi */
2153         } else {
2154                 *next = 0;
2155         }
2156
2157         arg = kmalloc(sizeof(*arg), GFP_KERNEL);
2158         if (!arg) {
2159                 dev_kfree_skb(skb);
2160                 return -ENOMEM;
2161         }
2162
2163         *arg = !comm_mode;
2164
2165         pn533_rf_field(dev->nfc_dev, 0);
2166
2167         rc = pn533_send_cmd_async(dev, PN533_CMD_IN_JUMP_FOR_DEP, skb,
2168                                   pn533_in_dep_link_up_complete, arg);
2169
2170         if (rc < 0) {
2171                 dev_kfree_skb(skb);
2172                 kfree(arg);
2173         }
2174
2175         return rc;
2176 }
2177
2178 static int pn533_dep_link_down(struct nfc_dev *nfc_dev)
2179 {
2180         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2181
2182         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
2183
2184         pn533_poll_reset_mod_list(dev);
2185
2186         if (dev->tgt_mode || dev->tgt_active_prot)
2187                 pn533_abort_cmd(dev, GFP_KERNEL);
2188
2189         dev->tgt_active_prot = 0;
2190         dev->tgt_mode = 0;
2191
2192         skb_queue_purge(&dev->resp_q);
2193
2194         return 0;
2195 }
2196
2197 struct pn533_data_exchange_arg {
2198         data_exchange_cb_t cb;
2199         void *cb_context;
2200 };
2201
2202 static struct sk_buff *pn533_build_response(struct pn533 *dev)
2203 {
2204         struct sk_buff *skb, *tmp, *t;
2205         unsigned int skb_len = 0, tmp_len = 0;
2206
2207         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
2208
2209         if (skb_queue_empty(&dev->resp_q))
2210                 return NULL;
2211
2212         if (skb_queue_len(&dev->resp_q) == 1) {
2213                 skb = skb_dequeue(&dev->resp_q);
2214                 goto out;
2215         }
2216
2217         skb_queue_walk_safe(&dev->resp_q, tmp, t)
2218                 skb_len += tmp->len;
2219
2220         nfc_dev_dbg(&dev->interface->dev, "%s total length %d\n",
2221                     __func__, skb_len);
2222
2223         skb = alloc_skb(skb_len, GFP_KERNEL);
2224         if (skb == NULL)
2225                 goto out;
2226
2227         skb_put(skb, skb_len);
2228
2229         skb_queue_walk_safe(&dev->resp_q, tmp, t) {
2230                 memcpy(skb->data + tmp_len, tmp->data, tmp->len);
2231                 tmp_len += tmp->len;
2232         }
2233
2234 out:
2235         skb_queue_purge(&dev->resp_q);
2236
2237         return skb;
2238 }
2239
2240 static int pn533_data_exchange_complete(struct pn533 *dev, void *_arg,
2241                                         struct sk_buff *resp)
2242 {
2243         struct pn533_data_exchange_arg *arg = _arg;
2244         struct sk_buff *skb;
2245         int rc = 0;
2246         u8 status, ret, mi;
2247
2248         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
2249
2250         if (IS_ERR(resp)) {
2251                 rc = PTR_ERR(resp);
2252                 goto _error;
2253         }
2254
2255         status = resp->data[0];
2256         ret = status & PN533_CMD_RET_MASK;
2257         mi = status & PN533_CMD_MI_MASK;
2258
2259         skb_pull(resp, sizeof(status));
2260
2261         if (ret != PN533_CMD_RET_SUCCESS) {
2262                 nfc_dev_err(&dev->interface->dev,
2263                             "Exchanging data failed (error 0x%x)", ret);
2264                 rc = -EIO;
2265                 goto error;
2266         }
2267
2268         skb_queue_tail(&dev->resp_q, resp);
2269
2270         if (mi) {
2271                 dev->cmd_complete_mi_arg = arg;
2272                 queue_work(dev->wq, &dev->mi_work);
2273                 return -EINPROGRESS;
2274         }
2275
