drivers/nfc/pn533.c

   1 /*
   2  * Copyright (C) 2011 Instituto Nokia de Tecnologia
   3  *
   4  * Authors:
   5  *    Lauro Ramos Venancio <lauro.venancio@openbossa.org>
   6  *    Aloisio Almeida Jr <aloisio.almeida@openbossa.org>
   7  *
   8  * This program is free software; you can redistribute it and/or modify
   9  * it under the terms of the GNU General Public License as published by
  10  * the Free Software Foundation; either version 2 of the License, or
  11  * (at your option) any later version.
  12  *
  13  * This program is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  16  * GNU General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License
  19  * along with this program; if not, write to the
  20  * Free Software Foundation, Inc.,
  21  * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
  22  */
  23
  24 #include <linux/device.h>
  25 #include <linux/kernel.h>
  26 #include <linux/module.h>
  27 #include <linux/slab.h>
  28 #include <linux/usb.h>
  29 #include <linux/nfc.h>
  30 #include <linux/netdevice.h>
  31 #include <net/nfc/nfc.h>
  32
  33 #define VERSION "0.1"
  34
  35 #define PN533_VENDOR_ID 0x4CC
  36 #define PN533_PRODUCT_ID 0x2533
  37
  38 #define SCM_VENDOR_ID 0x4E6
  39 #define SCL3711_PRODUCT_ID 0x5591
  40
  41 #define SONY_VENDOR_ID         0x054c
  42 #define PASORI_PRODUCT_ID      0x02e1
  43
  44 #define PN533_DEVICE_STD    0x1
  45 #define PN533_DEVICE_PASORI 0x2
  46
  47 #define PN533_ALL_PROTOCOLS (NFC_PROTO_JEWEL_MASK | NFC_PROTO_MIFARE_MASK |\
  48                              NFC_PROTO_FELICA_MASK | NFC_PROTO_ISO14443_MASK |\
  49                              NFC_PROTO_NFC_DEP_MASK |\
  50                              NFC_PROTO_ISO14443_B_MASK)
  51
  52 #define PN533_NO_TYPE_B_PROTOCOLS (NFC_PROTO_JEWEL_MASK | \
  53                                    NFC_PROTO_MIFARE_MASK | \
  54                                    NFC_PROTO_FELICA_MASK | \
  55                                    NFC_PROTO_ISO14443_MASK | \
  56                                    NFC_PROTO_NFC_DEP_MASK)
  57
  58 static const struct usb_device_id pn533_table[] = {
  59         { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE,
  60           .idVendor             = PN533_VENDOR_ID,
  61           .idProduct            = PN533_PRODUCT_ID,
  62           .driver_info          = PN533_DEVICE_STD,
  63         },
  64         { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE,
  65           .idVendor             = SCM_VENDOR_ID,
  66           .idProduct            = SCL3711_PRODUCT_ID,
  67           .driver_info          = PN533_DEVICE_STD,
  68         },
  69         { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE,
  70           .idVendor             = SONY_VENDOR_ID,
  71           .idProduct            = PASORI_PRODUCT_ID,
  72           .driver_info          = PN533_DEVICE_PASORI,
  73         },
  74         { }
  75 };
  76 MODULE_DEVICE_TABLE(usb, pn533_table);
  77
  78 /* How much time we spend listening for initiators */
  79 #define PN533_LISTEN_TIME 2
  80
  81 /* frame definitions */
  82 #define PN533_NORMAL_FRAME_MAX_LEN 262  /* 6   (PREAMBLE, SOF, LEN, LCS, TFI)
  83                                            254 (DATA)
  84                                            2   (DCS, postamble) */
  85 #define PN533_FRAME_HEADER_LEN (sizeof(struct pn533_frame) \
  86                                         + 2) /* data[0] TFI, data[1] CC */
  87 #define PN533_FRAME_TAIL_LEN 2 /* data[len] DCS, data[len + 1] postamble*/
  88
  89 /*
  90  * Max extended frame payload len, excluding TFI and CC
  91  * which are already in PN533_FRAME_HEADER_LEN.
  92  */
  93 #define PN533_FRAME_MAX_PAYLOAD_LEN 263
  94
  95 #define PN533_FRAME_SIZE(f) (sizeof(struct pn533_frame) + f->datalen + \
  96                                 PN533_FRAME_TAIL_LEN)
  97 #define PN533_FRAME_ACK_SIZE (sizeof(struct pn533_frame) + 1)
  98 #define PN533_FRAME_CHECKSUM(f) (f->data[f->datalen])
  99 #define PN533_FRAME_POSTAMBLE(f) (f->data[f->datalen + 1])
 100
 101 /* start of frame */
 102 #define PN533_SOF 0x00FF
 103
 104 /* frame identifier: in/out/error */
 105 #define PN533_FRAME_IDENTIFIER(f) (f->data[0])
 106 #define PN533_DIR_OUT 0xD4
 107 #define PN533_DIR_IN 0xD5
 108
 109 /* PN533 Commands */
 110 #define PN533_FRAME_CMD(f) (f->data[1])
 111 #define PN533_FRAME_CMD_PARAMS_PTR(f) (&f->data[2])
 112 #define PN533_FRAME_CMD_PARAMS_LEN(f) (f->datalen - 2)
 113
 114 #define PN533_CMD_GET_FIRMWARE_VERSION 0x02
 115 #define PN533_CMD_RF_CONFIGURATION 0x32
 116 #define PN533_CMD_IN_DATA_EXCHANGE 0x40
 117 #define PN533_CMD_IN_COMM_THRU     0x42
 118 #define PN533_CMD_IN_LIST_PASSIVE_TARGET 0x4A
 119 #define PN533_CMD_IN_ATR 0x50
 120 #define PN533_CMD_IN_RELEASE 0x52
 121 #define PN533_CMD_IN_JUMP_FOR_DEP 0x56
 122
 123 #define PN533_CMD_TG_INIT_AS_TARGET 0x8c
 124 #define PN533_CMD_TG_GET_DATA 0x86
 125 #define PN533_CMD_TG_SET_DATA 0x8e
 126 #define PN533_CMD_UNDEF 0xff
 127
 128 #define PN533_CMD_RESPONSE(cmd) (cmd + 1)
 129
 130 /* PN533 Return codes */
 131 #define PN533_CMD_RET_MASK 0x3F
 132 #define PN533_CMD_MI_MASK 0x40
 133 #define PN533_CMD_RET_SUCCESS 0x00
 134
 135 struct pn533;
 136
 137 typedef int (*pn533_cmd_complete_t) (struct pn533 *dev, void *arg,
 138                                         u8 *params, int params_len);
 139
 140 typedef int (*pn533_send_async_complete_t) (struct pn533 *dev, void *arg,
 141                                         struct sk_buff *resp);
 142
 143 /* structs for pn533 commands */
 144
 145 /* PN533_CMD_GET_FIRMWARE_VERSION */
 146 struct pn533_fw_version {
 147         u8 ic;
 148         u8 ver;
 149         u8 rev;
 150         u8 support;
 151 };
 152
 153 /* PN533_CMD_RF_CONFIGURATION */
 154 #define PN533_CFGITEM_TIMING 0x02
 155 #define PN533_CFGITEM_MAX_RETRIES 0x05
 156 #define PN533_CFGITEM_PASORI 0x82
 157
 158 #define PN533_CONFIG_TIMING_102 0xb
 159 #define PN533_CONFIG_TIMING_204 0xc
 160 #define PN533_CONFIG_TIMING_409 0xd
 161 #define PN533_CONFIG_TIMING_819 0xe
 162
 163 #define PN533_CONFIG_MAX_RETRIES_NO_RETRY 0x00
 164 #define PN533_CONFIG_MAX_RETRIES_ENDLESS 0xFF
 165
 166 struct pn533_config_max_retries {
 167         u8 mx_rty_atr;
 168         u8 mx_rty_psl;
 169         u8 mx_rty_passive_act;
 170 } __packed;
 171
 172 struct pn533_config_timing {
 173         u8 rfu;
 174         u8 atr_res_timeout;
 175         u8 dep_timeout;
 176 } __packed;
 177
 178 /* PN533_CMD_IN_LIST_PASSIVE_TARGET */
 179
 180 /* felica commands opcode */
 181 #define PN533_FELICA_OPC_SENSF_REQ 0
 182 #define PN533_FELICA_OPC_SENSF_RES 1
 183 /* felica SENSF_REQ parameters */
 184 #define PN533_FELICA_SENSF_SC_ALL 0xFFFF
 185 #define PN533_FELICA_SENSF_RC_NO_SYSTEM_CODE 0
 186 #define PN533_FELICA_SENSF_RC_SYSTEM_CODE 1
 187 #define PN533_FELICA_SENSF_RC_ADVANCED_PROTOCOL 2
 188
 189 /* type B initiator_data values */
 190 #define PN533_TYPE_B_AFI_ALL_FAMILIES 0
 191 #define PN533_TYPE_B_POLL_METHOD_TIMESLOT 0
 192 #define PN533_TYPE_B_POLL_METHOD_PROBABILISTIC 1
 193
 194 union pn533_cmd_poll_initdata {
 195         struct {
 196                 u8 afi;
 197                 u8 polling_method;
 198         } __packed type_b;
 199         struct {
 200                 u8 opcode;
 201                 __be16 sc;
 202                 u8 rc;
 203                 u8 tsn;
