drivers/nfc/pn533.c

   1 /*
   2  * Copyright (C) 2011 Instituto Nokia de Tecnologia
   3  * Copyright (C) 2012-2013 Tieto Poland
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License as published by
   7  * the Free Software Foundation; either version 2 of the License, or
   8  * (at your option) any later version.
   9  *
  10  * This program is distributed in the hope that it will be useful,
  11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  13  * GNU General Public License for more details.
  14  *
  15  * You should have received a copy of the GNU General Public License
  16  * along with this program; if not, write to the
  17  * Free Software Foundation, Inc.,
  18  * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
  19  */
  20
  21 #include <linux/device.h>
  22 #include <linux/kernel.h>
  23 #include <linux/module.h>
  24 #include <linux/slab.h>
  25 #include <linux/usb.h>
  26 #include <linux/nfc.h>
  27 #include <linux/netdevice.h>
  28 #include <net/nfc/nfc.h>
  29
  30 #define VERSION "0.2"
  31
  32 #define PN533_VENDOR_ID 0x4CC
  33 #define PN533_PRODUCT_ID 0x2533
  34
  35 #define SCM_VENDOR_ID 0x4E6
  36 #define SCL3711_PRODUCT_ID 0x5591
  37
  38 #define SONY_VENDOR_ID         0x054c
  39 #define PASORI_PRODUCT_ID      0x02e1
  40
  41 #define ACS_VENDOR_ID 0x072f
  42 #define ACR122U_PRODUCT_ID 0x2200
  43
  44 #define PN533_DEVICE_STD     0x1
  45 #define PN533_DEVICE_PASORI  0x2
  46 #define PN533_DEVICE_ACR122U 0x3
  47
  48 #define PN533_ALL_PROTOCOLS (NFC_PROTO_JEWEL_MASK | NFC_PROTO_MIFARE_MASK |\
  49                              NFC_PROTO_FELICA_MASK | NFC_PROTO_ISO14443_MASK |\
  50                              NFC_PROTO_NFC_DEP_MASK |\
  51                              NFC_PROTO_ISO14443_B_MASK)
  52
  53 #define PN533_NO_TYPE_B_PROTOCOLS (NFC_PROTO_JEWEL_MASK | \
  54                                    NFC_PROTO_MIFARE_MASK | \
  55                                    NFC_PROTO_FELICA_MASK | \
  56                                    NFC_PROTO_ISO14443_MASK | \
  57                                    NFC_PROTO_NFC_DEP_MASK)
  58
  59 static const struct usb_device_id pn533_table[] = {
  60         { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE,
  61           .idVendor             = PN533_VENDOR_ID,
  62           .idProduct            = PN533_PRODUCT_ID,
  63           .driver_info          = PN533_DEVICE_STD,
  64         },
  65         { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE,
  66           .idVendor             = SCM_VENDOR_ID,
  67           .idProduct            = SCL3711_PRODUCT_ID,
  68           .driver_info          = PN533_DEVICE_STD,
  69         },
  70         { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE,
  71           .idVendor             = SONY_VENDOR_ID,
  72           .idProduct            = PASORI_PRODUCT_ID,
  73           .driver_info          = PN533_DEVICE_PASORI,
  74         },
  75         { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE,
  76           .idVendor             = ACS_VENDOR_ID,
  77           .idProduct            = ACR122U_PRODUCT_ID,
  78           .driver_info          = PN533_DEVICE_ACR122U,
  79         },
  80         { }
  81 };
  82 MODULE_DEVICE_TABLE(usb, pn533_table);
  83
  84 /* How much time we spend listening for initiators */
  85 #define PN533_LISTEN_TIME 2
  86
  87 /* Standard pn533 frame definitions */
  88 #define PN533_STD_FRAME_HEADER_LEN (sizeof(struct pn533_std_frame) \
  89                                         + 2) /* data[0] TFI, data[1] CC */
  90 #define PN533_STD_FRAME_TAIL_LEN 2 /* data[len] DCS, data[len + 1] postamble*/
  91
  92 /*
  93  * Max extended frame payload len, excluding TFI and CC
  94  * which are already in PN533_FRAME_HEADER_LEN.
  95  */
  96 #define PN533_STD_FRAME_MAX_PAYLOAD_LEN 263
  97
  98 #define PN533_STD_FRAME_ACK_SIZE 6 /* Preamble (1), SoPC (2), ACK Code (2),
  99                                   Postamble (1) */
 100 #define PN533_STD_FRAME_CHECKSUM(f) (f->data[f->datalen])
 101 #define PN533_STD_FRAME_POSTAMBLE(f) (f->data[f->datalen + 1])
 102
 103 /* start of frame */
 104 #define PN533_STD_FRAME_SOF 0x00FF
 105
 106 /* standard frame identifier: in/out/error */
 107 #define PN533_STD_FRAME_IDENTIFIER(f) (f->data[0]) /* TFI */
 108 #define PN533_STD_FRAME_DIR_OUT 0xD4
 109 #define PN533_STD_FRAME_DIR_IN 0xD5
 110
 111 /* ACS ACR122 pn533 frame definitions */
 112 #define PN533_ACR122_TX_FRAME_HEADER_LEN (sizeof(struct pn533_acr122_tx_frame) \
 113                                           + 2)
 114 #define PN533_ACR122_TX_FRAME_TAIL_LEN 0
 115 #define PN533_ACR122_RX_FRAME_HEADER_LEN (sizeof(struct pn533_acr122_rx_frame) \
 116                                           + 2)
 117 #define PN533_ACR122_RX_FRAME_TAIL_LEN 2
 118 #define PN533_ACR122_FRAME_MAX_PAYLOAD_LEN PN533_STD_FRAME_MAX_PAYLOAD_LEN
 119
 120 /* CCID messages types */
 121 #define PN533_ACR122_PC_TO_RDR_ICCPOWERON 0x62
 122 #define PN533_ACR122_PC_TO_RDR_ESCAPE 0x6B
 123
 124 #define PN533_ACR122_RDR_TO_PC_ESCAPE 0x83
 125
 126 /* PN533 Commands */
 127 #define PN533_STD_FRAME_CMD(f) (f->data[1])
 128
 129 #define PN533_CMD_GET_FIRMWARE_VERSION 0x02
 130 #define PN533_CMD_RF_CONFIGURATION 0x32
 131 #define PN533_CMD_IN_DATA_EXCHANGE 0x40
 132 #define PN533_CMD_IN_COMM_THRU     0x42
 133 #define PN533_CMD_IN_LIST_PASSIVE_TARGET 0x4A
 134 #define PN533_CMD_IN_ATR 0x50
 135 #define PN533_CMD_IN_RELEASE 0x52
 136 #define PN533_CMD_IN_JUMP_FOR_DEP 0x56
 137
 138 #define PN533_CMD_TG_INIT_AS_TARGET 0x8c
 139 #define PN533_CMD_TG_GET_DATA 0x86
 140 #define PN533_CMD_TG_SET_DATA 0x8e
 141 #define PN533_CMD_UNDEF 0xff
 142
 143 #define PN533_CMD_RESPONSE(cmd) (cmd + 1)
 144
 145 /* PN533 Return codes */
 146 #define PN533_CMD_RET_MASK 0x3F
 147 #define PN533_CMD_MI_MASK 0x40
 148 #define PN533_CMD_RET_SUCCESS 0x00
 149
 150 struct pn533;
 151
 152 typedef int (*pn533_send_async_complete_t) (struct pn533 *dev, void *arg,
 153                                         struct sk_buff *resp);
 154
 155 /* structs for pn533 commands */
 156
 157 /* PN533_CMD_GET_FIRMWARE_VERSION */
 158 struct pn533_fw_version {
 159         u8 ic;
 160         u8 ver;
 161         u8 rev;
 162         u8 support;
 163 };
 164
 165 /* PN533_CMD_RF_CONFIGURATION */
 166 #define PN533_CFGITEM_TIMING 0x02
 167 #define PN533_CFGITEM_MAX_RETRIES 0x05
 168 #define PN533_CFGITEM_PASORI 0x82
 169
 170 #define PN533_CONFIG_TIMING_102 0xb
 171 #define PN533_CONFIG_TIMING_204 0xc
 172 #define PN533_CONFIG_TIMING_409 0xd
 173 #define PN533_CONFIG_TIMING_819 0xe
 174
 175 #define PN533_CONFIG_MAX_RETRIES_NO_RETRY 0x00
 176 #define PN533_CONFIG_MAX_RETRIES_ENDLESS 0xFF
 177
 178 struct pn533_config_max_retries {
 179         u8 mx_rty_atr;
 180         u8 mx_rty_psl;
 181         u8 mx_rty_passive_act;
 182 } __packed;
 183
 184 struct pn533_config_timing {
 185         u8 rfu;
 186         u8 atr_res_timeout;
 187         u8 dep_timeout;
 188 } __packed;
 189
 190 /* PN533_CMD_IN_LIST_PASSIVE_TARGET */
 191
 192 /* felica commands opcode */
 193 #define PN533_FELICA_OPC_SENSF_REQ 0
 194 #define PN533_FELICA_OPC_SENSF_RES 1
 195 /* felica SENSF_REQ parameters */
 196 #define PN533_FELICA_SENSF_SC_ALL 0xFFFF
 197 #define PN533_FELICA_SENSF_RC_NO_SYSTEM_CODE 0
 198 #define PN533_FELICA_SENSF_RC_SYSTEM_CODE 1
 199 #define PN533_FELICA_SENSF_RC_ADVANCED_PROTOCOL 2
 200
 201 /* type B initiator_data values */
 202 #define PN533_TYPE_B_AFI_ALL_FAMILIES 0
 203 #define PN533_TYPE_B_POLL_METHOD_TIMESLOT 0
 204 #define PN533_TYPE_B_POLL_METHOD_PROBABILISTIC 1
 205
 206 union pn533_cmd_poll_initdata {
 207         struct {
 208                 u8 afi;
 209                 u8 polling_method;
 210         } __packed type_b;
 211         struct {
 212                 u8 opcode;
 213                 __be16 sc;
 214                 u8 rc;
 215                 u8 tsn;
 216         } __packed felica;
 217 };
 218
 219 /* Poll modulations */
 220 enum {
 221         PN533_POLL_MOD_106KBPS_A,
 222         PN533_POLL_MOD_212KBPS_FELICA,
 223         PN533_POLL_MOD_424KBPS_FELICA,
 224         PN533_POLL_MOD_106KBPS_JEWEL,
 225         PN533_POLL_MOD_847KBPS_B,
 226         PN533_LISTEN_MOD,
 227
 228         __PN533_POLL_MOD_AFTER_LAST,
 229 };
 230 #define PN533_POLL_MOD_MAX (__PN533_POLL_MOD_AFTER_LAST - 1)
 231
 232 struct pn533_poll_modulations {
 233         struct {
 234                 u8 maxtg;
 235                 u8 brty;
 236                 union pn533_cmd_poll_initdata initiator_data;
 237         } __packed data;
 238         u8 len;
 239 };
 240
 241 static const struct pn533_poll_modulations poll_mod[] = {
 242         [PN533_POLL_MOD_106KBPS_A] = {
 243                 .data = {
 244                         .maxtg = 1,
 245                         .brty = 0,
 246                 },
 247                 .len = 2,
 248         },
 249         [PN533_POLL_MOD_212KBPS_FELICA] = {
 250                 .data = {
 251                         .maxtg = 1,
 252                         .brty = 1,
 253                         .initiator_data.felica = {
 254                                 .opcode = PN533_FELICA_OPC_SENSF_REQ,
 255                                 .sc = PN533_FELICA_SENSF_SC_ALL,
 256                                 .rc = PN533_FELICA_SENSF_RC_NO_SYSTEM_CODE,
 257                                 .tsn = 0,
 258                         },
 259                 },
 260                 .len = 7,
 261         },
 262         [PN533_POLL_MOD_424KBPS_FELICA] = {
 263                 .data = {
 264                         .maxtg = 1,
 265                         .brty = 2,
 266                         .initiator_data.felica = {
 267                                 .opcode = PN533_FELICA_OPC_SENSF_REQ,
 268                                 .sc = PN533_FELICA_SENSF_SC_ALL,
 269                                 .rc = PN533_FELICA_SENSF_RC_NO_SYSTEM_CODE,
 270                                 .tsn = 0,
 271                         },
 272                  },
 273                 .len = 7,
 274         },
 275         [PN533_POLL_MOD_106KBPS_JEWEL] = {
 276                 .data = {
 277                         .maxtg = 1,
 278                         .brty = 4,
 279                 },
 280                 .len = 2,
 281         },
 282         [PN533_POLL_MOD_847KBPS_B] = {
 283                 .data = {
 284                         .maxtg = 1,
 285                         .brty = 8,
 286                         .initiator_data.type_b = {
 287                                 .afi = PN533_TYPE_B_AFI_ALL_FAMILIES,
 288                                 .polling_method =
 289                                         PN533_TYPE_B_POLL_METHOD_TIMESLOT,
 290                         },
 291                 },
 292                 .len = 3,
 293         },
 294         [PN533_LISTEN_MOD] = {
 295                 .len = 0,
 296         },
 297 };
 298
 299 /* PN533_CMD_IN_ATR */
 300
 301 struct pn533_cmd_activate_response {
 302         u8 status;
 303         u8 nfcid3t[10];
 304         u8 didt;
 305         u8 bst;
 306         u8 brt;
 307         u8 to;
 308         u8 ppt;
 309         /* optional */
 310         u8 gt[];
 311 } __packed;
 312
 313 struct pn533_cmd_jump_dep_response {
 314         u8 status;
 315         u8 tg;
 316         u8 nfcid3t[10];
 317         u8 didt;
 318         u8 bst;
 319         u8 brt;
 320         u8 to;
 321         u8 ppt;
 322         /* optional */
 323         u8 gt[];
 324 } __packed;
 325
 326
 327 /* PN533_TG_INIT_AS_TARGET */
 328 #define PN533_INIT_TARGET_PASSIVE 0x1
 329 #define PN533_INIT_TARGET_DEP 0x2
 330
 331 #define PN533_INIT_TARGET_RESP_FRAME_MASK 0x3
 332 #define PN533_INIT_TARGET_RESP_ACTIVE     0x1
 333 #define PN533_INIT_TARGET_RESP_DEP        0x4
 334
 335 enum  pn533_protocol_type {
 336         PN533_PROTO_REQ_ACK_RESP = 0,
 337         PN533_PROTO_REQ_RESP
 338 };
 339
 340 struct pn533 {
 341         struct usb_device *udev;
 342         struct usb_interface *interface;
 343         struct nfc_dev *nfc_dev;