2276         skb = pn533_build_response(dev);
2277         if (!skb)
2278                 goto error;
2279
2280         arg->cb(arg->cb_context, skb, 0);
2281         kfree(arg);
2282         return 0;
2283
2284 error:
2285         dev_kfree_skb(resp);
2286 _error:
2287         skb_queue_purge(&dev->resp_q);
2288         arg->cb(arg->cb_context, NULL, rc);
2289         kfree(arg);
2290         return rc;
2291 }
2292
2293 static int pn533_transceive(struct nfc_dev *nfc_dev,
2294                             struct nfc_target *target, struct sk_buff *skb,
2295                             data_exchange_cb_t cb, void *cb_context)
2296 {
2297         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2298         struct pn533_data_exchange_arg *arg = NULL;
2299         int rc;
2300
2301         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
2302
2303         if (skb->len > PN533_CMD_DATAEXCH_DATA_MAXLEN) {
2304                 /* TODO: Implement support to multi-part data exchange */
2305                 nfc_dev_err(&dev->interface->dev,
2306                             "Data length greater than the max allowed: %d",
2307                             PN533_CMD_DATAEXCH_DATA_MAXLEN);
2308                 rc = -ENOSYS;
2309                 goto error;
2310         }
2311
2312         if (!dev->tgt_active_prot) {
2313                 nfc_dev_err(&dev->interface->dev,
2314                             "Can't exchange data if there is no active target");
2315                 rc = -EINVAL;
2316                 goto error;
2317         }
2318
2319         arg = kmalloc(sizeof(*arg), GFP_KERNEL);
2320         if (!arg) {
2321                 rc = -ENOMEM;
2322                 goto error;
2323         }
2324
2325         arg->cb = cb;
2326         arg->cb_context = cb_context;
2327
2328         switch (dev->device_type) {
2329         case PN533_DEVICE_PASORI:
2330                 if (dev->tgt_active_prot == NFC_PROTO_FELICA) {
2331                         rc = pn533_send_data_async(dev, PN533_CMD_IN_COMM_THRU,
2332                                                    skb,
2333                                                    pn533_data_exchange_complete,
2334                                                    arg);
2335
2336                         break;
2337                 }
2338         default:
2339                 *skb_push(skb, sizeof(u8)) =  1; /*TG*/
2340
2341                 rc = pn533_send_data_async(dev, PN533_CMD_IN_DATA_EXCHANGE,
2342                                            skb, pn533_data_exchange_complete,
2343                                            arg);
2344
2345                 break;
2346         }
2347
2348         if (rc < 0) /* rc from send_async */
2349                 goto error;
2350
2351         return 0;
2352
2353 error:
2354         kfree(arg);
2355         dev_kfree_skb(skb);
2356         return rc;
2357 }
2358
2359 static int pn533_tm_send_complete(struct pn533 *dev, void *arg,
2360                                   struct sk_buff *resp)
2361 {
2362         u8 status;
2363
2364         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
2365
2366         if (IS_ERR(resp))
2367                 return PTR_ERR(resp);
2368
2369         status = resp->data[0];
2370
2371         dev_kfree_skb(resp);
2372
2373         if (status != 0) {
2374                 nfc_tm_deactivated(dev->nfc_dev);
2375
2376                 dev->tgt_mode = 0;
2377
2378                 return 0;
2379         }
2380
2381         queue_work(dev->wq, &dev->tg_work);
2382
2383         return 0;
2384 }
2385
2386 static int pn533_tm_send(struct nfc_dev *nfc_dev, struct sk_buff *skb)
2387 {