 204         } __packed felica;
 205 };
 206
 207 /* Poll modulations */
 208 enum {
 209         PN533_POLL_MOD_106KBPS_A,
 210         PN533_POLL_MOD_212KBPS_FELICA,
 211         PN533_POLL_MOD_424KBPS_FELICA,
 212         PN533_POLL_MOD_106KBPS_JEWEL,
 213         PN533_POLL_MOD_847KBPS_B,
 214         PN533_LISTEN_MOD,
 215
 216         __PN533_POLL_MOD_AFTER_LAST,
 217 };
 218 #define PN533_POLL_MOD_MAX (__PN533_POLL_MOD_AFTER_LAST - 1)
 219
 220 struct pn533_poll_modulations {
 221         struct {
 222                 u8 maxtg;
 223                 u8 brty;
 224                 union pn533_cmd_poll_initdata initiator_data;
 225         } __packed data;
 226         u8 len;
 227 };
 228
 229 const struct pn533_poll_modulations poll_mod[] = {
 230         [PN533_POLL_MOD_106KBPS_A] = {
 231                 .data = {
 232                         .maxtg = 1,
 233                         .brty = 0,
 234                 },
 235                 .len = 2,
 236         },
 237         [PN533_POLL_MOD_212KBPS_FELICA] = {
 238                 .data = {
 239                         .maxtg = 1,
 240                         .brty = 1,
 241                         .initiator_data.felica = {
 242                                 .opcode = PN533_FELICA_OPC_SENSF_REQ,
 243                                 .sc = PN533_FELICA_SENSF_SC_ALL,
 244                                 .rc = PN533_FELICA_SENSF_RC_NO_SYSTEM_CODE,
 245                                 .tsn = 0,
 246                         },
 247                 },
 248                 .len = 7,
 249         },
 250         [PN533_POLL_MOD_424KBPS_FELICA] = {
 251                 .data = {
 252                         .maxtg = 1,
 253                         .brty = 2,
 254                         .initiator_data.felica = {
 255                                 .opcode = PN533_FELICA_OPC_SENSF_REQ,
 256                                 .sc = PN533_FELICA_SENSF_SC_ALL,
 257                                 .rc = PN533_FELICA_SENSF_RC_NO_SYSTEM_CODE,
 258                                 .tsn = 0,
 259                         },
 260                  },
 261                 .len = 7,
 262         },
 263         [PN533_POLL_MOD_106KBPS_JEWEL] = {
 264                 .data = {
 265                         .maxtg = 1,
 266                         .brty = 4,
 267                 },
 268                 .len = 2,
 269         },
 270         [PN533_POLL_MOD_847KBPS_B] = {
 271                 .data = {
 272                         .maxtg = 1,
 273                         .brty = 8,
 274                         .initiator_data.type_b = {
 275                                 .afi = PN533_TYPE_B_AFI_ALL_FAMILIES,
 276                                 .polling_method =
 277                                         PN533_TYPE_B_POLL_METHOD_TIMESLOT,
 278                         },
 279                 },
 280                 .len = 3,
 281         },
 282         [PN533_LISTEN_MOD] = {
 283                 .len = 0,
 284         },
 285 };
 286
 287 /* PN533_CMD_IN_ATR */
 288
 289 struct pn533_cmd_activate_param {
 290         u8 tg;
 291         u8 next;
 292 } __packed;
 293
 294 struct pn533_cmd_activate_response {
 295         u8 status;
 296         u8 nfcid3t[10];
 297         u8 didt;
 298         u8 bst;
 299         u8 brt;
 300         u8 to;
 301         u8 ppt;
 302         /* optional */
 303         u8 gt[];
 304 } __packed;
 305
 306 /* PN533_CMD_IN_JUMP_FOR_DEP */
 307 struct pn533_cmd_jump_dep {
 308         u8 active;
 309         u8 baud;
 310         u8 next;
 311         u8 data[];
 312 } __packed;
 313
 314 struct pn533_cmd_jump_dep_response {
 315         u8 status;
 316         u8 tg;
 317         u8 nfcid3t[10];
 318         u8 didt;
 319         u8 bst;
 320         u8 brt;
 321         u8 to;
 322         u8 ppt;
 323         /* optional */
 324         u8 gt[];
 325 } __packed;
 326
 327
 328 /* PN533_TG_INIT_AS_TARGET */
 329 #define PN533_INIT_TARGET_PASSIVE 0x1
 330 #define PN533_INIT_TARGET_DEP 0x2
 331
 332 #define PN533_INIT_TARGET_RESP_FRAME_MASK 0x3
 333 #define PN533_INIT_TARGET_RESP_ACTIVE     0x1
 334 #define PN533_INIT_TARGET_RESP_DEP        0x4
 335
 336 struct pn533_cmd_init_target {
 337         u8 mode;
 338         u8 mifare[6];
 339         u8 felica[18];
 340         u8 nfcid3[10];
 341         u8 gb_len;
 342         u8 gb[];
 343 } __packed;
 344
 345 struct pn533_cmd_init_target_response {
 346         u8 mode;
 347         u8 cmd[];
 348 } __packed;
 349
 350 struct pn533 {
 351         struct usb_device *udev;
 352         struct usb_interface *interface;
 353         struct nfc_dev *nfc_dev;
 354
 355         struct urb *out_urb;
 356         struct pn533_frame *out_frame;
 357
 358         struct urb *in_urb;
 359         struct pn533_frame *in_frame;
 360
 361         struct sk_buff_head resp_q;
 362
 363         struct workqueue_struct *wq;
 364         struct work_struct cmd_work;
 365         struct work_struct cmd_complete_work;
 366         struct work_struct poll_work;
 367         struct work_struct mi_work;
 368         struct work_struct tg_work;
 369         struct timer_list listen_timer;
 370         struct pn533_frame *wq_in_frame;
 371         int wq_in_error;
 372         int cancel_listen;
 373
 374         pn533_cmd_complete_t cmd_complete;
 375         void *cmd_complete_arg;
 376         struct mutex cmd_lock;
 377         u8 cmd;
 378
 379         struct pn533_poll_modulations *poll_mod_active[PN533_POLL_MOD_MAX + 1];
 380         u8 poll_mod_count;
 381         u8 poll_mod_curr;
 382         u32 poll_protocols;
 383         u32 listen_protocols;
 384
 385         u8 *gb;
 386         size_t gb_len;
 387
 388         u8 tgt_available_prots;
 389         u8 tgt_active_prot;
 390         u8 tgt_mode;
 391
 392         u32 device_type;
 393
 394         struct list_head cmd_queue;
 395         u8 cmd_pending;
 396 };
 397
 398 struct pn533_cmd {
 399         struct list_head queue;
 400         struct pn533_frame *out_frame;
 401         struct pn533_frame *in_frame;
 402         int in_frame_len;
 403         u8 cmd_code;
 404         struct sk_buff *req;
 405         struct sk_buff *resp;
 406         pn533_cmd_complete_t cmd_complete;
 407         void *arg;
 408 };
 409
 410 struct pn533_frame {
 411         u8 preamble;
 412         __be16 start_frame;
 413         u8 datalen;
 414         u8 datalen_checksum;
 415         u8 data[];
 416 } __packed;
 417
 418 /* The rule: value + checksum = 0 */
 419 static inline u8 pn533_checksum(u8 value)
 420 {
 421         return ~value + 1;
 422 }
 423
 424 /* The rule: sum(data elements) + checksum = 0 */
 425 static u8 pn533_data_checksum(u8 *data, int datalen)
 426 {
 427         u8 sum = 0;
 428         int i;
 429
 430         for (i = 0; i < datalen; i++)
 431                 sum += data[i];
 432
 433         return pn533_checksum(sum);
 434 }
 435
 436 /**
 437  * pn533_tx_frame_ack - create a ack frame
 438  * @frame:      The frame to be set as ack
 439  *
 440  * Ack is different type of standard frame. As a standard frame, it has
 441  * preamble and start_frame. However the checksum of this frame must fail,
 442  * i.e. datalen + datalen_checksum must NOT be zero. When the checksum test
 443  * fails and datalen = 0 and datalen_checksum = 0xFF, the frame is a ack.
 444  * After datalen_checksum field, the postamble is placed.