 344         u32 device_type;
 345         enum pn533_protocol_type protocol_type;
 346
 347         struct urb *out_urb;
 348         struct urb *in_urb;
 349
 350         struct sk_buff_head resp_q;
 351
 352         struct workqueue_struct *wq;
 353         struct work_struct cmd_work;
 354         struct work_struct cmd_complete_work;
 355         struct work_struct poll_work;
 356         struct work_struct mi_work;
 357         struct work_struct tg_work;
 358
 359         struct list_head cmd_queue;
 360         struct pn533_cmd *cmd;
 361         u8 cmd_pending;
 362         struct mutex cmd_lock;  /* protects cmd queue */
 363
 364         void *cmd_complete_mi_arg;
 365
 366         struct pn533_poll_modulations *poll_mod_active[PN533_POLL_MOD_MAX + 1];
 367         u8 poll_mod_count;
 368         u8 poll_mod_curr;
 369         u32 poll_protocols;
 370         u32 listen_protocols;
 371         struct timer_list listen_timer;
 372         int cancel_listen;
 373
 374         u8 *gb;
 375         size_t gb_len;
 376
 377         u8 tgt_available_prots;
 378         u8 tgt_active_prot;
 379         u8 tgt_mode;
 380
 381         struct pn533_frame_ops *ops;
 382 };
 383
 384 struct pn533_cmd {
 385         struct list_head queue;
 386         u8 code;
 387         int status;
 388         struct sk_buff *req;
 389         struct sk_buff *resp;
 390         int resp_len;
 391         pn533_send_async_complete_t  complete_cb;
 392         void *complete_cb_context;
 393 };
 394
 395 struct pn533_std_frame {
 396         u8 preamble;
 397         __be16 start_frame;
 398         u8 datalen;
 399         u8 datalen_checksum;
 400         u8 data[];
 401 } __packed;
 402
 403 struct pn533_frame_ops {
 404         void (*tx_frame_init)(void *frame, u8 cmd_code);
 405         void (*tx_frame_finish)(void *frame);
 406         void (*tx_update_payload_len)(void *frame, int len);
 407         int tx_header_len;
 408         int tx_tail_len;
 409
 410         bool (*rx_is_frame_valid)(void *frame);
 411         int (*rx_frame_size)(void *frame);
 412         int rx_header_len;
 413         int rx_tail_len;
 414
 415         int max_payload_len;
 416         u8 (*get_cmd_code)(void *frame);
 417 };
 418
 419 struct pn533_acr122_ccid_hdr {
 420         u8 type;
 421         u32 datalen;
 422         u8 slot;
 423         u8 seq;
 424         u8 params[3]; /* 3 msg specific bytes or status, error and 1 specific
 425                          byte for reposnse msg */
 426         u8 data[]; /* payload */
 427 } __packed;
 428
 429 struct pn533_acr122_apdu_hdr {
 430         u8 class;
 431         u8 ins;
 432         u8 p1;
 433         u8 p2;
 434 } __packed;
 435
 436 struct pn533_acr122_tx_frame {
 437         struct pn533_acr122_ccid_hdr ccid;
 438         struct pn533_acr122_apdu_hdr apdu;
 439         u8 datalen;
 440         u8 data[]; /* pn533 frame: TFI ... */
 441 } __packed;
 442
 443 struct pn533_acr122_rx_frame {
 444         struct pn533_acr122_ccid_hdr ccid;
 445         u8 data[]; /* pn533 frame : TFI ... */
 446 } __packed;
 447
 448 static void pn533_acr122_tx_frame_init(void *_frame, u8 cmd_code)
 449 {
 450         struct pn533_acr122_tx_frame *frame = _frame;
 451
 452         frame->ccid.type = PN533_ACR122_PC_TO_RDR_ESCAPE;
 453         frame->ccid.datalen = sizeof(frame->apdu) + 1; /* sizeof(apdu_hdr) +
 454                                                           sizeof(datalen) */
 455         frame->ccid.slot = 0;
 456         frame->ccid.seq = 0;
 457         frame->ccid.params[0] = 0;
 458         frame->ccid.params[1] = 0;
 459         frame->ccid.params[2] = 0;
 460
 461         frame->data[0] = PN533_STD_FRAME_DIR_OUT;
 462         frame->data[1] = cmd_code;
 463         frame->datalen = 2;  /* data[0] + data[1] */
 464
 465         frame->apdu.class = 0xFF;
 466         frame->apdu.ins = 0;
 467         frame->apdu.p1 = 0;
 468         frame->apdu.p2 = 0;
 469 }
 470
 471 static void pn533_acr122_tx_frame_finish(void *_frame)
 472 {
 473         struct pn533_acr122_tx_frame *frame = _frame;
 474
 475         frame->ccid.datalen += frame->datalen;
 476 }
 477
 478 static void pn533_acr122_tx_update_payload_len(void *_frame, int len)
 479 {
 480         struct pn533_acr122_tx_frame *frame = _frame;
 481
 482         frame->datalen += len;
 483 }
 484
 485 static bool pn533_acr122_is_rx_frame_valid(void *_frame)
 486 {
 487         struct pn533_acr122_rx_frame *frame = _frame;
 488
 489         if (frame->ccid.type != 0x83)
 490                 return false;
 491
 492         if (frame->data[frame->ccid.datalen - 2] == 0x63)
 493                 return false;
 494
 495         return true;
 496 }
 497
 498 static int pn533_acr122_rx_frame_size(void *frame)
 499 {
 500         struct pn533_acr122_rx_frame *f = frame;
 501
 502         /* f->ccid.datalen already includes tail length */
 503         return sizeof(struct pn533_acr122_rx_frame) + f->ccid.datalen;
 504 }
 505
 506 static u8 pn533_acr122_get_cmd_code(void *frame)
 507 {
 508         struct pn533_acr122_rx_frame *f = frame;
 509
 510         return PN533_STD_FRAME_CMD(f);
 511 }
 512
 513 static struct pn533_frame_ops pn533_acr122_frame_ops = {
 514         .tx_frame_init = pn533_acr122_tx_frame_init,
 515         .tx_frame_finish = pn533_acr122_tx_frame_finish,
 516         .tx_update_payload_len = pn533_acr122_tx_update_payload_len,
 517         .tx_header_len = PN533_ACR122_TX_FRAME_HEADER_LEN,
 518         .tx_tail_len = PN533_ACR122_TX_FRAME_TAIL_LEN,
 519
 520         .rx_is_frame_valid = pn533_acr122_is_rx_frame_valid,
 521         .rx_header_len = PN533_ACR122_RX_FRAME_HEADER_LEN,
 522         .rx_tail_len = PN533_ACR122_RX_FRAME_TAIL_LEN,
 523         .rx_frame_size = pn533_acr122_rx_frame_size,
 524
 525         .max_payload_len = PN533_ACR122_FRAME_MAX_PAYLOAD_LEN,
 526         .get_cmd_code = pn533_acr122_get_cmd_code,
 527 };
 528
 529 /* The rule: value + checksum = 0 */
 530 static inline u8 pn533_std_checksum(u8 value)
 531 {
 532         return ~value + 1;
 533 }
 534
 535 /* The rule: sum(data elements) + checksum = 0 */
 536 static u8 pn533_std_data_checksum(u8 *data, int datalen)
 537 {
 538         u8 sum = 0;
 539         int i;
 540
 541         for (i = 0; i < datalen; i++)
 542                 sum += data[i];
 543
 544         return pn533_std_checksum(sum);
 545 }
 546
 547 static void pn533_std_tx_frame_init(void *_frame, u8 cmd_code)
 548 {
 549         struct pn533_std_frame *frame = _frame;
 550
 551         frame->preamble = 0;
 552         frame->start_frame = cpu_to_be16(PN533_STD_FRAME_SOF);
 553         PN533_STD_FRAME_IDENTIFIER(frame) = PN533_STD_FRAME_DIR_OUT;
 554         PN533_STD_FRAME_CMD(frame) = cmd_code;
 555         frame->datalen = 2;
 556 }
 557
 558 static void pn533_std_tx_frame_finish(void *_frame)
 559 {
 560         struct pn533_std_frame *frame = _frame;
 561
 562         frame->datalen_checksum = pn533_std_checksum(frame->datalen);
 563
 564         PN533_STD_FRAME_CHECKSUM(frame) =
 565                 pn533_std_data_checksum(frame->data, frame->datalen);
 566
 567         PN533_STD_FRAME_POSTAMBLE(frame) = 0;
 568 }
 569
 570 static void pn533_std_tx_update_payload_len(void *_frame, int len)
 571 {
 572         struct pn533_std_frame *frame = _frame;
 573
 574         frame->datalen += len;
 575 }
 576
 577 static bool pn533_std_rx_frame_is_valid(void *_frame)
 578 {
 579         u8 checksum;
 580         struct pn533_std_frame *frame = _frame;
 581
 582         if (frame->start_frame != cpu_to_be16(PN533_STD_FRAME_SOF))
 583                 return false;
 584
 585         checksum = pn533_std_checksum(frame->datalen);
 586         if (checksum != frame->datalen_checksum)
 587                 return false;
 588
 589         checksum = pn533_std_data_checksum(frame->data, frame->datalen);
 590         if (checksum != PN533_STD_FRAME_CHECKSUM(frame))
 591                 return false;
 592
 593         return true;
 594 }
 595
 596 static bool pn533_std_rx_frame_is_ack(struct pn533_std_frame *frame)
 597 {
 598         if (frame->start_frame != cpu_to_be16(PN533_STD_FRAME_SOF))
 599                 return false;
 600
 601         if (frame->datalen != 0 || frame->datalen_checksum != 0xFF)
 602                 return false;
 603
 604         return true;
 605 }
 606
 607 static inline int pn533_std_rx_frame_size(void *frame)
 608 {
 609         struct pn533_std_frame *f = frame;
 610
 611         return sizeof(struct pn533_std_frame) + f->datalen +
 612                PN533_STD_FRAME_TAIL_LEN;
 613 }
 614
 615 static u8 pn533_std_get_cmd_code(void *frame)
 616 {
 617         struct pn533_std_frame *f = frame;
 618
 619         return PN533_STD_FRAME_CMD(f);
 620 }
 621
 622 static struct pn533_frame_ops pn533_std_frame_ops = {
 623         .tx_frame_init = pn533_std_tx_frame_init,
 624         .tx_frame_finish = pn533_std_tx_frame_finish,
 625         .tx_update_payload_len = pn533_std_tx_update_payload_len,
 626         .tx_header_len = PN533_STD_FRAME_HEADER_LEN,
 627         .tx_tail_len = PN533_STD_FRAME_TAIL_LEN,
 628
 629         .rx_is_frame_valid = pn533_std_rx_frame_is_valid,
 630         .rx_frame_size = pn533_std_rx_frame_size,
 631         .rx_header_len = PN533_STD_FRAME_HEADER_LEN,
 632         .rx_tail_len = PN533_STD_FRAME_TAIL_LEN,
 633
 634         .max_payload_len =  PN533_STD_FRAME_MAX_PAYLOAD_LEN,
 635         .get_cmd_code = pn533_std_get_cmd_code,
 636 };
 637
 638 static bool pn533_rx_frame_is_cmd_response(struct pn533 *dev, void *frame)
 639 {
 640         return (dev->ops->get_cmd_code(frame) ==
 641                                 PN533_CMD_RESPONSE(dev->cmd->code));
 642 }
 643
 644 static void pn533_recv_response(struct urb *urb)
 645 {
 646         struct pn533 *dev = urb->context;
 647         struct pn533_cmd *cmd = dev->cmd;
 648         u8 *in_frame;
 649
 650         cmd->status = urb->status;
 651
 652         switch (urb->status) {
 653         case 0:
 654                 break; /* success */
 655         case -ECONNRESET:
 656         case -ENOENT:
 657                 nfc_dev_dbg(&dev->interface->dev,
 658                             "The urb has been canceled (status %d)",
 659                             urb->status);
 660                 goto sched_wq;
 661         case -ESHUTDOWN:
 662         default:
 663                 nfc_dev_err(&dev->interface->dev,
 664                             "Urb failure (status %d)", urb->status);
 665                 goto sched_wq;
 666         }
 667
 668         in_frame = dev->in_urb->transfer_buffer;
 669
 670         nfc_dev_dbg(&dev->interface->dev, "Received a frame.");
 671         print_hex_dump_debug("PN533 RX: ", DUMP_PREFIX_NONE, 16, 1, in_frame,
 672                              dev->ops->rx_frame_size(in_frame), false);
 673
 674         if (!dev->ops->rx_is_frame_valid(in_frame)) {
 675                 nfc_dev_err(&dev->interface->dev, "Received an invalid frame");
 676                 cmd->status = -EIO;
 677                 goto sched_wq;
 678         }
 679
 680         if (!pn533_rx_frame_is_cmd_response(dev, in_frame)) {
 681                 nfc_dev_err(&dev->interface->dev,
 682                             "It it not the response to the last command");
 683                 cmd->status = -EIO;
 684                 goto sched_wq;
 685         }
 686
 687 sched_wq:
 688         queue_work(dev->wq, &dev->cmd_complete_work);
 689 }
 690
 691 static int pn533_submit_urb_for_response(struct pn533 *dev, gfp_t flags)
 692 {
 693         dev->in_urb->complete = pn533_recv_response;
 694
 695         return usb_submit_urb(dev->in_urb, flags);
 696 }
 697
 698 static void pn533_recv_ack(struct urb *urb)
 699 {
 700         struct pn533 *dev = urb->context;
 701         struct pn533_cmd *cmd = dev->cmd;
 702         struct pn533_std_frame *in_frame;
 703         int rc;
 704
 705         cmd->status = urb->status;
 706
 707         switch (urb->status) {
 708         case 0:
 709                 break; /* success */
 710         case -ECONNRESET:
 711         case -ENOENT:
 712                 nfc_dev_dbg(&dev->interface->dev,
 713                             "The urb has been stopped (status %d)",
 714                             urb->status);
 715                 goto sched_wq;
 716         case -ESHUTDOWN:
 717         default:
 718                 nfc_dev_err(&dev->interface->dev,
 719                             "Urb failure (status %d)", urb->status);
 720                 goto sched_wq;
 721         }
 722
 723         in_frame = dev->in_urb->transfer_buffer;
 724
 725         if (!pn533_std_rx_frame_is_ack(in_frame)) {
 726                 nfc_dev_err(&dev->interface->dev, "Received an invalid ack");
 727                 cmd->status = -EIO;
 728                 goto sched_wq;
 729         }
 730
 731         rc = pn533_submit_urb_for_response(dev, GFP_ATOMIC);
 732         if (rc) {
 733                 nfc_dev_err(&dev->interface->dev,
 734                             "usb_submit_urb failed with result %d", rc);
 735                 cmd->status = rc;
 736                 goto sched_wq;
 737         }
 738
 739         return;
 740
 741 sched_wq:
 742         queue_work(dev->wq, &dev->cmd_complete_work);
 743 }
 744
 745 static int pn533_submit_urb_for_ack(struct pn533 *dev, gfp_t flags)
 746 {
 747         dev->in_urb->complete = pn533_recv_ack;
 748
 749         return usb_submit_urb(dev->in_urb, flags);
 750 }
 751
 752 static int pn533_send_ack(struct pn533 *dev, gfp_t flags)
 753 {
 754         u8 ack[PN533_STD_FRAME_ACK_SIZE] = {0x00, 0x00, 0xff, 0x00, 0xff, 0x00};
 755         /* spec 7.1.1.3:  Preamble, SoPC (2), ACK Code (2), Postamble */
 756         int rc;
 757
 758         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
 759
 760         dev->out_urb->transfer_buffer = ack;
 761         dev->out_urb->transfer_buffer_length = sizeof(ack);
 762         rc = usb_submit_urb(dev->out_urb, flags);
 763
 764         return rc;
 765 }
 766
 767 static int __pn533_send_frame_async(struct pn533 *dev,
 768                                         struct sk_buff *out,
 769                                         struct sk_buff *in,
 770                                         int in_len)
 771 {
 772         int rc;
 773
 774         dev->out_urb->transfer_buffer = out->data;
 775         dev->out_urb->transfer_buffer_length = out->len;
 776
 777         dev->in_urb->transfer_buffer = in->data;
 778         dev->in_urb->transfer_buffer_length = in_len;
 779
 780         print_hex_dump_debug("PN533 TX: ", DUMP_PREFIX_NONE, 16, 1,
 781                              out->data, out->len, false);
 782
 783         rc = usb_submit_urb(dev->out_urb, GFP_KERNEL);
 784         if (rc)
 785                 return rc;
 786
 787         if (dev->protocol_type == PN533_PROTO_REQ_RESP) {
 788                 /* request for response for sent packet directly */
 789                 rc = pn533_submit_urb_for_response(dev, GFP_ATOMIC);
 790                 if (rc)
 791                         goto error;
 792         } else if (dev->protocol_type == PN533_PROTO_REQ_ACK_RESP) {
 793                 /* request for ACK if that's the case */
 794                 rc = pn533_submit_urb_for_ack(dev, GFP_KERNEL);
 795                 if (rc)
 796                         goto error;
 797         }
 798
 799         return 0;
 800
 801 error:
 802         usb_unlink_urb(dev->out_urb);
 803         return rc;
 804 }
 805
 806 static void pn533_build_cmd_frame(struct pn533 *dev, u8 cmd_code,
 807                                   struct sk_buff *skb)
 808 {
 809         /* payload is already there, just update datalen */
 810         int payload_len = skb->len;
 811         struct pn533_frame_ops *ops = dev->ops;
 812
 813
 814         skb_push(skb, ops->tx_header_len);
 815         skb_put(skb, ops->tx_tail_len);
 816
 817         ops->tx_frame_init(skb->data, cmd_code);
 818         ops->tx_update_payload_len(skb->data, payload_len);
 819         ops->tx_frame_finish(skb->data);
 820 }
 821
 822 static int pn533_send_async_complete(struct pn533 *dev)
 823 {
 824         struct pn533_cmd *cmd = dev->cmd;
 825         int status = cmd->status;
 826
 827         struct sk_buff *req = cmd->req;
 828         struct sk_buff *resp = cmd->resp;
 829
 830         int rc;
 831
 832         dev_kfree_skb(req);
 833
 834         if (status < 0) {
 835                 rc = cmd->complete_cb(dev, cmd->complete_cb_context,
 836                                       ERR_PTR(status));
 837                 dev_kfree_skb(resp);
 838                 goto done;
 839         }
 840
 841         skb_put(resp, dev->ops->rx_frame_size(resp->data));
 842         skb_pull(resp, dev->ops->rx_header_len);
 843         skb_trim(resp, resp->len - dev->ops->rx_tail_len);
 844
 845         rc = cmd->complete_cb(dev, cmd->complete_cb_context, resp);
 846
 847 done:
 848         kfree(cmd);
 849         dev->cmd = NULL;
 850         return rc;
 851 }
 852
 853 static int __pn533_send_async(struct pn533 *dev, u8 cmd_code,
 854                               struct sk_buff *req, struct sk_buff *resp,
 855                               int resp_len,
 856                               pn533_send_async_complete_t complete_cb,
 857                               void *complete_cb_context)
 858 {
 859         struct pn533_cmd *cmd;
 860         int rc = 0;
 861
 862         nfc_dev_dbg(&dev->interface->dev, "Sending command 0x%x", cmd_code);
 863
 864         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
 865         if (!cmd)
 866                 return -ENOMEM;
 867
 868         cmd->code = cmd_code;
 869         cmd->req = req;
 870         cmd->resp = resp;
 871         cmd->resp_len = resp_len;
 872         cmd->complete_cb = complete_cb;
 873         cmd->complete_cb_context = complete_cb_context;
 874
 875         pn533_build_cmd_frame(dev, cmd_code, req);
 876
 877         mutex_lock(&dev->cmd_lock);
 878
 879         if (!dev->cmd_pending) {
 880                 rc = __pn533_send_frame_async(dev, req, resp, resp_len);
 881                 if (rc)
 882                         goto error;
 883
 884                 dev->cmd_pending = 1;
 885                 dev->cmd = cmd;
 886                 goto unlock;
 887         }
 888
 889         nfc_dev_dbg(&dev->interface->dev, "%s Queueing command 0x%x", __func__,
 890                     cmd_code);
 891
 892         INIT_LIST_HEAD(&cmd->queue);
 893         list_add_tail(&cmd->queue, &dev->cmd_queue);
 894
 895         goto unlock;
 896
 897 error:
 898         kfree(cmd);
 899 unlock:
 900         mutex_unlock(&dev->cmd_lock);
 901         return rc;
 902 }
 903
 904 static int pn533_send_data_async(struct pn533 *dev, u8 cmd_code,
 905                                  struct sk_buff *req,
 906                                  pn533_send_async_complete_t complete_cb,
 907                                  void *complete_cb_context)
 908 {
 909         struct sk_buff *resp;
 910         int rc;
 911         int  resp_len = dev->ops->rx_header_len +
 912                         dev->ops->max_payload_len +
 913                         dev->ops->rx_tail_len;
 914
 915         resp = nfc_alloc_recv_skb(resp_len, GFP_KERNEL);
 916         if (!resp)
 917                 return -ENOMEM;
 918
 919         rc = __pn533_send_async(dev, cmd_code, req, resp, resp_len, complete_cb,
 920                                 complete_cb_context);
 921         if (rc)
 922                 dev_kfree_skb(resp);
 923
 924         return rc;
 925 }
 926
 927 static int pn533_send_cmd_async(struct pn533 *dev, u8 cmd_code,
 928                                 struct sk_buff *req,
 929                                 pn533_send_async_complete_t complete_cb,
 930                                 void *complete_cb_context)
 931 {
 932         struct sk_buff *resp;
 933         int rc;
 934         int  resp_len = dev->ops->rx_header_len +
 935                         dev->ops->max_payload_len +
 936                         dev->ops->rx_tail_len;
 937
 938         resp = alloc_skb(resp_len, GFP_KERNEL);
 939         if (!resp)
 940                 return -ENOMEM;
 941
 942         rc = __pn533_send_async(dev, cmd_code, req, resp, resp_len, complete_cb,
 943                                 complete_cb_context);
 944         if (rc)
 945                 dev_kfree_skb(resp);
 946
 947         return rc;
 948 }
 949
 950 /*
 951  * pn533_send_cmd_direct_async
 952  *
 953  * The function sends a piority cmd directly to the chip omiting the cmd
 954  * queue. It's intended to be used by chaining mechanism of received responses
 955  * where the host has to request every single chunk of data before scheduling
 956  * next cmd from the queue.
 957  */
 958 static int pn533_send_cmd_direct_async(struct pn533 *dev, u8 cmd_code,
 959                                        struct sk_buff *req,
 960                                        pn533_send_async_complete_t complete_cb,
 961                                        void *complete_cb_context)
 962 {
 963         struct sk_buff *resp;
 964         struct pn533_cmd *cmd;
 965         int rc;
 966         int resp_len = dev->ops->rx_header_len +
 967                        dev->ops->max_payload_len +
 968                        dev->ops->rx_tail_len;
 969
 970         resp = alloc_skb(resp_len, GFP_KERNEL);
 971         if (!resp)
 972                 return -ENOMEM;
 973
 974         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
 975         if (!cmd) {
 976                 dev_kfree_skb(resp);
 977                 return -ENOMEM;
 978         }
 979
 980         cmd->code = cmd_code;
 981         cmd->req = req;
 982         cmd->resp = resp;
 983         cmd->resp_len = resp_len;
 984         cmd->complete_cb = complete_cb;
 985         cmd->complete_cb_context = complete_cb_context;
 986
 987         pn533_build_cmd_frame(dev, cmd_code, req);
 988
 989         rc = __pn533_send_frame_async(dev, req, resp, resp_len);
 990         if (rc < 0) {
 991                 dev_kfree_skb(resp);
 992                 kfree(cmd);
 993         } else {
 994                 dev->cmd = cmd;
 995         }
 996
 997         return rc;
 998 }
 999
1000 static void pn533_wq_cmd_complete(struct work_struct *work)
1001 {
1002         struct pn533 *dev = container_of(work, struct pn533, cmd_complete_work);
1003         int rc;
1004
1005         rc = pn533_send_async_complete(dev);
1006         if (rc != -EINPROGRESS)
1007                 queue_work(dev->wq, &dev->cmd_work);
1008 }
1009
1010 static void pn533_wq_cmd(struct work_struct *work)
1011 {
1012         struct pn533 *dev = container_of(work, struct pn533, cmd_work);
1013         struct pn533_cmd *cmd;
1014         int rc;
1015
1016         mutex_lock(&dev->cmd_lock);
1017
1018         if (list_empty(&dev->cmd_queue)) {
1019                 dev->cmd_pending = 0;
1020                 mutex_unlock(&dev->cmd_lock);
1021                 return;
1022         }
1023
1024         cmd = list_first_entry(&dev->cmd_queue, struct pn533_cmd, queue);
1025
1026         list_del(&cmd->queue);
1027
1028         mutex_unlock(&dev->cmd_lock);
1029
1030         rc = __pn533_send_frame_async(dev, cmd->req, cmd->resp, cmd->resp_len);
1031         if (rc < 0) {
1032                 dev_kfree_skb(cmd->req);
1033                 dev_kfree_skb(cmd->resp);
1034                 kfree(cmd);
1035                 return;
1036         }
1037
1038         dev->cmd = cmd;
1039 }
1040
1041 struct pn533_sync_cmd_response {
1042         struct sk_buff *resp;
1043         struct completion done;
1044 };
1045
1046 static int pn533_send_sync_complete(struct pn533 *dev, void *_arg,
1047                                     struct sk_buff *resp)
1048 {
1049         struct pn533_sync_cmd_response *arg = _arg;
1050
1051         arg->resp = resp;
1052         complete(&arg->done);
1053
1054         return 0;
1055 }
1056
1057 /*  pn533_send_cmd_sync
1058  *
1059  *  Please note the req parameter is freed inside the function to
1060  *  limit a number of return value interpretations by the caller.