2388         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2389         int rc;
2390
2391         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
2392
2393         if (skb->len > PN533_CMD_DATAEXCH_DATA_MAXLEN) {
2394                 nfc_dev_err(&dev->interface->dev,
2395                             "Data length greater than the max allowed: %d",
2396                             PN533_CMD_DATAEXCH_DATA_MAXLEN);
2397                 return -ENOSYS;
2398         }
2399
2400         rc = pn533_send_data_async(dev, PN533_CMD_TG_SET_DATA, skb,
2401                                    pn533_tm_send_complete, NULL);
2402         if (rc < 0)
2403                 dev_kfree_skb(skb);
2404
2405         return rc;
2406 }
2407
2408 static void pn533_wq_mi_recv(struct work_struct *work)
2409 {
2410         struct pn533 *dev = container_of(work, struct pn533, mi_work);
2411
2412         struct sk_buff *skb;
2413         int rc;
2414
2415         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
2416
2417         skb = pn533_alloc_skb(dev, PN533_CMD_DATAEXCH_HEAD_LEN);
2418         if (!skb)
2419                 goto error;
2420
2421         switch (dev->device_type) {
2422         case PN533_DEVICE_PASORI:
2423                 if (dev->tgt_active_prot == NFC_PROTO_FELICA) {
2424                         rc = pn533_send_cmd_direct_async(dev,
2425                                                 PN533_CMD_IN_COMM_THRU,
2426                                                 skb,
2427                                                 pn533_data_exchange_complete,
2428                                                  dev->cmd_complete_mi_arg);
2429
2430                         break;
2431                 }
2432         default:
2433                 *skb_put(skb, sizeof(u8)) =  1; /*TG*/
2434
2435                 rc = pn533_send_cmd_direct_async(dev,
2436                                                  PN533_CMD_IN_DATA_EXCHANGE,
2437                                                  skb,
2438                                                  pn533_data_exchange_complete,
2439                                                  dev->cmd_complete_mi_arg);
2440
2441                 break;
2442         }
2443
2444         if (rc == 0) /* success */
2445                 return;
2446
2447         nfc_dev_err(&dev->interface->dev,
2448                     "Error %d when trying to perform data_exchange", rc);
2449
2450         dev_kfree_skb(skb);
2451         kfree(dev->cmd_complete_mi_arg);
2452
2453 error:
2454         pn533_send_ack(dev, GFP_KERNEL);
2455         queue_work(dev->wq, &dev->cmd_work);
2456 }
2457
2458 static int pn533_set_configuration(struct pn533 *dev, u8 cfgitem, u8 *cfgdata,
2459                                                                 u8 cfgdata_len)
2460 {
2461         struct sk_buff *skb;
2462         struct sk_buff *resp;
2463
2464         int skb_len;
2465
2466         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
2467
2468         skb_len = sizeof(cfgitem) + cfgdata_len; /* cfgitem + cfgdata */
2469
2470         skb = pn533_alloc_skb(dev, skb_len);
2471         if (!skb)
2472                 return -ENOMEM;
2473
2474         *skb_put(skb, sizeof(cfgitem)) = cfgitem;
2475         memcpy(skb_put(skb, cfgdata_len), cfgdata, cfgdata_len);
2476
2477         resp = pn533_send_cmd_sync(dev, PN533_CMD_RF_CONFIGURATION, skb);
2478         if (IS_ERR(resp))
2479                 return PTR_ERR(resp);
2480
2481         dev_kfree_skb(resp);
2482         return 0;
2483 }
2484
2485 static int pn533_get_firmware_version(struct pn533 *dev,
2486                                       struct pn533_fw_version *fv)
2487 {
2488         struct sk_buff *skb;