 445  */
 446 static void pn533_tx_frame_ack(struct pn533_frame *frame)
 447 {
 448         frame->preamble = 0;
 449         frame->start_frame = cpu_to_be16(PN533_SOF);
 450         frame->datalen = 0;
 451         frame->datalen_checksum = 0xFF;
 452         /* data[0] is used as postamble */
 453         frame->data[0] = 0;
 454 }
 455
 456 static void pn533_tx_frame_init(struct pn533_frame *frame, u8 cmd)
 457 {
 458         frame->preamble = 0;
 459         frame->start_frame = cpu_to_be16(PN533_SOF);
 460         PN533_FRAME_IDENTIFIER(frame) = PN533_DIR_OUT;
 461         PN533_FRAME_CMD(frame) = cmd;
 462         frame->datalen = 2;
 463 }
 464
 465 static void pn533_tx_frame_finish(struct pn533_frame *frame)
 466 {
 467         frame->datalen_checksum = pn533_checksum(frame->datalen);
 468
 469         PN533_FRAME_CHECKSUM(frame) =
 470                 pn533_data_checksum(frame->data, frame->datalen);
 471
 472         PN533_FRAME_POSTAMBLE(frame) = 0;
 473 }
 474
 475 static bool pn533_rx_frame_is_valid(struct pn533_frame *frame)
 476 {
 477         u8 checksum;
 478
 479         if (frame->start_frame != cpu_to_be16(PN533_SOF))
 480                 return false;
 481
 482         checksum = pn533_checksum(frame->datalen);
 483         if (checksum != frame->datalen_checksum)
 484                 return false;
 485
 486         checksum = pn533_data_checksum(frame->data, frame->datalen);
 487         if (checksum != PN533_FRAME_CHECKSUM(frame))
 488                 return false;
 489
 490         return true;
 491 }
 492
 493 static bool pn533_rx_frame_is_ack(struct pn533_frame *frame)
 494 {
 495         if (frame->start_frame != cpu_to_be16(PN533_SOF))
 496                 return false;
 497
 498         if (frame->datalen != 0 || frame->datalen_checksum != 0xFF)
 499                 return false;
 500
 501         return true;
 502 }
 503
 504 static bool pn533_rx_frame_is_cmd_response(struct pn533_frame *frame, u8 cmd)
 505 {
 506         return (PN533_FRAME_CMD(frame) == PN533_CMD_RESPONSE(cmd));
 507 }
 508
 509
 510 static void pn533_wq_cmd_complete(struct work_struct *work)
 511 {
 512         struct pn533 *dev = container_of(work, struct pn533, cmd_complete_work);
 513         struct pn533_frame *in_frame;
 514         int rc;
 515
 516         in_frame = dev->wq_in_frame;
 517
 518         if (dev->wq_in_error)
 519                 rc = dev->cmd_complete(dev, dev->cmd_complete_arg, NULL,
 520                                                         dev->wq_in_error);
 521         else
 522                 rc = dev->cmd_complete(dev, dev->cmd_complete_arg,
 523                                         PN533_FRAME_CMD_PARAMS_PTR(in_frame),
 524                                         PN533_FRAME_CMD_PARAMS_LEN(in_frame));
 525
 526         if (rc != -EINPROGRESS)
 527                 queue_work(dev->wq, &dev->cmd_work);
 528 }
 529
 530 static void pn533_recv_response(struct urb *urb)
 531 {
 532         struct pn533 *dev = urb->context;
 533         struct pn533_frame *in_frame;
 534
 535         dev->wq_in_frame = NULL;
 536
 537         switch (urb->status) {
 538         case 0:
 539                 /* success */
 540                 break;
 541         case -ECONNRESET:
 542         case -ENOENT:
 543         case -ESHUTDOWN:
 544                 nfc_dev_dbg(&dev->interface->dev, "Urb shutting down with"
 545                                                 " status: %d", urb->status);
 546                 dev->wq_in_error = urb->status;
 547                 goto sched_wq;
 548         default:
 549                 nfc_dev_err(&dev->interface->dev, "Nonzero urb status received:"
 550                                                         " %d", urb->status);
 551                 dev->wq_in_error = urb->status;
 552                 goto sched_wq;
 553         }
 554
 555         in_frame = dev->in_urb->transfer_buffer;
 556
 557         if (!pn533_rx_frame_is_valid(in_frame)) {
 558                 nfc_dev_err(&dev->interface->dev, "Received an invalid frame");
 559                 dev->wq_in_error = -EIO;
 560                 goto sched_wq;
 561         }
 562
 563         if (!pn533_rx_frame_is_cmd_response(in_frame, dev->cmd)) {
 564                 nfc_dev_err(&dev->interface->dev, "The received frame is not "
 565                                                 "response to the last command");
 566                 dev->wq_in_error = -EIO;
 567                 goto sched_wq;
 568         }
 569
 570         nfc_dev_dbg(&dev->interface->dev, "Received a valid frame");
 571         dev->wq_in_error = 0;
 572         dev->wq_in_frame = in_frame;
 573
 574 sched_wq:
 575         queue_work(dev->wq, &dev->cmd_complete_work);
 576 }
 577
 578 static int pn533_submit_urb_for_response(struct pn533 *dev, gfp_t flags)
 579 {
 580         dev->in_urb->complete = pn533_recv_response;
 581
 582         return usb_submit_urb(dev->in_urb, flags);
 583 }
 584
 585 static void pn533_recv_ack(struct urb *urb)
 586 {
 587         struct pn533 *dev = urb->context;
 588         struct pn533_frame *in_frame;
 589         int rc;
 590
 591         switch (urb->status) {
 592         case 0:
 593                 /* success */
 594                 break;
 595         case -ECONNRESET:
 596         case -ENOENT:
 597         case -ESHUTDOWN:
 598                 nfc_dev_dbg(&dev->interface->dev, "Urb shutting down with"
 599                                                 " status: %d", urb->status);
 600                 dev->wq_in_error = urb->status;
 601                 goto sched_wq;
 602         default:
 603                 nfc_dev_err(&dev->interface->dev, "Nonzero urb status received:"
 604                                                         " %d", urb->status);
 605                 dev->wq_in_error = urb->status;
 606                 goto sched_wq;
 607         }
 608
 609         in_frame = dev->in_urb->transfer_buffer;
 610
 611         if (!pn533_rx_frame_is_ack(in_frame)) {
 612                 nfc_dev_err(&dev->interface->dev, "Received an invalid ack");
 613                 dev->wq_in_error = -EIO;
 614                 goto sched_wq;
 615         }
 616
 617         nfc_dev_dbg(&dev->interface->dev, "Received a valid ack");
 618
 619         rc = pn533_submit_urb_for_response(dev, GFP_ATOMIC);
 620         if (rc) {
 621                 nfc_dev_err(&dev->interface->dev, "usb_submit_urb failed with"
 622                                                         " result %d", rc);
 623                 dev->wq_in_error = rc;
 624                 goto sched_wq;
 625         }
 626
 627         return;
 628
 629 sched_wq:
 630         dev->wq_in_frame = NULL;
 631         queue_work(dev->wq, &dev->cmd_complete_work);
 632 }
 633
 634 static int pn533_submit_urb_for_ack(struct pn533 *dev, gfp_t flags)
 635 {
 636         dev->in_urb->complete = pn533_recv_ack;
 637
 638         return usb_submit_urb(dev->in_urb, flags);
 639 }
 640
 641 static int pn533_send_ack(struct pn533 *dev, gfp_t flags)
 642 {
 643         int rc;
 644
 645         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
 646
 647         pn533_tx_frame_ack(dev->out_frame);
 648
 649         dev->out_urb->transfer_buffer = dev->out_frame;
 650         dev->out_urb->transfer_buffer_length = PN533_FRAME_ACK_SIZE;
 651         rc = usb_submit_urb(dev->out_urb, flags);
 652
 653         return rc;
 654 }
 655
 656 static int __pn533_send_cmd_frame_async(struct pn533 *dev,
 657                                         struct pn533_frame *out_frame,
 658                                         struct pn533_frame *in_frame,
 659                                         int in_frame_len,
 660                                         pn533_cmd_complete_t cmd_complete,
 661                                         void *arg)
 662 {
 663         int rc;
 664
 665         nfc_dev_dbg(&dev->interface->dev, "Sending command 0x%x",
 666                                                 PN533_FRAME_CMD(out_frame));
 667
 668         dev->cmd = PN533_FRAME_CMD(out_frame);
 669         dev->cmd_complete = cmd_complete;
 670         dev->cmd_complete_arg = arg;
 671
 672         dev->out_urb->transfer_buffer = out_frame;
 673         dev->out_urb->transfer_buffer_length =
 674                                 PN533_FRAME_SIZE(out_frame);
 675
 676         dev->in_urb->transfer_buffer = in_frame;
 677         dev->in_urb->transfer_buffer_length = in_frame_len;
 678
 679         rc = usb_submit_urb(dev->out_urb, GFP_KERNEL);
 680         if (rc)
 681                 return rc;
 682
 683         rc = pn533_submit_urb_for_ack(dev, GFP_KERNEL);
 684         if (rc)
 685                 goto error;
 686
 687         return 0;
 688
 689 error:
 690         usb_unlink_urb(dev->out_urb);
 691         return rc;
 692 }
 693
 694 static void pn533_build_cmd_frame(u8 cmd_code, struct sk_buff *skb)
 695 {
 696         struct pn533_frame *frame;
 697         /* payload is already there, just update datalen */
 698         int payload_len = skb->len;
 699
 700         skb_push(skb, PN533_FRAME_HEADER_LEN);
 701         skb_put(skb, PN533_FRAME_TAIL_LEN);
 702
 703         frame = (struct pn533_frame *)skb->data;
 704
 705         pn533_tx_frame_init(frame, cmd_code);
 706         frame->datalen += payload_len;
 707         pn533_tx_frame_finish(frame);
 708 }
 709
 710 struct pn533_send_async_complete_arg {
 711         pn533_send_async_complete_t  complete_cb;
 712         void *complete_cb_context;
 713         struct sk_buff *resp;
 714         struct sk_buff *req;
 715 };
 716
 717 static int pn533_send_async_complete(struct pn533 *dev, void *_arg, u8 *params,
 718                                      int params_len)
 719 {
 720         struct pn533_send_async_complete_arg *arg = _arg;