1061  *
1062  *  1. negative in case of error during TX path -> req should be freed
1063  *
1064  *  2. negative in case of error during RX path -> req should not be freed
1065  *     as it's been already freed at the begining of RX path by
1066  *     async_complete_cb.
1067  *
1068  *  3. valid pointer in case of succesfult RX path
1069  *
1070  *  A caller has to check a return value with IS_ERR macro. If the test pass,
1071  *  the returned pointer is valid.
1072  *
1073  * */
1074 static struct sk_buff *pn533_send_cmd_sync(struct pn533 *dev, u8 cmd_code,
1075                                                struct sk_buff *req)
1076 {
1077         int rc;
1078         struct pn533_sync_cmd_response arg;
1079
1080         init_completion(&arg.done);
1081
1082         rc = pn533_send_cmd_async(dev, cmd_code, req,
1083                                   pn533_send_sync_complete, &arg);
1084         if (rc) {
1085                 dev_kfree_skb(req);
1086                 return ERR_PTR(rc);
1087         }
1088
1089         wait_for_completion(&arg.done);
1090
1091         return arg.resp;
1092 }
1093
1094 static void pn533_send_complete(struct urb *urb)
1095 {
1096         struct pn533 *dev = urb->context;
1097
1098         switch (urb->status) {
1099         case 0:
1100                 break; /* success */
1101         case -ECONNRESET:
1102         case -ENOENT:
1103                 nfc_dev_dbg(&dev->interface->dev,
1104                             "The urb has been stopped (status %d)",
1105                             urb->status);
1106                 break;
1107         case -ESHUTDOWN:
1108         default:
1109                 nfc_dev_err(&dev->interface->dev,
1110                             "Urb failure (status %d)", urb->status);
1111         }
1112 }
1113
1114 static void pn533_abort_cmd(struct pn533 *dev, gfp_t flags)
1115 {
1116         /* ACR122U does not support any command which aborts last
1117          * issued command i.e. as ACK for standard PN533. Additionally,
1118          * it behaves stange, sending broken or incorrect responses,
1119          * when we cancel urb before the chip will send response.
1120          */
1121         if (dev->device_type == PN533_DEVICE_ACR122U)
1122                 return;
1123
1124         /* An ack will cancel the last issued command */
1125         pn533_send_ack(dev, flags);
1126
1127         /* cancel the urb request */
1128         usb_kill_urb(dev->in_urb);
1129 }
1130
1131 static struct sk_buff *pn533_alloc_skb(struct pn533 *dev, unsigned int size)
1132 {
1133         struct sk_buff *skb;
1134
1135         skb = alloc_skb(dev->ops->tx_header_len +
1136                         size +
1137                         dev->ops->tx_tail_len, GFP_KERNEL);
1138
1139         if (skb)
1140                 skb_reserve(skb, dev->ops->tx_header_len);
1141
1142         return skb;
1143 }
1144
1145 struct pn533_target_type_a {
1146         __be16 sens_res;
1147         u8 sel_res;
1148         u8 nfcid_len;
1149         u8 nfcid_data[];
1150 } __packed;
1151
1152
1153 #define PN533_TYPE_A_SENS_RES_NFCID1(x) ((u8)((be16_to_cpu(x) & 0x00C0) >> 6))
1154 #define PN533_TYPE_A_SENS_RES_SSD(x) ((u8)((be16_to_cpu(x) & 0x001F) >> 0))
1155 #define PN533_TYPE_A_SENS_RES_PLATCONF(x) ((u8)((be16_to_cpu(x) & 0x0F00) >> 8))
1156
1157 #define PN533_TYPE_A_SENS_RES_SSD_JEWEL 0x00
1158 #define PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL 0x0C
1159
1160 #define PN533_TYPE_A_SEL_PROT(x) (((x) & 0x60) >> 5)
1161 #define PN533_TYPE_A_SEL_CASCADE(x) (((x) & 0x04) >> 2)
1162
1163 #define PN533_TYPE_A_SEL_PROT_MIFARE 0
1164 #define PN533_TYPE_A_SEL_PROT_ISO14443 1
1165 #define PN533_TYPE_A_SEL_PROT_DEP 2
1166 #define PN533_TYPE_A_SEL_PROT_ISO14443_DEP 3
1167
1168 static bool pn533_target_type_a_is_valid(struct pn533_target_type_a *type_a,
1169                                                         int target_data_len)
1170 {
1171         u8 ssd;
1172         u8 platconf;
1173
1174         if (target_data_len < sizeof(struct pn533_target_type_a))
1175                 return false;
1176
1177         /* The lenght check of nfcid[] and ats[] are not being performed because
1178            the values are not being used */
1179
1180         /* Requirement 4.6.3.3 from NFC Forum Digital Spec */
1181         ssd = PN533_TYPE_A_SENS_RES_SSD(type_a->sens_res);
1182         platconf = PN533_TYPE_A_SENS_RES_PLATCONF(type_a->sens_res);
1183
1184         if ((ssd == PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
1185              platconf != PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL) ||
1186             (ssd != PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
1187              platconf == PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL))
1188                 return false;
1189
1190         /* Requirements 4.8.2.1, 4.8.2.3, 4.8.2.5 and 4.8.2.7 from NFC Forum */
1191         if (PN533_TYPE_A_SEL_CASCADE(type_a->sel_res) != 0)
1192                 return false;
1193
1194         return true;
1195 }
1196
1197 static int pn533_target_found_type_a(struct nfc_target *nfc_tgt, u8 *tgt_data,
1198                                                         int tgt_data_len)
1199 {
1200         struct pn533_target_type_a *tgt_type_a;
1201
1202         tgt_type_a = (struct pn533_target_type_a *)tgt_data;
1203
1204         if (!pn533_target_type_a_is_valid(tgt_type_a, tgt_data_len))
1205                 return -EPROTO;
1206
1207         switch (PN533_TYPE_A_SEL_PROT(tgt_type_a->sel_res)) {
1208         case PN533_TYPE_A_SEL_PROT_MIFARE:
1209                 nfc_tgt->supported_protocols = NFC_PROTO_MIFARE_MASK;
1210                 break;
1211         case PN533_TYPE_A_SEL_PROT_ISO14443:
1212                 nfc_tgt->supported_protocols = NFC_PROTO_ISO14443_MASK;
1213                 break;
1214         case PN533_TYPE_A_SEL_PROT_DEP:
1215                 nfc_tgt->supported_protocols = NFC_PROTO_NFC_DEP_MASK;
1216                 break;
1217         case PN533_TYPE_A_SEL_PROT_ISO14443_DEP:
1218                 nfc_tgt->supported_protocols = NFC_PROTO_ISO14443_MASK |
1219                                                         NFC_PROTO_NFC_DEP_MASK;
1220                 break;
1221         }
1222
1223         nfc_tgt->sens_res = be16_to_cpu(tgt_type_a->sens_res);
1224         nfc_tgt->sel_res = tgt_type_a->sel_res;
1225         nfc_tgt->nfcid1_len = tgt_type_a->nfcid_len;
1226         memcpy(nfc_tgt->nfcid1, tgt_type_a->nfcid_data, nfc_tgt->nfcid1_len);
1227
1228         return 0;
1229 }
1230
1231 struct pn533_target_felica {
1232         u8 pol_res;
1233         u8 opcode;
1234         u8 nfcid2[8];
1235         u8 pad[8];
1236         /* optional */
1237         u8 syst_code[];
1238 } __packed;
1239
1240 #define PN533_FELICA_SENSF_NFCID2_DEP_B1 0x01
1241 #define PN533_FELICA_SENSF_NFCID2_DEP_B2 0xFE
1242
1243 static bool pn533_target_felica_is_valid(struct pn533_target_felica *felica,
1244                                                         int target_data_len)
1245 {
1246         if (target_data_len < sizeof(struct pn533_target_felica))
1247                 return false;
1248
1249         if (felica->opcode != PN533_FELICA_OPC_SENSF_RES)
1250                 return false;
1251
1252         return true;
1253 }
1254
1255 static int pn533_target_found_felica(struct nfc_target *nfc_tgt, u8 *tgt_data,
1256                                                         int tgt_data_len)
1257 {
1258         struct pn533_target_felica *tgt_felica;
1259
1260         tgt_felica = (struct pn533_target_felica *)tgt_data;
1261
1262         if (!pn533_target_felica_is_valid(tgt_felica, tgt_data_len))
1263                 return -EPROTO;
1264
1265         if ((tgt_felica->nfcid2[0] == PN533_FELICA_SENSF_NFCID2_DEP_B1) &&
1266             (tgt_felica->nfcid2[1] == PN533_FELICA_SENSF_NFCID2_DEP_B2))
1267                 nfc_tgt->supported_protocols = NFC_PROTO_NFC_DEP_MASK;
1268         else
1269                 nfc_tgt->supported_protocols = NFC_PROTO_FELICA_MASK;
1270
1271         memcpy(nfc_tgt->sensf_res, &tgt_felica->opcode, 9);
1272         nfc_tgt->sensf_res_len = 9;
1273
1274         return 0;
1275 }
1276
1277 struct pn533_target_jewel {
1278         __be16 sens_res;
1279         u8 jewelid[4];
1280 } __packed;
1281
1282 static bool pn533_target_jewel_is_valid(struct pn533_target_jewel *jewel,
1283                                                         int target_data_len)
1284 {
1285         u8 ssd;
1286         u8 platconf;
1287
1288         if (target_data_len < sizeof(struct pn533_target_jewel))
1289                 return false;
1290
1291         /* Requirement 4.6.3.3 from NFC Forum Digital Spec */
1292         ssd = PN533_TYPE_A_SENS_RES_SSD(jewel->sens_res);
1293         platconf = PN533_TYPE_A_SENS_RES_PLATCONF(jewel->sens_res);
1294
1295         if ((ssd == PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
1296              platconf != PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL) ||
1297             (ssd != PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
1298              platconf == PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL))
1299                 return false;
1300
1301         return true;
1302 }
1303
1304 static int pn533_target_found_jewel(struct nfc_target *nfc_tgt, u8 *tgt_data,
1305                                                         int tgt_data_len)
1306 {
1307         struct pn533_target_jewel *tgt_jewel;
1308
1309         tgt_jewel = (struct pn533_target_jewel *)tgt_data;
1310
1311         if (!pn533_target_jewel_is_valid(tgt_jewel, tgt_data_len))
1312                 return -EPROTO;
1313
1314         nfc_tgt->supported_protocols = NFC_PROTO_JEWEL_MASK;
1315         nfc_tgt->sens_res = be16_to_cpu(tgt_jewel->sens_res);
1316         nfc_tgt->nfcid1_len = 4;
1317         memcpy(nfc_tgt->nfcid1, tgt_jewel->jewelid, nfc_tgt->nfcid1_len);
1318
1319         return 0;
1320 }
1321
1322 struct pn533_type_b_prot_info {
1323         u8 bitrate;
1324         u8 fsci_type;
1325         u8 fwi_adc_fo;
1326 } __packed;
1327
1328 #define PN533_TYPE_B_PROT_FCSI(x) (((x) & 0xF0) >> 4)
1329 #define PN533_TYPE_B_PROT_TYPE(x) (((x) & 0x0F) >> 0)
1330 #define PN533_TYPE_B_PROT_TYPE_RFU_MASK 0x8
1331
1332 struct pn533_type_b_sens_res {
1333         u8 opcode;
1334         u8 nfcid[4];
1335         u8 appdata[4];
1336         struct pn533_type_b_prot_info prot_info;
1337 } __packed;
1338
1339 #define PN533_TYPE_B_OPC_SENSB_RES 0x50
1340
1341 struct pn533_target_type_b {
1342         struct pn533_type_b_sens_res sensb_res;
1343         u8 attrib_res_len;
1344         u8 attrib_res[];
1345 } __packed;
1346
1347 static bool pn533_target_type_b_is_valid(struct pn533_target_type_b *type_b,
1348                                                         int target_data_len)
1349 {
1350         if (target_data_len < sizeof(struct pn533_target_type_b))
1351                 return false;
1352
1353         if (type_b->sensb_res.opcode != PN533_TYPE_B_OPC_SENSB_RES)
1354                 return false;
1355
1356         if (PN533_TYPE_B_PROT_TYPE(type_b->sensb_res.prot_info.fsci_type) &
1357                                                 PN533_TYPE_B_PROT_TYPE_RFU_MASK)
1358                 return false;
1359
1360         return true;
1361 }
1362
1363 static int pn533_target_found_type_b(struct nfc_target *nfc_tgt, u8 *tgt_data,
1364                                                         int tgt_data_len)
1365 {
1366         struct pn533_target_type_b *tgt_type_b;
1367
1368         tgt_type_b = (struct pn533_target_type_b *)tgt_data;
1369
1370         if (!pn533_target_type_b_is_valid(tgt_type_b, tgt_data_len))
1371                 return -EPROTO;
1372
1373         nfc_tgt->supported_protocols = NFC_PROTO_ISO14443_B_MASK;
1374
1375         return 0;
1376 }
1377
1378 static int pn533_target_found(struct pn533 *dev, u8 tg, u8 *tgdata,
1379                               int tgdata_len)
1380 {
1381         struct nfc_target nfc_tgt;
1382         int rc;
1383
1384         nfc_dev_dbg(&dev->interface->dev, "%s - modulation=%d", __func__,
1385                     dev->poll_mod_curr);
1386
1387         if (tg != 1)
1388                 return -EPROTO;
1389
1390         memset(&nfc_tgt, 0, sizeof(struct nfc_target));
1391
1392         switch (dev->poll_mod_curr) {
1393         case PN533_POLL_MOD_106KBPS_A:
1394                 rc = pn533_target_found_type_a(&nfc_tgt, tgdata, tgdata_len);
1395                 break;
1396         case PN533_POLL_MOD_212KBPS_FELICA:
1397         case PN533_POLL_MOD_424KBPS_FELICA:
1398                 rc = pn533_target_found_felica(&nfc_tgt, tgdata, tgdata_len);
1399                 break;
1400         case PN533_POLL_MOD_106KBPS_JEWEL:
1401                 rc = pn533_target_found_jewel(&nfc_tgt, tgdata, tgdata_len);
1402                 break;
1403         case PN533_POLL_MOD_847KBPS_B:
1404                 rc = pn533_target_found_type_b(&nfc_tgt, tgdata, tgdata_len);
1405                 break;
1406         default:
1407                 nfc_dev_err(&dev->interface->dev,
1408                             "Unknown current poll modulation");
1409                 return -EPROTO;
1410         }
1411
1412         if (rc)
1413                 return rc;
1414
1415         if (!(nfc_tgt.supported_protocols & dev->poll_protocols)) {
1416                 nfc_dev_dbg(&dev->interface->dev,
1417                             "The Tg found doesn't have the desired protocol");
1418                 return -EAGAIN;
1419         }
1420
1421         nfc_dev_dbg(&dev->interface->dev,
1422                     "Target found - supported protocols: 0x%x",
1423                     nfc_tgt.supported_protocols);
1424
1425         dev->tgt_available_prots = nfc_tgt.supported_protocols;
1426
1427         nfc_targets_found(dev->nfc_dev, &nfc_tgt, 1);
1428
1429         return 0;
1430 }
1431
1432 static inline void pn533_poll_next_mod(struct pn533 *dev)
1433 {
1434         dev->poll_mod_curr = (dev->poll_mod_curr + 1) % dev->poll_mod_count;
1435 }
1436
1437 static void pn533_poll_reset_mod_list(struct pn533 *dev)
1438 {
1439         dev->poll_mod_count = 0;
1440 }
1441
1442 static void pn533_poll_add_mod(struct pn533 *dev, u8 mod_index)
1443 {
1444         dev->poll_mod_active[dev->poll_mod_count] =
1445                 (struct pn533_poll_modulations *)&poll_mod[mod_index];
1446         dev->poll_mod_count++;
1447 }
1448
1449 static void pn533_poll_create_mod_list(struct pn533 *dev,
1450                                        u32 im_protocols, u32 tm_protocols)
1451 {
1452         pn533_poll_reset_mod_list(dev);
1453
1454         if ((im_protocols & NFC_PROTO_MIFARE_MASK) ||
1455             (im_protocols & NFC_PROTO_ISO14443_MASK) ||
1456             (im_protocols & NFC_PROTO_NFC_DEP_MASK))
1457                 pn533_poll_add_mod(dev, PN533_POLL_MOD_106KBPS_A);
1458
1459         if (im_protocols & NFC_PROTO_FELICA_MASK ||
1460             im_protocols & NFC_PROTO_NFC_DEP_MASK) {
1461                 pn533_poll_add_mod(dev, PN533_POLL_MOD_212KBPS_FELICA);
1462                 pn533_poll_add_mod(dev, PN533_POLL_MOD_424KBPS_FELICA);
1463         }
1464
1465         if (im_protocols & NFC_PROTO_JEWEL_MASK)
1466                 pn533_poll_add_mod(dev, PN533_POLL_MOD_106KBPS_JEWEL);
1467
1468         if (im_protocols & NFC_PROTO_ISO14443_B_MASK)
1469                 pn533_poll_add_mod(dev, PN533_POLL_MOD_847KBPS_B);
1470
1471         if (tm_protocols)
1472                 pn533_poll_add_mod(dev, PN533_LISTEN_MOD);
1473 }
1474
1475 static int pn533_start_poll_complete(struct pn533 *dev, struct sk_buff *resp)
1476 {
1477         u8 nbtg, tg, *tgdata;
1478         int rc, tgdata_len;
1479
1480         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1481
1482         nbtg = resp->data[0];
1483         tg = resp->data[1];
1484         tgdata = &resp->data[2];
1485         tgdata_len = resp->len - 2;  /* nbtg + tg */
1486
1487         if (nbtg) {
1488                 rc = pn533_target_found(dev, tg, tgdata, tgdata_len);
1489
1490                 /* We must stop the poll after a valid target found */
1491                 if (rc == 0) {
1492                         pn533_poll_reset_mod_list(dev);
1493                         return 0;
1494                 }
1495         }
1496
1497         return -EAGAIN;
1498 }
1499
1500 static struct sk_buff *pn533_alloc_poll_tg_frame(struct pn533 *dev)
1501 {
1502         struct sk_buff *skb;
1503         u8 *felica, *nfcid3, *gb;
1504
1505         u8 *gbytes = dev->gb;
1506         size_t gbytes_len = dev->gb_len;
1507
1508         u8 felica_params[18] = {0x1, 0xfe, /* DEP */
1509                                 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, /* random */
1510                                 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
1511                                 0xff, 0xff}; /* System code */
1512
1513         u8 mifare_params[6] = {0x1, 0x1, /* SENS_RES */
1514                                0x0, 0x0, 0x0,
1515                                0x40}; /* SEL_RES for DEP */
1516
1517         unsigned int skb_len = 36 + /* mode (1), mifare (6),
1518                                        felica (18), nfcid3 (10), gb_len (1) */
1519                                gbytes_len +
1520                                1;  /* len Tk*/
1521
1522         skb = pn533_alloc_skb(dev, skb_len);
1523         if (!skb)
1524                 return NULL;
1525
1526         /* DEP support only */
1527         *skb_put(skb, 1) = PN533_INIT_TARGET_DEP;
1528
1529         /* MIFARE params */
1530         memcpy(skb_put(skb, 6), mifare_params, 6);
1531
1532         /* Felica params */
1533         felica = skb_put(skb, 18);
1534         memcpy(felica, felica_params, 18);
1535         get_random_bytes(felica + 2, 6);
1536
1537         /* NFCID3 */
1538         nfcid3 = skb_put(skb, 10);
1539         memset(nfcid3, 0, 10);
1540         memcpy(nfcid3, felica, 8);
1541
1542         /* General bytes */
1543         *skb_put(skb, 1) = gbytes_len;
1544
1545         gb = skb_put(skb, gbytes_len);
1546         memcpy(gb, gbytes, gbytes_len);
1547
1548         /* Len Tk */
1549         *skb_put(skb, 1) = 0;
1550
1551         return skb;
1552 }
1553
1554 #define PN533_CMD_DATAEXCH_HEAD_LEN 1
1555 #define PN533_CMD_DATAEXCH_DATA_MAXLEN 262
1556 static int pn533_tm_get_data_complete(struct pn533 *dev, void *arg,
1557                                       struct sk_buff *resp)
1558 {
1559         u8 status;
1560
1561         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1562
1563         if (IS_ERR(resp))
1564                 return PTR_ERR(resp);
1565
1566         status = resp->data[0];
1567         skb_pull(resp, sizeof(status));
1568
1569         if (status != 0) {
1570                 nfc_tm_deactivated(dev->nfc_dev);
1571                 dev->tgt_mode = 0;
1572                 dev_kfree_skb(resp);
1573                 return 0;
1574         }
1575
1576         return nfc_tm_data_received(dev->nfc_dev, resp);
1577 }
1578
1579 static void pn533_wq_tg_get_data(struct work_struct *work)
1580 {
1581         struct pn533 *dev = container_of(work, struct pn533, tg_work);
1582
1583         struct sk_buff *skb;
1584         int rc;
1585
1586         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1587
1588         skb = pn533_alloc_skb(dev, 0);
1589         if (!skb)
1590                 return;
1591
1592         rc = pn533_send_data_async(dev, PN533_CMD_TG_GET_DATA, skb,
1593                                    pn533_tm_get_data_complete, NULL);
1594
1595         if (rc < 0)
1596                 dev_kfree_skb(skb);
1597
1598         return;
1599 }
1600
1601 #define ATR_REQ_GB_OFFSET 17
1602 static int pn533_init_target_complete(struct pn533 *dev, struct sk_buff *resp)
1603 {
1604         u8 mode, *cmd, comm_mode = NFC_COMM_PASSIVE, *gb;
1605         size_t gb_len;
1606         int rc;
1607
1608         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1609
1610         if (resp->len < ATR_REQ_GB_OFFSET + 1)
1611                 return -EINVAL;
1612
1613         mode = resp->data[0];
1614         cmd = &resp->data[1];
1615
1616         nfc_dev_dbg(&dev->interface->dev, "Target mode 0x%x len %d\n",
1617                     mode, resp->len);
1618
1619         if ((mode & PN533_INIT_TARGET_RESP_FRAME_MASK) ==
1620             PN533_INIT_TARGET_RESP_ACTIVE)
1621                 comm_mode = NFC_COMM_ACTIVE;
1622
1623         if ((mode & PN533_INIT_TARGET_RESP_DEP) == 0)  /* Only DEP supported */
1624                 return -EOPNOTSUPP;
1625
1626         gb = cmd + ATR_REQ_GB_OFFSET;
1627         gb_len = resp->len - (ATR_REQ_GB_OFFSET + 1);
1628
1629         rc = nfc_tm_activated(dev->nfc_dev, NFC_PROTO_NFC_DEP_MASK,
1630                               comm_mode, gb, gb_len);
1631         if (rc < 0) {
1632                 nfc_dev_err(&dev->interface->dev,
1633                             "Error when signaling target activation");
1634                 return rc;
1635         }
1636
1637         dev->tgt_mode = 1;
1638         queue_work(dev->wq, &dev->tg_work);
1639
1640         return 0;
1641 }
1642
1643 static void pn533_listen_mode_timer(unsigned long data)
1644 {
1645         struct pn533 *dev = (struct pn533 *)data;
1646
1647         nfc_dev_dbg(&dev->interface->dev, "Listen mode timeout");
1648
1649         dev->cancel_listen = 1;
1650
1651         pn533_poll_next_mod(dev);
1652
1653         queue_work(dev->wq, &dev->poll_work);
1654 }
1655
1656 static int pn533_poll_complete(struct pn533 *dev, void *arg,
1657                                struct sk_buff *resp)
1658 {
1659         struct pn533_poll_modulations *cur_mod;
1660         int rc;
1661
1662         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1663
1664         if (IS_ERR(resp)) {
1665                 rc = PTR_ERR(resp);
1666
1667                 nfc_dev_err(&dev->interface->dev, "%s  Poll complete error %d",
1668                             __func__, rc);
1669
1670                 if (rc == -ENOENT) {
1671                         if (dev->poll_mod_count != 0)
1672                                 return rc;
1673                         else
1674                                 goto stop_poll;
1675                 } else if (rc < 0) {
1676                         nfc_dev_err(&dev->interface->dev,
1677                                     "Error %d when running poll", rc);
1678                         goto stop_poll;
1679                 }
1680         }
1681
1682         cur_mod = dev->poll_mod_active[dev->poll_mod_curr];
1683
1684         if (cur_mod->len == 0) { /* Target mode */
1685                 del_timer(&dev->listen_timer);
1686                 rc = pn533_init_target_complete(dev, resp);
1687                 goto done;
1688         }
1689
1690         /* Initiator mode */
1691         rc = pn533_start_poll_complete(dev, resp);
1692         if (!rc)
1693                 goto done;
1694
1695         if (!dev->poll_mod_count) {
1696                 nfc_dev_dbg(&dev->interface->dev, "Polling has been stoped.");
1697                 goto done;
1698         }
1699
1700         pn533_poll_next_mod(dev);
1701         queue_work(dev->wq, &dev->poll_work);
1702
1703 done:
1704         dev_kfree_skb(resp);
1705         return rc;
1706
1707 stop_poll:
1708         nfc_dev_err(&dev->interface->dev, "Polling operation has been stopped");
1709
1710         pn533_poll_reset_mod_list(dev);
1711         dev->poll_protocols = 0;
1712         return rc;
1713 }
1714
1715 static struct sk_buff *pn533_alloc_poll_in_frame(struct pn533 *dev,
1716                                         struct pn533_poll_modulations *mod)
1717 {
1718         struct sk_buff *skb;
1719
1720         skb = pn533_alloc_skb(dev, mod->len);
1721         if (!skb)
1722                 return NULL;
1723
1724         memcpy(skb_put(skb, mod->len), &mod->data, mod->len);
1725
1726         return skb;
1727 }
1728
1729 static int pn533_send_poll_frame(struct pn533 *dev)
1730 {
1731         struct pn533_poll_modulations *mod;
1732         struct sk_buff *skb;
1733         int rc;
1734         u8 cmd_code;
1735
1736         mod = dev->poll_mod_active[dev->poll_mod_curr];
1737
1738         nfc_dev_dbg(&dev->interface->dev, "%s mod len %d\n",
1739                     __func__, mod->len);
1740
1741         if (mod->len == 0) {  /* Listen mode */
1742                 cmd_code = PN533_CMD_TG_INIT_AS_TARGET;
1743                 skb = pn533_alloc_poll_tg_frame(dev);
1744         } else {  /* Polling mode */
1745                 cmd_code =  PN533_CMD_IN_LIST_PASSIVE_TARGET;
1746                 skb = pn533_alloc_poll_in_frame(dev, mod);
1747         }
1748
1749         if (!skb) {
1750                 nfc_dev_err(&dev->interface->dev, "Failed to allocate skb.");
1751                 return -ENOMEM;
1752         }
1753
1754         rc = pn533_send_cmd_async(dev, cmd_code, skb, pn533_poll_complete,
1755                                   NULL);
1756         if (rc < 0) {
1757                 dev_kfree_skb(skb);