2489         struct sk_buff *resp;
2490
2491         skb = pn533_alloc_skb(dev, 0);
2492         if (!skb)
2493                 return -ENOMEM;
2494
2495         resp = pn533_send_cmd_sync(dev, PN533_CMD_GET_FIRMWARE_VERSION, skb);
2496         if (IS_ERR(resp))
2497                 return PTR_ERR(resp);
2498
2499         fv->ic = resp->data[0];
2500         fv->ver = resp->data[1];
2501         fv->rev = resp->data[2];
2502         fv->support = resp->data[3];
2503
2504         dev_kfree_skb(resp);
2505         return 0;
2506 }
2507
2508 static int pn533_pasori_fw_reset(struct pn533 *dev)
2509 {
2510         struct sk_buff *skb;
2511         struct sk_buff *resp;
2512
2513         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
2514
2515         skb = pn533_alloc_skb(dev, sizeof(u8));
2516         if (!skb)
2517                 return -ENOMEM;
2518
2519         *skb_put(skb, sizeof(u8)) = 0x1;
2520
2521         resp = pn533_send_cmd_sync(dev, 0x18, skb);
2522         if (IS_ERR(resp))
2523                 return PTR_ERR(resp);
2524
2525         dev_kfree_skb(resp);
2526
2527         return 0;
2528 }
2529
2530 struct pn533_acr122_poweron_rdr_arg {
2531         int rc;
2532         struct completion done;
2533 };
2534
2535 static void pn533_acr122_poweron_rdr_resp(struct urb *urb)
2536 {
2537         struct pn533_acr122_poweron_rdr_arg *arg = urb->context;
2538
2539         nfc_dev_dbg(&urb->dev->dev, "%s", __func__);
2540
2541         print_hex_dump_debug("ACR122 RX: ", DUMP_PREFIX_NONE, 16, 1,
2542                        urb->transfer_buffer, urb->transfer_buffer_length,
2543                        false);
2544
2545         arg->rc = urb->status;
2546         complete(&arg->done);
2547 }
2548
2549 static int pn533_acr122_poweron_rdr(struct pn533 *dev)
2550 {
2551         /* Power on th reader (CCID cmd) */
2552         u8 cmd[10] = {PN533_ACR122_PC_TO_RDR_ICCPOWERON,
2553                       0, 0, 0, 0, 0, 0, 3, 0, 0};
2554         u8 buf[255];
2555         int rc;
2556         void *cntx;
2557         struct pn533_acr122_poweron_rdr_arg arg;
2558
2559         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
2560
2561         init_completion(&arg.done);
2562         cntx = dev->in_urb->context;  /* backup context */
2563
2564         dev->in_urb->transfer_buffer = buf;
2565         dev->in_urb->transfer_buffer_length = 255;
2566         dev->in_urb->complete = pn533_acr122_poweron_rdr_resp;
2567         dev->in_urb->context = &arg;
2568
2569         dev->out_urb->transfer_buffer = cmd;
2570         dev->out_urb->transfer_buffer_length = sizeof(cmd);
2571
2572         print_hex_dump_debug("ACR122 TX: ", DUMP_PREFIX_NONE, 16, 1,
2573                        cmd, sizeof(cmd), false);
2574
2575         rc = usb_submit_urb(dev->out_urb, GFP_KERNEL);
2576         if (rc) {
2577                 nfc_dev_err(&dev->interface->dev,
2578                             "Reader power on cmd error %d", rc);
2579                 return rc;
2580         }
2581
2582         rc =  usb_submit_urb(dev->in_urb, GFP_KERNEL);
2583         if (rc) {
2584                 nfc_dev_err(&dev->interface->dev,
2585                             "Can't submit for reader power on cmd response %d",
2586                             rc);
2587                 return rc;
2588         }
2589
2590         wait_for_completion(&arg.done);
2591         dev->in_urb->context = cntx; /* restore context */
2592
2593         return arg.rc;
2594 }
2595
2596 static int pn533_rf_field(struct nfc_dev *nfc_dev, u8 rf)
2597 {
2598         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2599         u8 rf_field = !!rf;
2600         int rc;
2601