 721
 722         struct sk_buff *req = arg->req;
 723         struct sk_buff *resp = arg->resp;
 724
 725         struct pn533_frame *frame = (struct pn533_frame *)resp->data;
 726         int rc;
 727
 728         dev_kfree_skb(req);
 729
 730         if (params_len < 0) {
 731                 nfc_dev_err(&dev->interface->dev,
 732                             "Error %d when starting as a target",
 733                             params_len);
 734
 735                 arg->complete_cb(dev, arg->complete_cb_context,
 736                                  ERR_PTR(params_len));
 737                 rc = params_len;
 738                 dev_kfree_skb(resp);
 739                 goto out;
 740         }
 741
 742         skb_put(resp, PN533_FRAME_SIZE(frame));
 743         skb_pull(resp, PN533_FRAME_HEADER_LEN);
 744         skb_trim(resp, resp->len - PN533_FRAME_TAIL_LEN);
 745
 746         rc = arg->complete_cb(dev, arg->complete_cb_context, resp);
 747
 748 out:
 749         kfree(arg);
 750         return rc;
 751 }
 752
 753 static int __pn533_send_async(struct pn533 *dev, u8 cmd_code,
 754                               struct sk_buff *req, struct sk_buff *resp,
 755                               int resp_len,
 756                               pn533_send_async_complete_t complete_cb,
 757                               void *complete_cb_context)
 758 {
 759         struct pn533_cmd *cmd;
 760         struct pn533_send_async_complete_arg *arg;
 761         int rc = 0;
 762
 763         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
 764
 765         arg = kzalloc(sizeof(arg), GFP_KERNEL);
 766         if (!arg)
 767                 return -ENOMEM;
 768
 769         arg->complete_cb = complete_cb;
 770         arg->complete_cb_context = complete_cb_context;
 771         arg->resp = resp;
 772         arg->req = req;
 773
 774         pn533_build_cmd_frame(cmd_code, req);
 775
 776         mutex_lock(&dev->cmd_lock);
 777
 778         if (!dev->cmd_pending) {
 779                 rc = __pn533_send_cmd_frame_async(dev,
 780                                                   (struct pn533_frame *)req->data,
 781                                                   (struct pn533_frame *)resp->data,
 782                                                   resp_len, pn533_send_async_complete,
 783                                                   arg);
 784                 if (rc)
 785                         goto error;
 786
 787                 dev->cmd_pending = 1;
 788                 goto unlock;
 789         }
 790
 791         nfc_dev_dbg(&dev->interface->dev, "%s Queueing command", __func__);
 792
 793         cmd = kzalloc(sizeof(struct pn533_cmd), GFP_KERNEL);
 794         if (!cmd) {
 795                 rc = -ENOMEM;
 796                 goto error;
 797         }
 798
 799         INIT_LIST_HEAD(&cmd->queue);
 800         cmd->cmd_code = cmd_code;
 801         cmd->req = req;
 802         cmd->resp = resp;
 803         cmd->arg = arg;
 804
 805         list_add_tail(&cmd->queue, &dev->cmd_queue);
 806
 807         goto unlock;
 808
 809 error:
 810         kfree(arg);
 811 unlock:
 812         mutex_unlock(&dev->cmd_lock);
 813         return rc;
 814 }
 815
 816 static int pn533_send_data_async(struct pn533 *dev, u8 cmd_code,
 817                                  struct sk_buff *req,
 818                                  pn533_send_async_complete_t complete_cb,
 819                                  void *complete_cb_context)
 820 {
 821         struct sk_buff *resp;
 822         int rc;
 823         int  resp_len = PN533_FRAME_HEADER_LEN +
 824                         PN533_FRAME_MAX_PAYLOAD_LEN +
 825                         PN533_FRAME_TAIL_LEN;
 826
 827         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
 828
 829         resp = nfc_alloc_recv_skb(resp_len, GFP_KERNEL);
 830         if (!resp)
 831                 return -ENOMEM;
 832
 833         rc = __pn533_send_async(dev, cmd_code, req, resp, resp_len, complete_cb,
 834                                 complete_cb_context);
 835         if (rc)
 836                 dev_kfree_skb(resp);
 837
 838         return rc;
 839 }
 840
 841 static int pn533_send_cmd_async(struct pn533 *dev, u8 cmd_code,
 842                                 struct sk_buff *req,
 843                                 pn533_send_async_complete_t complete_cb,
 844                                 void *complete_cb_context)
 845 {
 846         struct sk_buff *resp;
 847         int rc;
 848
 849         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
 850
 851         resp = alloc_skb(PN533_NORMAL_FRAME_MAX_LEN, GFP_KERNEL);
 852         if (!resp)
 853                 return -ENOMEM;
 854
 855         rc = __pn533_send_async(dev, cmd_code, req, resp,
 856                                 PN533_NORMAL_FRAME_MAX_LEN,
 857                                 complete_cb, complete_cb_context);
 858         if (rc)
 859                 dev_kfree_skb(resp);
 860
 861         return rc;
 862 }
 863
 864 static void pn533_wq_cmd(struct work_struct *work)
 865 {
 866         struct pn533 *dev = container_of(work, struct pn533, cmd_work);
 867         struct pn533_cmd *cmd;
 868
 869         mutex_lock(&dev->cmd_lock);
 870
 871         if (list_empty(&dev->cmd_queue)) {
 872                 dev->cmd_pending = 0;
 873                 mutex_unlock(&dev->cmd_lock);
 874                 return;
 875         }
 876
 877         cmd = list_first_entry(&dev->cmd_queue, struct pn533_cmd, queue);
 878
 879         list_del(&cmd->queue);
 880
 881         mutex_unlock(&dev->cmd_lock);
 882
 883         if (cmd->cmd_code != PN533_CMD_UNDEF)
 884                 __pn533_send_cmd_frame_async(dev,
 885                                              (struct pn533_frame *)cmd->req->data,
 886                                              (struct pn533_frame *)cmd->resp->data,
 887                                              PN533_NORMAL_FRAME_MAX_LEN,
 888                                              pn533_send_async_complete,
 889                                              cmd->arg);
 890         else
 891                 __pn533_send_cmd_frame_async(dev, cmd->out_frame, cmd->in_frame,
 892                                              cmd->in_frame_len,
 893                                              cmd->cmd_complete, cmd->arg);
 894
 895         kfree(cmd);
 896 }
 897
 898 static int pn533_send_cmd_frame_async(struct pn533 *dev,
 899                                         struct pn533_frame *out_frame,
 900                                         struct pn533_frame *in_frame,
 901                                         int in_frame_len,
 902                                         pn533_cmd_complete_t cmd_complete,
 903                                         void *arg)
 904 {
 905         struct pn533_cmd *cmd;
 906         int rc = 0;
 907
 908         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
 909
 910         mutex_lock(&dev->cmd_lock);
 911
 912         if (!dev->cmd_pending) {
 913                 rc = __pn533_send_cmd_frame_async(dev, out_frame, in_frame,
 914                                                   in_frame_len, cmd_complete,
 915                                                   arg);
 916                 if (!rc)
 917                         dev->cmd_pending = 1;
 918
 919                 goto unlock;
 920         }
 921
 922         nfc_dev_dbg(&dev->interface->dev, "%s Queueing command", __func__);
 923
 924         cmd = kzalloc(sizeof(struct pn533_cmd), GFP_KERNEL);
 925         if (!cmd) {
 926                 rc = -ENOMEM;
 927                 goto unlock;
 928         }
 929
 930         INIT_LIST_HEAD(&cmd->queue);
 931         cmd->out_frame = out_frame;
 932         cmd->in_frame = in_frame;
 933         cmd->in_frame_len = in_frame_len;
 934         cmd->cmd_code = PN533_CMD_UNDEF;
 935         cmd->cmd_complete = cmd_complete;
 936         cmd->arg = arg;
 937
 938         list_add_tail(&cmd->queue, &dev->cmd_queue);
 939
 940 unlock:
 941         mutex_unlock(&dev->cmd_lock);
 942
 943         return rc;
 944 }
 945
 946 struct pn533_sync_cmd_response {
 947         int rc;
 948         struct sk_buff *resp;
 949         struct completion done;
 950 };
 951
 952 static int pn533_sync_cmd_complete(struct pn533 *dev, void *_arg,
 953                                         u8 *params, int params_len)
 954 {
 955         struct pn533_sync_cmd_response *arg = _arg;
 956
 957         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
 958
 959         arg->rc = 0;
 960
 961         if (params_len < 0) /* error */
 962                 arg->rc = params_len;
 963
 964         complete(&arg->done);
 965
 966         return 0;
 967 }
 968
 969 static int pn533_send_sync_complete(struct pn533 *dev, void *_arg,
 970                                     struct sk_buff *resp)
 971 {
 972         struct pn533_sync_cmd_response *arg = _arg;
 973
 974         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
 975
 976         arg->resp = resp;
 977         complete(&arg->done);
 978
 979         return 0;
 980 }
 981
 982 /*  pn533_send_cmd_sync
 983  *
 984  *  Please note the req parameter is freed inside the function to
 985  *  limit a number of return value interpretations by the caller.
 986  *
 987  *  1. negative in case of error during TX path -> req should be freed
 988  *
 989  *  2. negative in case of error during RX path -> req should not be freed
 990  *     as it's been already freed at the begining of RX path by
 991  *     async_complete_cb.
 992  *
 993  *  3. valid pointer in case of succesfult RX path
 994  *
 995  *  A caller has to check a return value with IS_ERR macro. If the test pass,
 996  *  the returned pointer is valid.