1758                 nfc_dev_err(&dev->interface->dev, "Polling loop error %d", rc);
1759         }
1760
1761         return rc;
1762 }
1763
1764 static void pn533_wq_poll(struct work_struct *work)
1765 {
1766         struct pn533 *dev = container_of(work, struct pn533, poll_work);
1767         struct pn533_poll_modulations *cur_mod;
1768         int rc;
1769
1770         cur_mod = dev->poll_mod_active[dev->poll_mod_curr];
1771
1772         nfc_dev_dbg(&dev->interface->dev,
1773                     "%s cancel_listen %d modulation len %d",
1774                     __func__, dev->cancel_listen, cur_mod->len);
1775
1776         if (dev->cancel_listen == 1) {
1777                 dev->cancel_listen = 0;
1778                 pn533_abort_cmd(dev, GFP_ATOMIC);
1779         }
1780
1781         rc = pn533_send_poll_frame(dev);
1782         if (rc)
1783                 return;
1784
1785         if (cur_mod->len == 0 && dev->poll_mod_count > 1)
1786                 mod_timer(&dev->listen_timer, jiffies + PN533_LISTEN_TIME * HZ);
1787
1788         return;
1789 }
1790
1791 static int pn533_start_poll(struct nfc_dev *nfc_dev,
1792                             u32 im_protocols, u32 tm_protocols)
1793 {
1794         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
1795
1796         nfc_dev_dbg(&dev->interface->dev,
1797                     "%s: im protocols 0x%x tm protocols 0x%x",
1798                     __func__, im_protocols, tm_protocols);
1799
1800         if (dev->tgt_active_prot) {
1801                 nfc_dev_err(&dev->interface->dev,
1802                             "Cannot poll with a target already activated");
1803                 return -EBUSY;
1804         }
1805
1806         if (dev->tgt_mode) {
1807                 nfc_dev_err(&dev->interface->dev,
1808                             "Cannot poll while already being activated");
1809                 return -EBUSY;
1810         }
1811
1812         if (tm_protocols) {
1813                 dev->gb = nfc_get_local_general_bytes(nfc_dev, &dev->gb_len);
1814                 if (dev->gb == NULL)
1815                         tm_protocols = 0;
1816         }
1817
1818         dev->poll_mod_curr = 0;
1819         pn533_poll_create_mod_list(dev, im_protocols, tm_protocols);
1820         dev->poll_protocols = im_protocols;
1821         dev->listen_protocols = tm_protocols;
1822
1823         return pn533_send_poll_frame(dev);
1824 }
1825
1826 static void pn533_stop_poll(struct nfc_dev *nfc_dev)
1827 {
1828         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
1829
1830         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1831
1832         del_timer(&dev->listen_timer);
1833
1834         if (!dev->poll_mod_count) {
1835                 nfc_dev_dbg(&dev->interface->dev,
1836                             "Polling operation was not running");
1837                 return;
1838         }
1839
1840         pn533_abort_cmd(dev, GFP_KERNEL);
1841         pn533_poll_reset_mod_list(dev);
1842 }
1843
1844 static int pn533_activate_target_nfcdep(struct pn533 *dev)
1845 {
1846         struct pn533_cmd_activate_response *rsp;
1847         u16 gt_len;
1848         int rc;
1849
1850         struct sk_buff *skb;
1851         struct sk_buff *resp;
1852
1853         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1854
1855         skb = pn533_alloc_skb(dev, sizeof(u8) * 2); /*TG + Next*/
1856         if (!skb)
1857                 return -ENOMEM;
1858
1859         *skb_put(skb, sizeof(u8)) = 1; /* TG */
1860         *skb_put(skb, sizeof(u8)) = 0; /* Next */
1861
1862         resp = pn533_send_cmd_sync(dev, PN533_CMD_IN_ATR, skb);
1863         if (IS_ERR(resp))
1864                 return PTR_ERR(resp);
1865
1866         rsp = (struct pn533_cmd_activate_response *)resp->data;
1867         rc = rsp->status & PN533_CMD_RET_MASK;
1868         if (rc != PN533_CMD_RET_SUCCESS) {
1869                 nfc_dev_err(&dev->interface->dev,
1870                             "Target activation failed (error 0x%x)", rc);
1871                 dev_kfree_skb(resp);
1872                 return -EIO;
1873         }
1874
1875         /* ATR_RES general bytes are located at offset 16 */
1876         gt_len = resp->len - 16;
1877         rc = nfc_set_remote_general_bytes(dev->nfc_dev, rsp->gt, gt_len);
1878
1879         dev_kfree_skb(resp);
1880         return rc;
1881 }
1882
1883 static int pn533_activate_target(struct nfc_dev *nfc_dev,
1884                                  struct nfc_target *target, u32 protocol)
1885 {
1886         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
1887         int rc;
1888
1889         nfc_dev_dbg(&dev->interface->dev, "%s - protocol=%u", __func__,
1890                     protocol);
1891
1892         if (dev->poll_mod_count) {
1893                 nfc_dev_err(&dev->interface->dev,
1894                             "Cannot activate while polling");
1895                 return -EBUSY;
1896         }
1897
1898         if (dev->tgt_active_prot) {
1899                 nfc_dev_err(&dev->interface->dev,
1900                             "There is already an active target");
1901                 return -EBUSY;
1902         }
1903
1904         if (!dev->tgt_available_prots) {
1905                 nfc_dev_err(&dev->interface->dev,
1906                             "There is no available target to activate");
1907                 return -EINVAL;
1908         }
1909
1910         if (!(dev->tgt_available_prots & (1 << protocol))) {
1911                 nfc_dev_err(&dev->interface->dev,
1912                             "Target doesn't support requested proto %u",
1913                             protocol);
1914                 return -EINVAL;
1915         }
1916
1917         if (protocol == NFC_PROTO_NFC_DEP) {
1918                 rc = pn533_activate_target_nfcdep(dev);
1919                 if (rc) {
1920                         nfc_dev_err(&dev->interface->dev,
1921                                     "Activating target with DEP failed %d", rc);
1922                         return rc;
1923                 }
1924         }
1925
1926         dev->tgt_active_prot = protocol;
1927         dev->tgt_available_prots = 0;
1928
1929         return 0;
1930 }
1931
1932 static void pn533_deactivate_target(struct nfc_dev *nfc_dev,
1933                                     struct nfc_target *target)
1934 {
1935         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
1936
1937         struct sk_buff *skb;
1938         struct sk_buff *resp;
1939
1940         int rc;
1941
1942         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1943
1944         if (!dev->tgt_active_prot) {
1945                 nfc_dev_err(&dev->interface->dev, "There is no active target");
1946                 return;
1947         }
1948
1949         dev->tgt_active_prot = 0;
1950         skb_queue_purge(&dev->resp_q);
1951
1952         skb = pn533_alloc_skb(dev, sizeof(u8));
1953         if (!skb)
1954                 return;
1955
1956         *skb_put(skb, 1) = 1; /* TG*/
1957
1958         resp = pn533_send_cmd_sync(dev, PN533_CMD_IN_RELEASE, skb);
1959         if (IS_ERR(resp))
1960                 return;
1961
1962         rc = resp->data[0] & PN533_CMD_RET_MASK;
1963         if (rc != PN533_CMD_RET_SUCCESS)
1964                 nfc_dev_err(&dev->interface->dev,
1965                             "Error 0x%x when releasing the target", rc);
1966
1967         dev_kfree_skb(resp);
1968         return;
1969 }
1970
1971
1972 static int pn533_in_dep_link_up_complete(struct pn533 *dev, void *arg,
1973                                          struct sk_buff *resp)
1974 {
1975         struct pn533_cmd_jump_dep_response *rsp;
1976         u8 target_gt_len;
1977         int rc;
1978         u8 active = *(u8 *)arg;
1979
1980         kfree(arg);
1981
1982         if (IS_ERR(resp))
1983                 return PTR_ERR(resp);
1984
1985         if (dev->tgt_available_prots &&
1986             !(dev->tgt_available_prots & (1 << NFC_PROTO_NFC_DEP))) {
1987                 nfc_dev_err(&dev->interface->dev,
1988                             "The target does not support DEP");
1989                 rc =  -EINVAL;
1990                 goto error;
1991         }
1992
1993         rsp = (struct pn533_cmd_jump_dep_response *)resp->data;
1994
1995         rc = rsp->status & PN533_CMD_RET_MASK;
1996         if (rc != PN533_CMD_RET_SUCCESS) {
1997                 nfc_dev_err(&dev->interface->dev,
1998                             "Bringing DEP link up failed (error 0x%x)", rc);
1999                 goto error;
2000         }
2001
2002         if (!dev->tgt_available_prots) {
2003                 struct nfc_target nfc_target;
2004
2005                 nfc_dev_dbg(&dev->interface->dev, "Creating new target");
2006
2007                 nfc_target.supported_protocols = NFC_PROTO_NFC_DEP_MASK;
2008                 nfc_target.nfcid1_len = 10;
2009                 memcpy(nfc_target.nfcid1, rsp->nfcid3t, nfc_target.nfcid1_len);
2010                 rc = nfc_targets_found(dev->nfc_dev, &nfc_target, 1);
2011                 if (rc)
2012                         goto error;
2013
2014                 dev->tgt_available_prots = 0;
2015         }
2016
2017         dev->tgt_active_prot = NFC_PROTO_NFC_DEP;
2018
2019         /* ATR_RES general bytes are located at offset 17 */
2020         target_gt_len = resp->len - 17;
2021         rc = nfc_set_remote_general_bytes(dev->nfc_dev,
2022                                           rsp->gt, target_gt_len);
2023         if (rc == 0)
2024                 rc = nfc_dep_link_is_up(dev->nfc_dev,
2025                                         dev->nfc_dev->targets[0].idx,
2026                                         !active, NFC_RF_INITIATOR);
2027
2028 error:
2029         dev_kfree_skb(resp);
2030         return rc;
2031 }
2032
2033 static int pn533_mod_to_baud(struct pn533 *dev)
2034 {
2035         switch (dev->poll_mod_curr) {
2036         case PN533_POLL_MOD_106KBPS_A:
2037                 return 0;
2038         case PN533_POLL_MOD_212KBPS_FELICA:
2039                 return 1;
2040         case PN533_POLL_MOD_424KBPS_FELICA:
2041                 return 2;
2042         default:
2043                 return -EINVAL;
2044         }
2045 }
2046
2047 #define PASSIVE_DATA_LEN 5
2048 static int pn533_dep_link_up(struct nfc_dev *nfc_dev, struct nfc_target *target,
2049                              u8 comm_mode, u8 *gb, size_t gb_len)
2050 {
2051         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2052         struct sk_buff *skb;
2053         int rc, baud, skb_len;
2054         u8 *next, *arg;
2055
2056         u8 passive_data[PASSIVE_DATA_LEN] = {0x00, 0xff, 0xff, 0x00, 0x3};
2057
2058         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
2059
2060         if (dev->poll_mod_count) {
2061                 nfc_dev_err(&dev->interface->dev,
2062                             "Cannot bring the DEP link up while polling");
2063                 return -EBUSY;
2064         }
2065
2066         if (dev->tgt_active_prot) {
2067                 nfc_dev_err(&dev->interface->dev,
2068                             "There is already an active target");
2069                 return -EBUSY;
2070         }
2071
2072         baud = pn533_mod_to_baud(dev);
2073         if (baud < 0) {
2074                 nfc_dev_err(&dev->interface->dev,
2075                             "Invalid curr modulation %d", dev->poll_mod_curr);
2076                 return baud;
2077         }
2078
2079         skb_len = 3 + gb_len; /* ActPass + BR + Next */
2080         if (comm_mode == NFC_COMM_PASSIVE)
2081                 skb_len += PASSIVE_DATA_LEN;
2082
2083         skb = pn533_alloc_skb(dev, skb_len);
2084         if (!skb)
2085                 return -ENOMEM;
2086
2087         *skb_put(skb, 1) = !comm_mode;  /* ActPass */
2088         *skb_put(skb, 1) = baud;  /* Baud rate */
2089
2090         next = skb_put(skb, 1);  /* Next */
2091         *next = 0;
2092
2093         if (comm_mode == NFC_COMM_PASSIVE && baud > 0) {
2094                 memcpy(skb_put(skb, PASSIVE_DATA_LEN), passive_data,
2095                        PASSIVE_DATA_LEN);
2096                 *next |= 1;
2097         }
2098
2099         if (gb != NULL && gb_len > 0) {
2100                 memcpy(skb_put(skb, gb_len), gb, gb_len);
2101                 *next |= 4; /* We have some Gi */
2102         } else {
2103                 *next = 0;
2104         }
2105
2106         arg = kmalloc(sizeof(*arg), GFP_KERNEL);
2107         if (!arg) {
2108                 dev_kfree_skb(skb);