2602         rf_field |= PN533_CFGITEM_RF_FIELD_AUTO_RFCA;
2603
2604         rc = pn533_set_configuration(dev, PN533_CFGITEM_RF_FIELD,
2605                                      (u8 *)&rf_field, 1);
2606         if (rc) {
2607                 nfc_dev_err(&dev->interface->dev,
2608                             "Error on setting RF field");
2609                 return rc;
2610         }
2611
2612         return rc;
2613 }
2614
2615 int pn533_dev_up(struct nfc_dev *nfc_dev)
2616 {
2617         return pn533_rf_field(nfc_dev, 1);
2618 }
2619
2620 int pn533_dev_down(struct nfc_dev *nfc_dev)
2621 {
2622         return pn533_rf_field(nfc_dev, 0);
2623 }
2624
2625 static struct nfc_ops pn533_nfc_ops = {
2626         .dev_up = pn533_dev_up,
2627         .dev_down = pn533_dev_down,
2628         .dep_link_up = pn533_dep_link_up,
2629         .dep_link_down = pn533_dep_link_down,
2630         .start_poll = pn533_start_poll,
2631         .stop_poll = pn533_stop_poll,
2632         .activate_target = pn533_activate_target,
2633         .deactivate_target = pn533_deactivate_target,
2634         .im_transceive = pn533_transceive,
2635         .tm_send = pn533_tm_send,
2636 };
2637
2638 static int pn533_setup(struct pn533 *dev)
2639 {
2640         struct pn533_config_max_retries max_retries;
2641         struct pn533_config_timing timing;
2642         u8 pasori_cfg[3] = {0x08, 0x01, 0x08};
2643         int rc;
2644
2645         switch (dev->device_type) {
2646         case PN533_DEVICE_STD:
2647         case PN533_DEVICE_PASORI:
2648         case PN533_DEVICE_ACR122U:
2649                 max_retries.mx_rty_atr = 0x2;
2650                 max_retries.mx_rty_psl = 0x1;
2651                 max_retries.mx_rty_passive_act =
2652                         PN533_CONFIG_MAX_RETRIES_NO_RETRY;
2653
2654                 timing.rfu = PN533_CONFIG_TIMING_102;
2655                 timing.atr_res_timeout = PN533_CONFIG_TIMING_102;
2656                 timing.dep_timeout = PN533_CONFIG_TIMING_204;
2657
2658                 break;
2659
2660         default:
2661                 nfc_dev_err(&dev->interface->dev, "Unknown device type %d\n",
2662                             dev->device_type);
2663                 return -EINVAL;
2664         }
2665
2666         rc = pn533_set_configuration(dev, PN533_CFGITEM_MAX_RETRIES,
2667                                      (u8 *)&max_retries, sizeof(max_retries));
2668         if (rc) {
2669                 nfc_dev_err(&dev->interface->dev,
2670                             "Error on setting MAX_RETRIES config");
2671                 return rc;
2672         }
2673
2674
2675         rc = pn533_set_configuration(dev, PN533_CFGITEM_TIMING,
2676                                      (u8 *)&timing, sizeof(timing));
2677         if (rc) {
2678                 nfc_dev_err(&dev->interface->dev,
2679                             "Error on setting RF timings");
2680                 return rc;
2681         }
2682
2683         switch (dev->device_type) {
2684         case PN533_DEVICE_STD:
2685                 break;
2686
2687         case PN533_DEVICE_PASORI:
2688                 pn533_pasori_fw_reset(dev);
2689
2690                 rc = pn533_set_configuration(dev, PN533_CFGITEM_PASORI,
2691                                              pasori_cfg, 3);
2692                 if (rc) {
2693                         nfc_dev_err(&dev->interface->dev,
2694                                     "Error while settings PASORI config");
2695                         return rc;
2696                 }
2697
2698                 pn533_pasori_fw_reset(dev);
2699
2700                 break;
2701         }
2702
2703         return 0;
2704 }
2705