 997  *
 998  * */
 999 static struct sk_buff *pn533_send_cmd_sync(struct pn533 *dev, u8 cmd_code,
1000                                                struct sk_buff *req)
1001 {
1002         int rc;
1003         struct pn533_sync_cmd_response arg;
1004
1005         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1006
1007         init_completion(&arg.done);
1008
1009         rc = pn533_send_cmd_async(dev, cmd_code, req,
1010                                   pn533_send_sync_complete, &arg);
1011         if (rc) {
1012                 dev_kfree_skb(req);
1013                 return ERR_PTR(rc);
1014         }
1015
1016         wait_for_completion(&arg.done);
1017
1018         return arg.resp;
1019 }
1020
1021 static int pn533_send_cmd_frame_sync(struct pn533 *dev,
1022                                                 struct pn533_frame *out_frame,
1023                                                 struct pn533_frame *in_frame,
1024                                                 int in_frame_len)
1025 {
1026         int rc;
1027         struct pn533_sync_cmd_response arg;
1028
1029         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1030
1031         init_completion(&arg.done);
1032
1033         rc = pn533_send_cmd_frame_async(dev, out_frame, in_frame, in_frame_len,
1034                                         pn533_sync_cmd_complete, &arg);
1035         if (rc)
1036                 return rc;
1037
1038         wait_for_completion(&arg.done);
1039
1040         return arg.rc;
1041 }
1042
1043 static void pn533_send_complete(struct urb *urb)
1044 {
1045         struct pn533 *dev = urb->context;
1046
1047         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1048
1049         switch (urb->status) {
1050         case 0:
1051                 /* success */
1052                 break;
1053         case -ECONNRESET:
1054         case -ENOENT:
1055         case -ESHUTDOWN:
1056                 nfc_dev_dbg(&dev->interface->dev, "Urb shutting down with"
1057                                                 " status: %d", urb->status);
1058                 break;
1059         default:
1060                 nfc_dev_dbg(&dev->interface->dev, "Nonzero urb status received:"
1061                                                         " %d", urb->status);
1062         }
1063 }
1064
1065 struct pn533_target_type_a {
1066         __be16 sens_res;
1067         u8 sel_res;
1068         u8 nfcid_len;
1069         u8 nfcid_data[];
1070 } __packed;
1071
1072
1073 #define PN533_TYPE_A_SENS_RES_NFCID1(x) ((u8)((be16_to_cpu(x) & 0x00C0) >> 6))
1074 #define PN533_TYPE_A_SENS_RES_SSD(x) ((u8)((be16_to_cpu(x) & 0x001F) >> 0))
1075 #define PN533_TYPE_A_SENS_RES_PLATCONF(x) ((u8)((be16_to_cpu(x) & 0x0F00) >> 8))
1076
1077 #define PN533_TYPE_A_SENS_RES_SSD_JEWEL 0x00
1078 #define PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL 0x0C
1079
1080 #define PN533_TYPE_A_SEL_PROT(x) (((x) & 0x60) >> 5)
1081 #define PN533_TYPE_A_SEL_CASCADE(x) (((x) & 0x04) >> 2)
1082
1083 #define PN533_TYPE_A_SEL_PROT_MIFARE 0
1084 #define PN533_TYPE_A_SEL_PROT_ISO14443 1
1085 #define PN533_TYPE_A_SEL_PROT_DEP 2
1086 #define PN533_TYPE_A_SEL_PROT_ISO14443_DEP 3
1087
1088 static bool pn533_target_type_a_is_valid(struct pn533_target_type_a *type_a,
1089                                                         int target_data_len)
1090 {
1091         u8 ssd;
1092         u8 platconf;
1093
1094         if (target_data_len < sizeof(struct pn533_target_type_a))
1095                 return false;
1096
1097         /* The lenght check of nfcid[] and ats[] are not being performed because
1098            the values are not being used */
1099
1100         /* Requirement 4.6.3.3 from NFC Forum Digital Spec */
1101         ssd = PN533_TYPE_A_SENS_RES_SSD(type_a->sens_res);
1102         platconf = PN533_TYPE_A_SENS_RES_PLATCONF(type_a->sens_res);
1103
1104         if ((ssd == PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
1105                         platconf != PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL) ||
1106                         (ssd != PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
1107                         platconf == PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL))
1108                 return false;
1109
1110         /* Requirements 4.8.2.1, 4.8.2.3, 4.8.2.5 and 4.8.2.7 from NFC Forum */
1111         if (PN533_TYPE_A_SEL_CASCADE(type_a->sel_res) != 0)
1112                 return false;
1113
1114         return true;
1115 }
1116
1117 static int pn533_target_found_type_a(struct nfc_target *nfc_tgt, u8 *tgt_data,
1118                                                         int tgt_data_len)
1119 {
1120         struct pn533_target_type_a *tgt_type_a;
1121
1122         tgt_type_a = (struct pn533_target_type_a *) tgt_data;
1123
1124         if (!pn533_target_type_a_is_valid(tgt_type_a, tgt_data_len))
1125                 return -EPROTO;
1126
1127         switch (PN533_TYPE_A_SEL_PROT(tgt_type_a->sel_res)) {
1128         case PN533_TYPE_A_SEL_PROT_MIFARE:
1129                 nfc_tgt->supported_protocols = NFC_PROTO_MIFARE_MASK;
1130                 break;
1131         case PN533_TYPE_A_SEL_PROT_ISO14443:
1132                 nfc_tgt->supported_protocols = NFC_PROTO_ISO14443_MASK;
1133                 break;
1134         case PN533_TYPE_A_SEL_PROT_DEP:
1135                 nfc_tgt->supported_protocols = NFC_PROTO_NFC_DEP_MASK;
1136                 break;
1137         case PN533_TYPE_A_SEL_PROT_ISO14443_DEP:
1138                 nfc_tgt->supported_protocols = NFC_PROTO_ISO14443_MASK |
1139                                                         NFC_PROTO_NFC_DEP_MASK;
1140                 break;
1141         }
1142
1143         nfc_tgt->sens_res = be16_to_cpu(tgt_type_a->sens_res);
1144         nfc_tgt->sel_res = tgt_type_a->sel_res;
1145         nfc_tgt->nfcid1_len = tgt_type_a->nfcid_len;
1146         memcpy(nfc_tgt->nfcid1, tgt_type_a->nfcid_data, nfc_tgt->nfcid1_len);
1147
1148         return 0;
1149 }
1150
1151 struct pn533_target_felica {
1152         u8 pol_res;
1153         u8 opcode;
1154         u8 nfcid2[8];
1155         u8 pad[8];
1156         /* optional */
1157         u8 syst_code[];
1158 } __packed;
1159
1160 #define PN533_FELICA_SENSF_NFCID2_DEP_B1 0x01
1161 #define PN533_FELICA_SENSF_NFCID2_DEP_B2 0xFE
1162
1163 static bool pn533_target_felica_is_valid(struct pn533_target_felica *felica,
1164                                                         int target_data_len)
1165 {
1166         if (target_data_len < sizeof(struct pn533_target_felica))
1167                 return false;
1168
1169         if (felica->opcode != PN533_FELICA_OPC_SENSF_RES)
1170                 return false;
1171
1172         return true;
1173 }
1174
1175 static int pn533_target_found_felica(struct nfc_target *nfc_tgt, u8 *tgt_data,
1176                                                         int tgt_data_len)
1177 {
1178         struct pn533_target_felica *tgt_felica;
1179
1180         tgt_felica = (struct pn533_target_felica *) tgt_data;
1181
1182         if (!pn533_target_felica_is_valid(tgt_felica, tgt_data_len))
1183                 return -EPROTO;
1184
1185         if (tgt_felica->nfcid2[0] == PN533_FELICA_SENSF_NFCID2_DEP_B1 &&
1186                                         tgt_felica->nfcid2[1] ==
1187                                         PN533_FELICA_SENSF_NFCID2_DEP_B2)
1188                 nfc_tgt->supported_protocols = NFC_PROTO_NFC_DEP_MASK;
1189         else
1190                 nfc_tgt->supported_protocols = NFC_PROTO_FELICA_MASK;
1191
1192         memcpy(nfc_tgt->sensf_res, &tgt_felica->opcode, 9);
1193         nfc_tgt->sensf_res_len = 9;
1194
1195         return 0;
1196 }
1197
1198 struct pn533_target_jewel {
1199         __be16 sens_res;
1200         u8 jewelid[4];
1201 } __packed;
1202
1203 static bool pn533_target_jewel_is_valid(struct pn533_target_jewel *jewel,
1204                                                         int target_data_len)
1205 {
1206         u8 ssd;
1207         u8 platconf;
1208
1209         if (target_data_len < sizeof(struct pn533_target_jewel))
1210                 return false;
1211
1212         /* Requirement 4.6.3.3 from NFC Forum Digital Spec */
1213         ssd = PN533_TYPE_A_SENS_RES_SSD(jewel->sens_res);
1214         platconf = PN533_TYPE_A_SENS_RES_PLATCONF(jewel->sens_res);
1215
1216         if ((ssd == PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
1217                         platconf != PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL) ||
1218                         (ssd != PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
1219                         platconf == PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL))
1220                 return false;
1221
1222         return true;
1223 }
1224
1225 static int pn533_target_found_jewel(struct nfc_target *nfc_tgt, u8 *tgt_data,
1226                                                         int tgt_data_len)
1227 {
1228         struct pn533_target_jewel *tgt_jewel;
1229
1230         tgt_jewel = (struct pn533_target_jewel *) tgt_data;
1231
1232         if (!pn533_target_jewel_is_valid(tgt_jewel, tgt_data_len))
1233                 return -EPROTO;
1234
1235         nfc_tgt->supported_protocols = NFC_PROTO_JEWEL_MASK;
1236         nfc_tgt->sens_res = be16_to_cpu(tgt_jewel->sens_res);
1237         nfc_tgt->nfcid1_len = 4;
1238         memcpy(nfc_tgt->nfcid1, tgt_jewel->jewelid, nfc_tgt->nfcid1_len);
1239
1240         return 0;
1241 }