2109                 return -ENOMEM;
2110         }
2111
2112         *arg = !comm_mode;
2113
2114         rc = pn533_send_cmd_async(dev, PN533_CMD_IN_JUMP_FOR_DEP, skb,
2115                                   pn533_in_dep_link_up_complete, arg);
2116
2117         if (rc < 0) {
2118                 dev_kfree_skb(skb);
2119                 kfree(arg);
2120         }
2121
2122         return rc;
2123 }
2124
2125 static int pn533_dep_link_down(struct nfc_dev *nfc_dev)
2126 {
2127         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2128
2129         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
2130
2131         pn533_poll_reset_mod_list(dev);
2132
2133         if (dev->tgt_mode || dev->tgt_active_prot)
2134                 pn533_abort_cmd(dev, GFP_KERNEL);
2135
2136         dev->tgt_active_prot = 0;
2137         dev->tgt_mode = 0;
2138
2139         skb_queue_purge(&dev->resp_q);
2140
2141         return 0;
2142 }
2143
2144 struct pn533_data_exchange_arg {
2145         data_exchange_cb_t cb;
2146         void *cb_context;
2147 };
2148
2149 static struct sk_buff *pn533_build_response(struct pn533 *dev)
2150 {
2151         struct sk_buff *skb, *tmp, *t;
2152         unsigned int skb_len = 0, tmp_len = 0;
2153
2154         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
2155
2156         if (skb_queue_empty(&dev->resp_q))
2157                 return NULL;
2158
2159         if (skb_queue_len(&dev->resp_q) == 1) {
2160                 skb = skb_dequeue(&dev->resp_q);
2161                 goto out;
2162         }
2163
2164         skb_queue_walk_safe(&dev->resp_q, tmp, t)
2165                 skb_len += tmp->len;
2166
2167         nfc_dev_dbg(&dev->interface->dev, "%s total length %d\n",
2168                     __func__, skb_len);
2169
2170         skb = alloc_skb(skb_len, GFP_KERNEL);
2171         if (skb == NULL)
2172                 goto out;
2173
2174         skb_put(skb, skb_len);
2175
2176         skb_queue_walk_safe(&dev->resp_q, tmp, t) {
2177                 memcpy(skb->data + tmp_len, tmp->data, tmp->len);
2178                 tmp_len += tmp->len;
2179         }
2180
2181 out:
2182         skb_queue_purge(&dev->resp_q);
2183
2184         return skb;
2185 }
2186
2187 static int pn533_data_exchange_complete(struct pn533 *dev, void *_arg,
2188                                         struct sk_buff *resp)
2189 {
2190         struct pn533_data_exchange_arg *arg = _arg;
2191         struct sk_buff *skb;
2192         int rc = 0;
2193         u8 status, ret, mi;
2194
2195         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
2196
2197         if (IS_ERR(resp)) {
2198                 rc = PTR_ERR(resp);
2199                 goto _error;
2200         }
2201
2202         status = resp->data[0];
2203         ret = status & PN533_CMD_RET_MASK;
2204         mi = status & PN533_CMD_MI_MASK;
2205
2206         skb_pull(resp, sizeof(status));
2207
2208         if (ret != PN533_CMD_RET_SUCCESS) {
2209                 nfc_dev_err(&dev->interface->dev,
2210                             "Exchanging data failed (error 0x%x)", ret);
2211                 rc = -EIO;
2212                 goto error;
2213         }
2214
2215         skb_queue_tail(&dev->resp_q, resp);
2216
2217         if (mi) {
2218                 dev->cmd_complete_mi_arg = arg;
2219                 queue_work(dev->wq, &dev->mi_work);
2220                 return -EINPROGRESS;
2221         }
2222
2223         skb = pn533_build_response(dev);
2224         if (!skb)
2225                 goto error;
2226
2227         arg->cb(arg->cb_context, skb, 0);
2228         kfree(arg);
2229         return 0;
2230
2231 error:
2232         dev_kfree_skb(resp);
2233 _error:
2234         skb_queue_purge(&dev->resp_q);
2235         arg->cb(arg->cb_context, NULL, rc);
2236         kfree(arg);
2237         return rc;
2238 }
2239
2240 static int pn533_transceive(struct nfc_dev *nfc_dev,
2241                             struct nfc_target *target, struct sk_buff *skb,
2242                             data_exchange_cb_t cb, void *cb_context)
2243 {
2244         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2245         struct pn533_data_exchange_arg *arg = NULL;
2246         int rc;
2247
2248         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
2249
2250         if (skb->len > PN533_CMD_DATAEXCH_DATA_MAXLEN) {
2251                 /* TODO: Implement support to multi-part data exchange */
2252                 nfc_dev_err(&dev->interface->dev,
2253                             "Data length greater than the max allowed: %d",
2254                             PN533_CMD_DATAEXCH_DATA_MAXLEN);
2255                 rc = -ENOSYS;
2256                 goto error;
2257         }
2258
2259         if (!dev->tgt_active_prot) {
2260                 nfc_dev_err(&dev->interface->dev,
2261                             "Can't exchange data if there is no active target");
2262                 rc = -EINVAL;
2263                 goto error;
2264         }
2265
2266         arg = kmalloc(sizeof(*arg), GFP_KERNEL);
2267         if (!arg) {
2268                 rc = -ENOMEM;
2269                 goto error;
2270         }
2271
2272         arg->cb = cb;
2273         arg->cb_context = cb_context;
2274
2275         switch (dev->device_type) {
2276         case PN533_DEVICE_PASORI:
2277                 if (dev->tgt_active_prot == NFC_PROTO_FELICA) {
2278                         rc = pn533_send_data_async(dev, PN533_CMD_IN_COMM_THRU,
2279                                                    skb,
2280                                                    pn533_data_exchange_complete,
2281                                                    arg);
2282
2283                         break;
2284                 }
2285         default:
2286                 *skb_push(skb, sizeof(u8)) =  1; /*TG*/
2287
2288                 rc = pn533_send_data_async(dev, PN533_CMD_IN_DATA_EXCHANGE,
2289                                            skb, pn533_data_exchange_complete,
2290                                            arg);
2291
2292                 break;
2293         }
2294
2295         if (rc < 0) /* rc from send_async */
2296                 goto error;
2297
2298         return 0;
2299
2300 error:
2301         kfree(arg);
2302         dev_kfree_skb(skb);
2303         return rc;
2304 }
2305
2306 static int pn533_tm_send_complete(struct pn533 *dev, void *arg,
2307                                   struct sk_buff *resp)
2308 {
2309         u8 status;
2310
2311         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
2312
2313         if (IS_ERR(resp))
2314                 return PTR_ERR(resp);
2315
2316         status = resp->data[0];
2317
2318         dev_kfree_skb(resp);
2319
2320         if (status != 0) {
2321                 nfc_tm_deactivated(dev->nfc_dev);
2322
2323                 dev->tgt_mode = 0;
2324
2325                 return 0;
2326         }
2327
2328         queue_work(dev->wq, &dev->tg_work);
2329
2330         return 0;
2331 }
2332
2333 static int pn533_tm_send(struct nfc_dev *nfc_dev, struct sk_buff *skb)
2334 {
2335         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2336         int rc;
2337
2338         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
2339
2340         if (skb->len > PN533_CMD_DATAEXCH_DATA_MAXLEN) {
2341                 nfc_dev_err(&dev->interface->dev,
2342                             "Data length greater than the max allowed: %d",
2343                             PN533_CMD_DATAEXCH_DATA_MAXLEN);
2344                 return -ENOSYS;
2345         }
2346
2347         rc = pn533_send_data_async(dev, PN533_CMD_TG_SET_DATA, skb,
2348                                    pn533_tm_send_complete, NULL);
2349         if (rc < 0)
2350                 dev_kfree_skb(skb);
2351
2352         return rc;
2353 }
2354
2355 static void pn533_wq_mi_recv(struct work_struct *work)
2356 {
2357         struct pn533 *dev = container_of(work, struct pn533, mi_work);
2358
2359         struct sk_buff *skb;
2360         int rc;
2361
2362         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
2363
2364         skb = pn533_alloc_skb(dev, PN533_CMD_DATAEXCH_HEAD_LEN);
2365         if (!skb)
2366                 goto error;
2367
2368         switch (dev->device_type) {
2369         case PN533_DEVICE_PASORI:
2370                 if (dev->tgt_active_prot == NFC_PROTO_FELICA) {
2371                         rc = pn533_send_cmd_direct_async(dev,
2372                                                 PN533_CMD_IN_COMM_THRU,
2373                                                 skb,
2374                                                 pn533_data_exchange_complete,
2375                                                  dev->cmd_complete_mi_arg);
2376
2377                         break;
2378                 }
2379         default:
2380                 *skb_put(skb, sizeof(u8)) =  1; /*TG*/
2381
2382                 rc = pn533_send_cmd_direct_async(dev,
2383                                                  PN533_CMD_IN_DATA_EXCHANGE,
2384                                                  skb,
2385                                                  pn533_data_exchange_complete,
2386                                                  dev->cmd_complete_mi_arg);
2387
2388                 break;
2389         }
2390
2391         if (rc == 0) /* success */
2392                 return;
2393
2394         nfc_dev_err(&dev->interface->dev,
2395                     "Error %d when trying to perform data_exchange", rc);
2396
2397         dev_kfree_skb(skb);
2398         kfree(dev->cmd_complete_mi_arg);
2399
2400 error:
2401         pn533_send_ack(dev, GFP_KERNEL);
2402         queue_work(dev->wq, &dev->cmd_work);
2403 }
2404
2405 static int pn533_set_configuration(struct pn533 *dev, u8 cfgitem, u8 *cfgdata,
2406                                                                 u8 cfgdata_len)
2407 {
2408         struct sk_buff *skb;
2409         struct sk_buff *resp;
2410
2411         int skb_len;
2412
2413         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
2414
2415         skb_len = sizeof(cfgitem) + cfgdata_len; /* cfgitem + cfgdata */
2416
2417         skb = pn533_alloc_skb(dev, skb_len);
2418         if (!skb)
2419                 return -ENOMEM;
2420
2421         *skb_put(skb, sizeof(cfgitem)) = cfgitem;
2422         memcpy(skb_put(skb, cfgdata_len), cfgdata, cfgdata_len);
2423
2424         resp = pn533_send_cmd_sync(dev, PN533_CMD_RF_CONFIGURATION, skb);
2425         if (IS_ERR(resp))
2426                 return PTR_ERR(resp);
2427
2428         dev_kfree_skb(resp);
2429         return 0;
2430 }
2431
2432 static int pn533_get_firmware_version(struct pn533 *dev,
2433                                       struct pn533_fw_version *fv)
2434 {
2435         struct sk_buff *skb;
2436         struct sk_buff *resp;
2437
2438         skb = pn533_alloc_skb(dev, 0);
2439         if (!skb)
2440                 return -ENOMEM;
2441
2442         resp = pn533_send_cmd_sync(dev, PN533_CMD_GET_FIRMWARE_VERSION, skb);
2443         if (IS_ERR(resp))
2444                 return PTR_ERR(resp);
2445
2446         fv->ic = resp->data[0];
2447         fv->ver = resp->data[1];
2448         fv->rev = resp->data[2];
2449         fv->support = resp->data[3];
2450
2451         dev_kfree_skb(resp);
2452         return 0;
2453 }
2454
2455 static int pn533_pasori_fw_reset(struct pn533 *dev)
2456 {
2457         struct sk_buff *skb;
2458         struct sk_buff *resp;
2459
2460         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
2461
2462         skb = pn533_alloc_skb(dev, sizeof(u8));
2463         if (!skb)
2464                 return -ENOMEM;
2465
2466         *skb_put(skb, sizeof(u8)) = 0x1;
2467
2468         resp = pn533_send_cmd_sync(dev, 0x18, skb);
2469         if (IS_ERR(resp))
2470                 return PTR_ERR(resp);
2471
2472         dev_kfree_skb(resp);
2473
2474         return 0;
2475 }
2476
2477 struct pn533_acr122_poweron_rdr_arg {
2478         int rc;
2479         struct completion done;
2480 };
2481
2482 static void pn533_acr122_poweron_rdr_resp(struct urb *urb)
2483 {
2484         struct pn533_acr122_poweron_rdr_arg *arg = urb->context;
2485
2486         nfc_dev_dbg(&urb->dev->dev, "%s", __func__);
2487
2488         print_hex_dump(KERN_ERR, "ACR122 RX: ", DUMP_PREFIX_NONE, 16, 1,
2489                        urb->transfer_buffer, urb->transfer_buffer_length,
2490                        false);
2491
2492         arg->rc = urb->status;
2493         complete(&arg->done);
2494 }
2495