2706 static int pn533_probe(struct usb_interface *interface,
2707                         const struct usb_device_id *id)
2708 {
2709         struct pn533_fw_version fw_ver;
2710         struct pn533 *dev;
2711         struct usb_host_interface *iface_desc;
2712         struct usb_endpoint_descriptor *endpoint;
2713         int in_endpoint = 0;
2714         int out_endpoint = 0;
2715         int rc = -ENOMEM;
2716         int i;
2717         u32 protocols;
2718
2719         dev = kzalloc(sizeof(*dev), GFP_KERNEL);
2720         if (!dev)
2721                 return -ENOMEM;
2722
2723         dev->udev = usb_get_dev(interface_to_usbdev(interface));
2724         dev->interface = interface;
2725         mutex_init(&dev->cmd_lock);
2726
2727         iface_desc = interface->cur_altsetting;
2728         for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
2729                 endpoint = &iface_desc->endpoint[i].desc;
2730
2731                 if (!in_endpoint && usb_endpoint_is_bulk_in(endpoint))
2732                         in_endpoint = endpoint->bEndpointAddress;
2733
2734                 if (!out_endpoint && usb_endpoint_is_bulk_out(endpoint))
2735                         out_endpoint = endpoint->bEndpointAddress;
2736         }
2737
2738         if (!in_endpoint || !out_endpoint) {
2739                 nfc_dev_err(&interface->dev,
2740                             "Could not find bulk-in or bulk-out endpoint");
2741                 rc = -ENODEV;
2742                 goto error;
2743         }
2744
2745         dev->in_urb = usb_alloc_urb(0, GFP_KERNEL);
2746         dev->out_urb = usb_alloc_urb(0, GFP_KERNEL);
2747
2748         if (!dev->in_urb || !dev->out_urb)
2749                 goto error;
2750
2751         usb_fill_bulk_urb(dev->in_urb, dev->udev,
2752                           usb_rcvbulkpipe(dev->udev, in_endpoint),
2753                           NULL, 0, NULL, dev);
2754         usb_fill_bulk_urb(dev->out_urb, dev->udev,
2755                           usb_sndbulkpipe(dev->udev, out_endpoint),
2756                           NULL, 0, pn533_send_complete, dev);
2757
2758         INIT_WORK(&dev->cmd_work, pn533_wq_cmd);
2759         INIT_WORK(&dev->cmd_complete_work, pn533_wq_cmd_complete);
2760         INIT_WORK(&dev->mi_work, pn533_wq_mi_recv);
2761         INIT_WORK(&dev->tg_work, pn533_wq_tg_get_data);
2762         INIT_WORK(&dev->poll_work, pn533_wq_poll);
2763         INIT_WORK(&dev->rf_work, pn533_wq_rf);
2764         dev->wq = alloc_ordered_workqueue("pn533", 0);
2765         if (dev->wq == NULL)
2766                 goto error;
2767
2768         init_timer(&dev->listen_timer);
2769         dev->listen_timer.data = (unsigned long) dev;
2770         dev->listen_timer.function = pn533_listen_mode_timer;
2771
2772         skb_queue_head_init(&dev->resp_q);
2773
2774         INIT_LIST_HEAD(&dev->cmd_queue);
2775
2776         usb_set_intfdata(interface, dev);
2777
2778         dev->ops = &pn533_std_frame_ops;
2779
2780         dev->protocol_type = PN533_PROTO_REQ_ACK_RESP;
2781         dev->device_type = id->driver_info;
2782         switch (dev->device_type) {
2783         case PN533_DEVICE_STD:
2784                 protocols = PN533_ALL_PROTOCOLS;
2785                 break;
2786
2787         case PN533_DEVICE_PASORI:
2788                 protocols = PN533_NO_TYPE_B_PROTOCOLS;
2789                 break;
2790
2791         case PN533_DEVICE_ACR122U:
2792                 protocols = PN533_NO_TYPE_B_PROTOCOLS;
2793                 dev->ops = &pn533_acr122_frame_ops;
2794                 dev->protocol_type = PN533_PROTO_REQ_RESP,
2795
2796                 rc = pn533_acr122_poweron_rdr(dev);
2797                 if (rc < 0) {