1242
1243 struct pn533_type_b_prot_info {
1244         u8 bitrate;
1245         u8 fsci_type;
1246         u8 fwi_adc_fo;
1247 } __packed;
1248
1249 #define PN533_TYPE_B_PROT_FCSI(x) (((x) & 0xF0) >> 4)
1250 #define PN533_TYPE_B_PROT_TYPE(x) (((x) & 0x0F) >> 0)
1251 #define PN533_TYPE_B_PROT_TYPE_RFU_MASK 0x8
1252
1253 struct pn533_type_b_sens_res {
1254         u8 opcode;
1255         u8 nfcid[4];
1256         u8 appdata[4];
1257         struct pn533_type_b_prot_info prot_info;
1258 } __packed;
1259
1260 #define PN533_TYPE_B_OPC_SENSB_RES 0x50
1261
1262 struct pn533_target_type_b {
1263         struct pn533_type_b_sens_res sensb_res;
1264         u8 attrib_res_len;
1265         u8 attrib_res[];
1266 } __packed;
1267
1268 static bool pn533_target_type_b_is_valid(struct pn533_target_type_b *type_b,
1269                                                         int target_data_len)
1270 {
1271         if (target_data_len < sizeof(struct pn533_target_type_b))
1272                 return false;
1273
1274         if (type_b->sensb_res.opcode != PN533_TYPE_B_OPC_SENSB_RES)
1275                 return false;
1276
1277         if (PN533_TYPE_B_PROT_TYPE(type_b->sensb_res.prot_info.fsci_type) &
1278                                                 PN533_TYPE_B_PROT_TYPE_RFU_MASK)
1279                 return false;
1280
1281         return true;
1282 }
1283
1284 static int pn533_target_found_type_b(struct nfc_target *nfc_tgt, u8 *tgt_data,
1285                                                         int tgt_data_len)
1286 {
1287         struct pn533_target_type_b *tgt_type_b;
1288
1289         tgt_type_b = (struct pn533_target_type_b *) tgt_data;
1290
1291         if (!pn533_target_type_b_is_valid(tgt_type_b, tgt_data_len))
1292                 return -EPROTO;
1293
1294         nfc_tgt->supported_protocols = NFC_PROTO_ISO14443_B_MASK;
1295
1296         return 0;
1297 }
1298
1299 struct pn533_poll_response {
1300         u8 nbtg;
1301         u8 tg;
1302         u8 target_data[];
1303 } __packed;
1304
1305 static int pn533_target_found(struct pn533 *dev,
1306                         struct pn533_poll_response *resp, int resp_len)
1307 {
1308         int target_data_len;
1309         struct nfc_target nfc_tgt;
1310         int rc;
1311
1312         nfc_dev_dbg(&dev->interface->dev, "%s - modulation=%d", __func__,
1313                                                         dev->poll_mod_curr);
1314
1315         if (resp->tg != 1)
1316                 return -EPROTO;
1317
1318         memset(&nfc_tgt, 0, sizeof(struct nfc_target));
1319
1320         target_data_len = resp_len - sizeof(struct pn533_poll_response);
1321
1322         switch (dev->poll_mod_curr) {
1323         case PN533_POLL_MOD_106KBPS_A:
1324                 rc = pn533_target_found_type_a(&nfc_tgt, resp->target_data,
1325                                                         target_data_len);
1326                 break;
1327         case PN533_POLL_MOD_212KBPS_FELICA:
1328         case PN533_POLL_MOD_424KBPS_FELICA:
1329                 rc = pn533_target_found_felica(&nfc_tgt, resp->target_data,
1330                                                         target_data_len);
1331                 break;
1332         case PN533_POLL_MOD_106KBPS_JEWEL:
1333                 rc = pn533_target_found_jewel(&nfc_tgt, resp->target_data,
1334                                                         target_data_len);
1335                 break;
1336         case PN533_POLL_MOD_847KBPS_B:
1337                 rc = pn533_target_found_type_b(&nfc_tgt, resp->target_data,
1338                                                         target_data_len);
1339                 break;
1340         default:
1341                 nfc_dev_err(&dev->interface->dev, "Unknown current poll"
1342                                                                 " modulation");
1343                 return -EPROTO;
1344         }
1345
1346         if (rc)
1347                 return rc;
1348
1349         if (!(nfc_tgt.supported_protocols & dev->poll_protocols)) {
1350                 nfc_dev_dbg(&dev->interface->dev, "The target found does not"
1351                                                 " have the desired protocol");
1352                 return -EAGAIN;
1353         }
1354
1355         nfc_dev_dbg(&dev->interface->dev, "Target found - supported protocols: "
1356                                         "0x%x", nfc_tgt.supported_protocols);
1357
1358         dev->tgt_available_prots = nfc_tgt.supported_protocols;
1359
1360         nfc_targets_found(dev->nfc_dev, &nfc_tgt, 1);
1361
1362         return 0;
1363 }
1364
1365 static inline void pn533_poll_next_mod(struct pn533 *dev)
1366 {
1367         dev->poll_mod_curr = (dev->poll_mod_curr + 1) % dev->poll_mod_count;
1368 }
1369
1370 static void pn533_poll_reset_mod_list(struct pn533 *dev)
1371 {
1372         dev->poll_mod_count = 0;
1373 }
1374
1375 static void pn533_poll_add_mod(struct pn533 *dev, u8 mod_index)
1376 {
1377         dev->poll_mod_active[dev->poll_mod_count] =
1378                 (struct pn533_poll_modulations *) &poll_mod[mod_index];
1379         dev->poll_mod_count++;
1380 }
1381
1382 static void pn533_poll_create_mod_list(struct pn533 *dev,
1383                                        u32 im_protocols, u32 tm_protocols)
1384 {
1385         pn533_poll_reset_mod_list(dev);
1386
1387         if (im_protocols & NFC_PROTO_MIFARE_MASK
1388             || im_protocols & NFC_PROTO_ISO14443_MASK
1389             || im_protocols & NFC_PROTO_NFC_DEP_MASK)
1390                 pn533_poll_add_mod(dev, PN533_POLL_MOD_106KBPS_A);
1391
1392         if (im_protocols & NFC_PROTO_FELICA_MASK
1393             || im_protocols & NFC_PROTO_NFC_DEP_MASK) {
1394                 pn533_poll_add_mod(dev, PN533_POLL_MOD_212KBPS_FELICA);
1395                 pn533_poll_add_mod(dev, PN533_POLL_MOD_424KBPS_FELICA);
1396         }
1397
1398         if (im_protocols & NFC_PROTO_JEWEL_MASK)
1399                 pn533_poll_add_mod(dev, PN533_POLL_MOD_106KBPS_JEWEL);
1400
1401         if (im_protocols & NFC_PROTO_ISO14443_B_MASK)
1402                 pn533_poll_add_mod(dev, PN533_POLL_MOD_847KBPS_B);
1403
1404         if (tm_protocols)
1405                 pn533_poll_add_mod(dev, PN533_LISTEN_MOD);
1406 }
1407
1408 static int pn533_start_poll_complete(struct pn533 *dev, u8 *params, int params_len)
1409 {
1410         struct pn533_poll_response *resp;
1411         int rc;
1412
1413         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1414
1415         resp = (struct pn533_poll_response *) params;
1416         if (resp->nbtg) {
1417                 rc = pn533_target_found(dev, resp, params_len);
1418
1419                 /* We must stop the poll after a valid target found */
1420                 if (rc == 0) {
1421                         pn533_poll_reset_mod_list(dev);
1422                         return 0;
1423                 }
1424         }
1425
1426         return -EAGAIN;
1427 }
1428
1429 static int pn533_init_target_frame(struct pn533_frame *frame,
1430                                    u8 *gb, size_t gb_len)
1431 {
1432         struct pn533_cmd_init_target *cmd;
1433         size_t cmd_len;
1434         u8 felica_params[18] = {0x1, 0xfe, /* DEP */
1435                                 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, /* random */
1436                                 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
1437                                 0xff, 0xff}; /* System code */
1438         u8 mifare_params[6] = {0x1, 0x1, /* SENS_RES */
1439                                0x0, 0x0, 0x0,
1440                                0x40}; /* SEL_RES for DEP */
1441
1442         cmd_len = sizeof(struct pn533_cmd_init_target) + gb_len + 1;
1443         cmd = kzalloc(cmd_len, GFP_KERNEL);
1444         if (cmd == NULL)
1445                 return -ENOMEM;
1446
1447         pn533_tx_frame_init(frame, PN533_CMD_TG_INIT_AS_TARGET);
1448
1449         /* DEP support only */
1450         cmd->mode |= PN533_INIT_TARGET_DEP;
1451
1452         /* Felica params */
1453         memcpy(cmd->felica, felica_params, 18);
1454         get_random_bytes(cmd->felica + 2, 6);
1455
1456         /* NFCID3 */
1457         memset(cmd->nfcid3, 0, 10);
1458         memcpy(cmd->nfcid3, cmd->felica, 8);
1459
1460         /* MIFARE params */
1461         memcpy(cmd->mifare, mifare_params, 6);
1462
1463         /* General bytes */
1464         cmd->gb_len = gb_len;
1465         memcpy(cmd->gb, gb, gb_len);
1466
1467         /* Len Tk */
1468         cmd->gb[gb_len] = 0;
1469
1470         memcpy(PN533_FRAME_CMD_PARAMS_PTR(frame), cmd, cmd_len);
1471
1472         frame->datalen += cmd_len;
1473
1474         pn533_tx_frame_finish(frame);
1475
1476         kfree(cmd);
1477
1478         return 0;
1479 }
1480
1481 #define PN533_CMD_DATAEXCH_HEAD_LEN 1
1482 #define PN533_CMD_DATAEXCH_DATA_MAXLEN 262
1483 static int pn533_tm_get_data_complete(struct pn533 *dev, void *arg,
1484                                       u8 *params, int params_len)
1485 {
1486         struct sk_buff *skb_resp = arg;
1487         struct pn533_frame *in_frame = (struct pn533_frame *) skb_resp->data;
1488
1489         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1490
1491         if (params_len < 0) {
1492                 nfc_dev_err(&dev->interface->dev,
1493                             "Error %d when starting as a target",
1494                             params_len);
1495
1496                 return params_len;