2496 static int pn533_acr122_poweron_rdr(struct pn533 *dev)
2497 {
2498         /* Power on th reader (CCID cmd) */
2499         u8 cmd[10] = {PN533_ACR122_PC_TO_RDR_ICCPOWERON,
2500                       0, 0, 0, 0, 0, 0, 3, 0, 0};
2501         u8 buf[255];
2502         int rc;
2503         void *cntx;
2504         struct pn533_acr122_poweron_rdr_arg arg;
2505
2506         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
2507
2508         init_completion(&arg.done);
2509         cntx = dev->in_urb->context;  /* backup context */
2510
2511         dev->in_urb->transfer_buffer = buf;
2512         dev->in_urb->transfer_buffer_length = 255;
2513         dev->in_urb->complete = pn533_acr122_poweron_rdr_resp;
2514         dev->in_urb->context = &arg;
2515
2516         dev->out_urb->transfer_buffer = cmd;
2517         dev->out_urb->transfer_buffer_length = sizeof(cmd);
2518
2519         print_hex_dump(KERN_ERR, "ACR122 TX: ", DUMP_PREFIX_NONE, 16, 1,
2520                        cmd, sizeof(cmd), false);
2521
2522         rc = usb_submit_urb(dev->out_urb, GFP_KERNEL);
2523         if (rc) {
2524                 nfc_dev_err(&dev->interface->dev,
2525                             "Reader power on cmd error %d", rc);
2526                 return rc;
2527         }
2528
2529         rc =  usb_submit_urb(dev->in_urb, GFP_KERNEL);
2530         if (rc) {
2531                 nfc_dev_err(&dev->interface->dev,
2532                             "Can't submit for reader power on cmd response %d",
2533                             rc);
2534                 return rc;
2535         }
2536
2537         wait_for_completion(&arg.done);
2538         dev->in_urb->context = cntx; /* restore context */
2539
2540         return arg.rc;
2541 }
2542
2543 static struct nfc_ops pn533_nfc_ops = {
2544         .dev_up = NULL,
2545         .dev_down = NULL,
2546         .dep_link_up = pn533_dep_link_up,
2547         .dep_link_down = pn533_dep_link_down,
2548         .start_poll = pn533_start_poll,
2549         .stop_poll = pn533_stop_poll,
2550         .activate_target = pn533_activate_target,
2551         .deactivate_target = pn533_deactivate_target,
2552         .im_transceive = pn533_transceive,
2553         .tm_send = pn533_tm_send,
2554 };
2555
2556 static int pn533_setup(struct pn533 *dev)
2557 {
2558         struct pn533_config_max_retries max_retries;
2559         struct pn533_config_timing timing;
2560         u8 pasori_cfg[3] = {0x08, 0x01, 0x08};
2561         int rc;
2562
2563         switch (dev->device_type) {
2564         case PN533_DEVICE_STD:
2565                 max_retries.mx_rty_atr = PN533_CONFIG_MAX_RETRIES_ENDLESS;
2566                 max_retries.mx_rty_psl = 2;
2567                 max_retries.mx_rty_passive_act =
2568                         PN533_CONFIG_MAX_RETRIES_NO_RETRY;
2569
2570                 timing.rfu = PN533_CONFIG_TIMING_102;
2571                 timing.atr_res_timeout = PN533_CONFIG_TIMING_204;
2572                 timing.dep_timeout = PN533_CONFIG_TIMING_409;
2573
2574                 break;
2575
2576         case PN533_DEVICE_PASORI:
2577         case PN533_DEVICE_ACR122U:
2578                 max_retries.mx_rty_atr = 0x2;
2579                 max_retries.mx_rty_psl = 0x1;
2580                 max_retries.mx_rty_passive_act =
2581                         PN533_CONFIG_MAX_RETRIES_NO_RETRY;
2582
2583                 timing.rfu = PN533_CONFIG_TIMING_102;
2584                 timing.atr_res_timeout = PN533_CONFIG_TIMING_102;
2585                 timing.dep_timeout = PN533_CONFIG_TIMING_204;
2586
2587                 break;
2588
2589         default:
2590                 nfc_dev_err(&dev->interface->dev, "Unknown device type %d\n",
2591                             dev->device_type);
2592                 return -EINVAL;
2593         }
2594
2595         rc = pn533_set_configuration(dev, PN533_CFGITEM_MAX_RETRIES,
2596                                      (u8 *)&max_retries, sizeof(max_retries));
2597         if (rc) {
2598                 nfc_dev_err(&dev->interface->dev,
2599                             "Error on setting MAX_RETRIES config");
2600                 return rc;
2601         }
2602
2603
2604         rc = pn533_set_configuration(dev, PN533_CFGITEM_TIMING,
2605                                      (u8 *)&timing, sizeof(timing));
2606         if (rc) {
2607                 nfc_dev_err(&dev->interface->dev,
2608                             "Error on setting RF timings");
2609                 return rc;
2610         }
2611
2612         switch (dev->device_type) {
2613         case PN533_DEVICE_STD:
2614                 break;
2615
2616         case PN533_DEVICE_PASORI:
2617                 pn533_pasori_fw_reset(dev);
2618
2619                 rc = pn533_set_configuration(dev, PN533_CFGITEM_PASORI,
2620                                              pasori_cfg, 3);
2621                 if (rc) {
2622                         nfc_dev_err(&dev->interface->dev,
2623                                     "Error while settings PASORI config");
2624                         return rc;
2625                 }
2626
2627                 pn533_pasori_fw_reset(dev);
2628
2629                 break;
2630         }
2631
2632         return 0;
2633 }
2634
2635 static int pn533_probe(struct usb_interface *interface,
2636                         const struct usb_device_id *id)
2637 {
2638         struct pn533_fw_version fw_ver;
2639         struct pn533 *dev;
2640         struct usb_host_interface *iface_desc;
2641         struct usb_endpoint_descriptor *endpoint;
2642         int in_endpoint = 0;
2643         int out_endpoint = 0;
2644         int rc = -ENOMEM;
2645         int i;
2646         u32 protocols;
2647
2648         dev = kzalloc(sizeof(*dev), GFP_KERNEL);
2649         if (!dev)
2650                 return -ENOMEM;
2651
2652         dev->udev = usb_get_dev(interface_to_usbdev(interface));
2653         dev->interface = interface;
2654         mutex_init(&dev->cmd_lock);
2655
2656         iface_desc = interface->cur_altsetting;
2657         for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
2658                 endpoint = &iface_desc->endpoint[i].desc;
2659
2660                 if (!in_endpoint && usb_endpoint_is_bulk_in(endpoint))
2661                         in_endpoint = endpoint->bEndpointAddress;
2662
2663                 if (!out_endpoint && usb_endpoint_is_bulk_out(endpoint))
2664                         out_endpoint = endpoint->bEndpointAddress;
2665         }
2666
2667         if (!in_endpoint || !out_endpoint) {
2668                 nfc_dev_err(&interface->dev,
2669                             "Could not find bulk-in or bulk-out endpoint");
2670                 rc = -ENODEV;
2671                 goto error;
2672         }
2673
2674         dev->in_urb = usb_alloc_urb(0, GFP_KERNEL);
2675         dev->out_urb = usb_alloc_urb(0, GFP_KERNEL);
2676
2677         if (!dev->in_urb || !dev->out_urb)
2678                 goto error;
2679
2680         usb_fill_bulk_urb(dev->in_urb, dev->udev,
2681                           usb_rcvbulkpipe(dev->udev, in_endpoint),
2682                           NULL, 0, NULL, dev);
2683         usb_fill_bulk_urb(dev->out_urb, dev->udev,
2684                           usb_sndbulkpipe(dev->udev, out_endpoint),
2685                           NULL, 0, pn533_send_complete, dev);
2686
2687         INIT_WORK(&dev->cmd_work, pn533_wq_cmd);
2688         INIT_WORK(&dev->cmd_complete_work, pn533_wq_cmd_complete);
2689         INIT_WORK(&dev->mi_work, pn533_wq_mi_recv);
2690         INIT_WORK(&dev->tg_work, pn533_wq_tg_get_data);
2691         INIT_WORK(&dev->poll_work, pn533_wq_poll);
2692         dev->wq = alloc_ordered_workqueue("pn533", 0);
2693         if (dev->wq == NULL)
2694                 goto error;
2695
2696         init_timer(&dev->listen_timer);
2697         dev->listen_timer.data = (unsigned long) dev;
2698         dev->listen_timer.function = pn533_listen_mode_timer;
2699
2700         skb_queue_head_init(&dev->resp_q);
2701
2702         INIT_LIST_HEAD(&dev->cmd_queue);
2703
2704         usb_set_intfdata(interface, dev);
2705
2706         dev->ops = &pn533_std_frame_ops;
2707
2708         dev->protocol_type = PN533_PROTO_REQ_ACK_RESP;
2709         dev->device_type = id->driver_info;
2710         switch (dev->device_type) {
2711         case PN533_DEVICE_STD:
2712                 protocols = PN533_ALL_PROTOCOLS;
2713                 break;
2714
2715         case PN533_DEVICE_PASORI:
2716                 protocols = PN533_NO_TYPE_B_PROTOCOLS;
2717                 break;
2718
2719         case PN533_DEVICE_ACR122U:
2720                 protocols = PN533_NO_TYPE_B_PROTOCOLS;
2721                 dev->ops = &pn533_acr122_frame_ops;
2722                 dev->protocol_type = PN533_PROTO_REQ_RESP,
2723
2724                 rc = pn533_acr122_poweron_rdr(dev);
2725                 if (rc < 0) {
2726                         nfc_dev_err(&dev->interface->dev,
2727                                     "Couldn't poweron the reader (error %d)",
2728                                     rc);
2729                         goto destroy_wq;
2730                 }
2731                 break;
2732
2733         default:
2734                 nfc_dev_err(&dev->interface->dev, "Unknown device type %d\n",
2735                             dev->device_type);
2736                 rc = -EINVAL;
2737                 goto destroy_wq;
2738         }
2739
2740         memset(&fw_ver, 0, sizeof(fw_ver));
2741         rc = pn533_get_firmware_version(dev, &fw_ver);
2742         if (rc < 0)
2743                 goto destroy_wq;
2744
2745         nfc_dev_info(&dev->interface->dev,
2746                      "NXP PN533 firmware ver %d.%d now attached",
2747                      fw_ver.ver, fw_ver.rev);
2748
2749
2750         dev->nfc_dev = nfc_allocate_device(&pn533_nfc_ops, protocols,
2751                                            NFC_SE_NONE,
2752                                            dev->ops->tx_header_len +
2753                                            PN533_CMD_DATAEXCH_HEAD_LEN,
2754                                            dev->ops->tx_tail_len);
2755         if (!dev->nfc_dev)
2756                 goto destroy_wq;
2757
2758         nfc_set_parent_dev(dev->nfc_dev, &interface->dev);
2759         nfc_set_drvdata(dev->nfc_dev, dev);
2760
2761         rc = nfc_register_device(dev->nfc_dev);
2762         if (rc)
2763                 goto free_nfc_dev;
2764
2765         rc = pn533_setup(dev);
2766         if (rc)
2767                 goto unregister_nfc_dev;
2768
2769         return 0;
2770
2771 unregister_nfc_dev:
2772         nfc_unregister_device(dev->nfc_dev);
2773
2774 free_nfc_dev:
2775         nfc_free_device(dev->nfc_dev);
2776
2777 destroy_wq:
2778         destroy_workqueue(dev->wq);
2779 error:
2780         usb_free_urb(dev->in_urb);
2781         usb_free_urb(dev->out_urb);
2782         usb_put_dev(dev->udev);
2783         kfree(dev);
2784         return rc;
2785 }
2786
2787 static void pn533_disconnect(struct usb_interface *interface)
2788 {
2789         struct pn533 *dev;
2790         struct pn533_cmd *cmd, *n;
2791
2792         dev = usb_get_intfdata(interface);
2793         usb_set_intfdata(interface, NULL);
2794
2795         nfc_unregister_device(dev->nfc_dev);
2796         nfc_free_device(dev->nfc_dev);
2797
2798         usb_kill_urb(dev->in_urb);
2799         usb_kill_urb(dev->out_urb);
2800
2801         destroy_workqueue(dev->wq);
2802
2803         skb_queue_purge(&dev->resp_q);
2804
2805         del_timer(&dev->listen_timer);
2806
2807         list_for_each_entry_safe(cmd, n, &dev->cmd_queue, queue) {
2808                 list_del(&cmd->queue);
2809                 kfree(cmd);
2810         }
2811
2812         usb_free_urb(dev->in_urb);
2813         usb_free_urb(dev->out_urb);
2814         kfree(dev);
2815
2816         nfc_dev_info(&interface->dev, "NXP PN533 NFC device disconnected");
2817 }
2818
2819 static struct usb_driver pn533_driver = {
2820         .name =         "pn533",
2821         .probe =        pn533_probe,
2822         .disconnect =   pn533_disconnect,
2823         .id_table =     pn533_table,
2824 };
2825
2826 module_usb_driver(pn533_driver);
2827
2828 MODULE_AUTHOR("Lauro Ramos Venancio <lauro.venancio@openbossa.org>");
2829 MODULE_AUTHOR("Aloisio Almeida Jr <aloisio.almeida@openbossa.org>");
2830 MODULE_AUTHOR("Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>");
2831 MODULE_DESCRIPTION("PN533 usb driver ver " VERSION);
2832 MODULE_VERSION(VERSION);
2833 MODULE_LICENSE("GPL");