2798                         nfc_dev_err(&dev->interface->dev,
2799                                     "Couldn't poweron the reader (error %d)",
2800                                     rc);
2801                         goto destroy_wq;
2802                 }
2803                 break;
2804
2805         default:
2806                 nfc_dev_err(&dev->interface->dev, "Unknown device type %d\n",
2807                             dev->device_type);
2808                 rc = -EINVAL;
2809                 goto destroy_wq;
2810         }
2811
2812         memset(&fw_ver, 0, sizeof(fw_ver));
2813         rc = pn533_get_firmware_version(dev, &fw_ver);
2814         if (rc < 0)
2815                 goto destroy_wq;
2816
2817         nfc_dev_info(&dev->interface->dev,
2818                      "NXP PN5%02X firmware ver %d.%d now attached",
2819                      fw_ver.ic, fw_ver.ver, fw_ver.rev);
2820
2821
2822         dev->nfc_dev = nfc_allocate_device(&pn533_nfc_ops, protocols,
2823                                            dev->ops->tx_header_len +
2824                                            PN533_CMD_DATAEXCH_HEAD_LEN,
2825                                            dev->ops->tx_tail_len);
2826         if (!dev->nfc_dev) {
2827                 rc = -ENOMEM;
2828                 goto destroy_wq;
2829         }
2830
2831         nfc_set_parent_dev(dev->nfc_dev, &interface->dev);
2832         nfc_set_drvdata(dev->nfc_dev, dev);
2833
2834         rc = nfc_register_device(dev->nfc_dev);
2835         if (rc)
2836                 goto free_nfc_dev;
2837
2838         rc = pn533_setup(dev);
2839         if (rc)
2840                 goto unregister_nfc_dev;
2841
2842         return 0;
2843
2844 unregister_nfc_dev:
2845         nfc_unregister_device(dev->nfc_dev);
2846
2847 free_nfc_dev:
2848         nfc_free_device(dev->nfc_dev);
2849
2850 destroy_wq:
2851         destroy_workqueue(dev->wq);
2852 error:
2853         usb_free_urb(dev->in_urb);
2854         usb_free_urb(dev->out_urb);
2855         usb_put_dev(dev->udev);
2856         kfree(dev);
2857         return rc;
2858 }
2859
2860 static void pn533_disconnect(struct usb_interface *interface)
2861 {
2862         struct pn533 *dev;
2863         struct pn533_cmd *cmd, *n;
2864
2865         dev = usb_get_intfdata(interface);
2866         usb_set_intfdata(interface, NULL);
2867
2868         nfc_unregister_device(dev->nfc_dev);
2869         nfc_free_device(dev->nfc_dev);
2870
2871         usb_kill_urb(dev->in_urb);
2872         usb_kill_urb(dev->out_urb);
2873
2874         destroy_workqueue(dev->wq);
2875
2876         skb_queue_purge(&dev->resp_q);
2877
2878         del_timer(&dev->listen_timer);
2879
2880         list_for_each_entry_safe(cmd, n, &dev->cmd_queue, queue) {
2881                 list_del(&cmd->queue);
2882                 kfree(cmd);
2883         }
2884
2885         usb_free_urb(dev->in_urb);
2886         usb_free_urb(dev->out_urb);
2887         kfree(dev);
2888
2889         nfc_dev_info(&interface->dev, "NXP PN533 NFC device disconnected");
2890 }
2891
2892 static struct usb_driver pn533_driver = {
2893         .name =         "pn533",
2894         .probe =        pn533_probe,
2895         .disconnect =   pn533_disconnect,
2896         .id_table =     pn533_table,
2897 };
2898
2899 module_usb_driver(pn533_driver);
2900
2901 MODULE_AUTHOR("Lauro Ramos Venancio <lauro.venancio@openbossa.org>");
2902 MODULE_AUTHOR("Aloisio Almeida Jr <aloisio.almeida@openbossa.org>");
2903 MODULE_AUTHOR("Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>");
2904 MODULE_DESCRIPTION("PN533 usb driver ver " VERSION);
2905 MODULE_VERSION(VERSION);
2906 MODULE_LICENSE("GPL");