1497         }
1498
1499         if (params_len > 0 && params[0] != 0) {
1500                 nfc_tm_deactivated(dev->nfc_dev);
1501
1502                 dev->tgt_mode = 0;
1503
1504                 kfree_skb(skb_resp);
1505                 return 0;
1506         }
1507
1508         skb_put(skb_resp, PN533_FRAME_SIZE(in_frame));
1509         skb_pull(skb_resp,
1510                  PN533_FRAME_HEADER_LEN + PN533_CMD_DATAEXCH_HEAD_LEN);
1511         skb_trim(skb_resp, skb_resp->len - PN533_FRAME_TAIL_LEN);
1512
1513         return nfc_tm_data_received(dev->nfc_dev, skb_resp);
1514 }
1515
1516 static void pn533_wq_tg_get_data(struct work_struct *work)
1517 {
1518         struct pn533 *dev = container_of(work, struct pn533, tg_work);
1519         struct pn533_frame *in_frame;
1520         struct sk_buff *skb_resp;
1521         size_t skb_resp_len;
1522
1523         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1524
1525         skb_resp_len = PN533_FRAME_HEADER_LEN +
1526                        PN533_CMD_DATAEXCH_HEAD_LEN +
1527                        PN533_CMD_DATAEXCH_DATA_MAXLEN +
1528                        PN533_FRAME_TAIL_LEN;
1529
1530         skb_resp = nfc_alloc_recv_skb(skb_resp_len, GFP_KERNEL);
1531         if (!skb_resp)
1532                 return;
1533
1534         in_frame = (struct pn533_frame *)skb_resp->data;
1535
1536         pn533_tx_frame_init(dev->out_frame, PN533_CMD_TG_GET_DATA);
1537         pn533_tx_frame_finish(dev->out_frame);
1538
1539         pn533_send_cmd_frame_async(dev, dev->out_frame, in_frame,
1540                                    skb_resp_len,
1541                                    pn533_tm_get_data_complete,
1542                                    skb_resp);
1543
1544         return;
1545 }
1546
1547 #define ATR_REQ_GB_OFFSET 17
1548 static int pn533_init_target_complete(struct pn533 *dev, u8 *params, int params_len)
1549 {
1550         struct pn533_cmd_init_target_response *resp;
1551         u8 frame, comm_mode = NFC_COMM_PASSIVE, *gb;
1552         size_t gb_len;
1553         int rc;
1554
1555         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1556
1557         if (params_len < 0) {
1558                 nfc_dev_err(&dev->interface->dev,
1559                             "Error %d when starting as a target",
1560                             params_len);
1561
1562                 return params_len;
1563         }
1564
1565         if (params_len < ATR_REQ_GB_OFFSET + 1)
1566                 return -EINVAL;
1567
1568         resp = (struct pn533_cmd_init_target_response *) params;
1569
1570         nfc_dev_dbg(&dev->interface->dev, "Target mode 0x%x param len %d\n",
1571                     resp->mode, params_len);
1572
1573         frame = resp->mode & PN533_INIT_TARGET_RESP_FRAME_MASK;
1574         if (frame == PN533_INIT_TARGET_RESP_ACTIVE)
1575                 comm_mode = NFC_COMM_ACTIVE;
1576
1577         /* Again, only DEP */
1578         if ((resp->mode & PN533_INIT_TARGET_RESP_DEP) == 0)
1579                 return -EOPNOTSUPP;
1580
1581         gb = resp->cmd + ATR_REQ_GB_OFFSET;
1582         gb_len = params_len - (ATR_REQ_GB_OFFSET + 1);
1583
1584         rc = nfc_tm_activated(dev->nfc_dev, NFC_PROTO_NFC_DEP_MASK,
1585                               comm_mode, gb, gb_len);
1586         if (rc < 0) {
1587                 nfc_dev_err(&dev->interface->dev,
1588                             "Error when signaling target activation");
1589                 return rc;
1590         }
1591
1592         dev->tgt_mode = 1;
1593
1594         queue_work(dev->wq, &dev->tg_work);
1595
1596         return 0;
1597 }
1598
1599 static void pn533_listen_mode_timer(unsigned long data)
1600 {
1601         struct pn533 *dev = (struct pn533 *) data;
1602
1603         nfc_dev_dbg(&dev->interface->dev, "Listen mode timeout");
1604
1605         /* An ack will cancel the last issued command (poll) */
1606         pn533_send_ack(dev, GFP_ATOMIC);
1607
1608         dev->cancel_listen = 1;
1609
1610         pn533_poll_next_mod(dev);
1611
1612         queue_work(dev->wq, &dev->poll_work);
1613 }
1614
1615 static int pn533_poll_complete(struct pn533 *dev, void *arg,
1616                                u8 *params, int params_len)
1617 {
1618         struct pn533_poll_modulations *cur_mod;
1619         int rc;
1620
1621         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1622
1623         if (params_len == -ENOENT) {
1624                 if (dev->poll_mod_count != 0)
1625                         return 0;
1626
1627                 nfc_dev_err(&dev->interface->dev,
1628                             "Polling operation has been stopped");
1629
1630                 goto stop_poll;
1631         }
1632
1633         if (params_len < 0) {
1634                 nfc_dev_err(&dev->interface->dev,
1635                             "Error %d when running poll", params_len);
1636
1637                 goto stop_poll;
1638         }
1639
1640         cur_mod = dev->poll_mod_active[dev->poll_mod_curr];
1641
1642         if (cur_mod->len == 0) {
1643                 del_timer(&dev->listen_timer);
1644
1645                 return pn533_init_target_complete(dev, params, params_len);
1646         } else {
1647                 rc = pn533_start_poll_complete(dev, params, params_len);
1648                 if (!rc)
1649                         return rc;
1650         }
1651
1652         pn533_poll_next_mod(dev);
1653
1654         queue_work(dev->wq, &dev->poll_work);
1655
1656         return 0;
1657
1658 stop_poll:
1659         pn533_poll_reset_mod_list(dev);
1660         dev->poll_protocols = 0;
1661         return 0;
1662 }
1663
1664 static void pn533_build_poll_frame(struct pn533 *dev,
1665                                    struct pn533_frame *frame,
1666                                    struct pn533_poll_modulations *mod)
1667 {
1668         nfc_dev_dbg(&dev->interface->dev, "mod len %d\n", mod->len);
1669
1670         if (mod->len == 0) {
1671                 /* Listen mode */
1672                 pn533_init_target_frame(frame, dev->gb, dev->gb_len);
1673         } else {
1674                 /* Polling mode */
1675                 pn533_tx_frame_init(frame, PN533_CMD_IN_LIST_PASSIVE_TARGET);
1676
1677                 memcpy(PN533_FRAME_CMD_PARAMS_PTR(frame), &mod->data, mod->len);
1678                 frame->datalen += mod->len;
1679
1680                 pn533_tx_frame_finish(frame);
1681         }
1682 }
1683
1684 static int pn533_send_poll_frame(struct pn533 *dev)
1685 {
1686         struct pn533_poll_modulations *cur_mod;
1687         int rc;
1688
1689         cur_mod = dev->poll_mod_active[dev->poll_mod_curr];
1690
1691         pn533_build_poll_frame(dev, dev->out_frame, cur_mod);
1692
1693         rc = pn533_send_cmd_frame_async(dev, dev->out_frame, dev->in_frame,
1694                                         PN533_NORMAL_FRAME_MAX_LEN,
1695                                         pn533_poll_complete,
1696                                         NULL);
1697         if (rc)
1698                 nfc_dev_err(&dev->interface->dev, "Polling loop error %d", rc);
1699
1700         return rc;
1701 }
1702
1703 static void pn533_wq_poll(struct work_struct *work)
1704 {
1705         struct pn533 *dev = container_of(work, struct pn533, poll_work);
1706         struct pn533_poll_modulations *cur_mod;
1707         int rc;
1708
1709         cur_mod = dev->poll_mod_active[dev->poll_mod_curr];
1710
1711         nfc_dev_dbg(&dev->interface->dev,
1712                     "%s cancel_listen %d modulation len %d",
1713                     __func__, dev->cancel_listen, cur_mod->len);
1714
1715         if (dev->cancel_listen == 1) {
1716                 dev->cancel_listen = 0;
1717                 usb_kill_urb(dev->in_urb);
1718         }
1719
1720         rc = pn533_send_poll_frame(dev);
1721         if (rc)
1722                 return;
1723
1724         if (cur_mod->len == 0 && dev->poll_mod_count > 1)
1725                 mod_timer(&dev->listen_timer, jiffies + PN533_LISTEN_TIME * HZ);
1726
1727         return;
1728 }
1729
1730 static int pn533_start_poll(struct nfc_dev *nfc_dev,
1731                             u32 im_protocols, u32 tm_protocols)
1732 {
1733         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
1734
1735         nfc_dev_dbg(&dev->interface->dev,
1736                     "%s: im protocols 0x%x tm protocols 0x%x",
1737                     __func__, im_protocols, tm_protocols);
1738
1739         if (dev->tgt_active_prot) {
1740                 nfc_dev_err(&dev->interface->dev,
1741                             "Cannot poll with a target already activated");
1742                 return -EBUSY;
1743         }
1744
1745         if (dev->tgt_mode) {
1746                 nfc_dev_err(&dev->interface->dev,
1747                             "Cannot poll while already being activated");
1748                 return -EBUSY;
1749         }
1750
1751         if (tm_protocols) {
1752                 dev->gb = nfc_get_local_general_bytes(nfc_dev, &dev->gb_len);
1753                 if (dev->gb == NULL)
1754                         tm_protocols = 0;
1755         }
1756
1757         dev->poll_mod_curr = 0;
1758         pn533_poll_create_mod_list(dev, im_protocols, tm_protocols);
1759         dev->poll_protocols = im_protocols;
1760         dev->listen_protocols = tm_protocols;
1761
1762         return pn533_send_poll_frame(dev);
1763 }
1764
1765 static void pn533_stop_poll(struct nfc_dev *nfc_dev)
1766 {
1767         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
1768
1769         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1770
1771         del_timer(&dev->listen_timer);
1772
1773         if (!dev->poll_mod_count) {
1774                 nfc_dev_dbg(&dev->interface->dev, "Polling operation was not"
1775                                                                 " running");
1776                 return;
1777         }
1778
1779         /* An ack will cancel the last issued command (poll) */
1780         pn533_send_ack(dev, GFP_KERNEL);
1781
1782         /* prevent pn533_start_poll_complete to issue a new poll meanwhile */
1783         usb_kill_urb(dev->in_urb);
1784
1785         pn533_poll_reset_mod_list(dev);
1786 }
1787
1788 static int pn533_activate_target_nfcdep(struct pn533 *dev)
1789 {
1790         struct pn533_cmd_activate_param param;
1791         struct pn533_cmd_activate_response *resp;
1792         u16 gt_len;
1793         int rc;
1794
1795         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1796
1797         pn533_tx_frame_init(dev->out_frame, PN533_CMD_IN_ATR);
1798
1799         param.tg = 1;
1800         param.next = 0;
1801         memcpy(PN533_FRAME_CMD_PARAMS_PTR(dev->out_frame), &param,
1802                                 sizeof(struct pn533_cmd_activate_param));
1803         dev->out_frame->datalen += sizeof(struct pn533_cmd_activate_param);
1804
1805         pn533_tx_frame_finish(dev->out_frame);
1806
1807         rc = pn533_send_cmd_frame_sync(dev, dev->out_frame, dev->in_frame,
1808                                        PN533_NORMAL_FRAME_MAX_LEN);
1809         if (rc)
1810                 return rc;
1811
1812         resp = (struct pn533_cmd_activate_response *)
1813                                 PN533_FRAME_CMD_PARAMS_PTR(dev->in_frame);
1814         rc = resp->status & PN533_CMD_RET_MASK;
1815         if (rc != PN533_CMD_RET_SUCCESS)
1816                 return -EIO;
1817
1818         /* ATR_RES general bytes are located at offset 16 */
1819         gt_len = PN533_FRAME_CMD_PARAMS_LEN(dev->in_frame) - 16;
1820         rc = nfc_set_remote_general_bytes(dev->nfc_dev, resp->gt, gt_len);
1821
1822         return rc;
1823 }
1824
1825 static int pn533_activate_target(struct nfc_dev *nfc_dev,
1826                                  struct nfc_target *target, u32 protocol)
1827 {
1828         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
1829         int rc;
1830
1831         nfc_dev_dbg(&dev->interface->dev, "%s - protocol=%u", __func__,
1832                                                                 protocol);
1833
1834         if (dev->poll_mod_count) {
1835                 nfc_dev_err(&dev->interface->dev, "Cannot activate while"
1836                                                                 " polling");
1837                 return -EBUSY;
1838         }
1839
1840         if (dev->tgt_active_prot) {
1841                 nfc_dev_err(&dev->interface->dev, "There is already an active"
1842                                                                 " target");
1843                 return -EBUSY;
1844         }
1845
1846         if (!dev->tgt_available_prots) {
1847                 nfc_dev_err(&dev->interface->dev, "There is no available target"
1848                                                                 " to activate");
1849                 return -EINVAL;
1850         }
1851
1852         if (!(dev->tgt_available_prots & (1 << protocol))) {
1853                 nfc_dev_err(&dev->interface->dev, "The target does not support"
1854                                         " the requested protocol %u", protocol);
1855                 return -EINVAL;
1856         }
1857
1858         if (protocol == NFC_PROTO_NFC_DEP) {
1859                 rc = pn533_activate_target_nfcdep(dev);
1860                 if (rc) {
1861                         nfc_dev_err(&dev->interface->dev, "Error %d when"
1862                                                 " activating target with"
1863                                                 " NFC_DEP protocol", rc);
1864                         return rc;
1865                 }
1866         }
1867
1868         dev->tgt_active_prot = protocol;
1869         dev->tgt_available_prots = 0;
1870
1871         return 0;
1872 }
1873
1874 static void pn533_deactivate_target(struct nfc_dev *nfc_dev,
1875                                     struct nfc_target *target)
1876 {
1877         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
1878         u8 tg;
1879         u8 status;
1880         int rc;
1881
1882         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1883
1884         if (!dev->tgt_active_prot) {
1885                 nfc_dev_err(&dev->interface->dev, "There is no active target");
1886                 return;
1887         }
1888
1889         dev->tgt_active_prot = 0;
1890
1891         skb_queue_purge(&dev->resp_q);
1892
1893         pn533_tx_frame_init(dev->out_frame, PN533_CMD_IN_RELEASE);
1894
1895         tg = 1;
1896         memcpy(PN533_FRAME_CMD_PARAMS_PTR(dev->out_frame), &tg, sizeof(u8));
1897         dev->out_frame->datalen += sizeof(u8);
1898
1899         pn533_tx_frame_finish(dev->out_frame);
1900
1901         rc = pn533_send_cmd_frame_sync(dev, dev->out_frame, dev->in_frame,
1902                                        PN533_NORMAL_FRAME_MAX_LEN);
1903         if (rc) {
1904                 nfc_dev_err(&dev->interface->dev, "Error when sending release"
1905                                                 " command to the controller");
1906                 return;
1907         }
1908
1909         status = PN533_FRAME_CMD_PARAMS_PTR(dev->in_frame)[0];
1910         rc = status & PN533_CMD_RET_MASK;
1911         if (rc != PN533_CMD_RET_SUCCESS)
1912                 nfc_dev_err(&dev->interface->dev, "Error 0x%x when releasing"
1913                                                         " the target", rc);
1914
1915         return;
1916 }
1917
1918
1919 static int pn533_in_dep_link_up_complete(struct pn533 *dev, void *arg,
1920                                                 u8 *params, int params_len)
1921 {
1922         struct pn533_cmd_jump_dep_response *resp;
1923         struct nfc_target nfc_target;
1924         u8 target_gt_len;
1925         int rc;
1926         struct pn533_cmd_jump_dep *cmd = (struct pn533_cmd_jump_dep *)arg;
1927         u8 active = cmd->active;
1928
1929         kfree(arg);
1930
1931         if (params_len == -ENOENT) {
1932                 nfc_dev_dbg(&dev->interface->dev, "");
1933                 return 0;
1934         }
1935
1936         if (params_len < 0) {
1937                 nfc_dev_err(&dev->interface->dev,
1938                                 "Error %d when bringing DEP link up",
1939                                                                 params_len);
1940                 return 0;
1941         }
1942
1943         if (dev->tgt_available_prots &&
1944             !(dev->tgt_available_prots & (1 << NFC_PROTO_NFC_DEP))) {
1945                 nfc_dev_err(&dev->interface->dev,
1946                         "The target does not support DEP");
1947                 return -EINVAL;
1948         }
1949
1950         resp = (struct pn533_cmd_jump_dep_response *) params;
1951         rc = resp->status & PN533_CMD_RET_MASK;
1952         if (rc != PN533_CMD_RET_SUCCESS) {
1953                 nfc_dev_err(&dev->interface->dev,
1954                                 "Bringing DEP link up failed %d", rc);
1955                 return 0;
1956         }
1957
1958         if (!dev->tgt_available_prots) {
1959                 nfc_dev_dbg(&dev->interface->dev, "Creating new target");
1960
1961                 nfc_target.supported_protocols = NFC_PROTO_NFC_DEP_MASK;
1962                 nfc_target.nfcid1_len = 10;
1963                 memcpy(nfc_target.nfcid1, resp->nfcid3t, nfc_target.nfcid1_len);
1964                 rc = nfc_targets_found(dev->nfc_dev, &nfc_target, 1);
1965                 if (rc)
1966                         return 0;
1967
1968                 dev->tgt_available_prots = 0;
1969         }
1970
1971         dev->tgt_active_prot = NFC_PROTO_NFC_DEP;
1972
1973         /* ATR_RES general bytes are located at offset 17 */
1974         target_gt_len = PN533_FRAME_CMD_PARAMS_LEN(dev->in_frame) - 17;
1975         rc = nfc_set_remote_general_bytes(dev->nfc_dev,
1976                                                 resp->gt, target_gt_len);
1977         if (rc == 0)
1978                 rc = nfc_dep_link_is_up(dev->nfc_dev,
1979                                                 dev->nfc_dev->targets[0].idx,
1980                                                 !active, NFC_RF_INITIATOR);
1981
1982         return 0;
1983 }
1984
1985 static int pn533_mod_to_baud(struct pn533 *dev)
1986 {
1987         switch (dev->poll_mod_curr) {
1988         case PN533_POLL_MOD_106KBPS_A:
1989                 return 0;
1990         case PN533_POLL_MOD_212KBPS_FELICA:
1991                 return 1;
1992         case PN533_POLL_MOD_424KBPS_FELICA:
1993                 return 2;
1994         default:
1995                 return -EINVAL;
1996         }
1997 }
1998
1999 #define PASSIVE_DATA_LEN 5
2000 static int pn533_dep_link_up(struct nfc_dev *nfc_dev, struct nfc_target *target,
2001                              u8 comm_mode, u8* gb, size_t gb_len)
2002 {
2003         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2004         struct pn533_cmd_jump_dep *cmd;
2005         u8 cmd_len, *data_ptr;
2006         u8 passive_data[PASSIVE_DATA_LEN] = {0x00, 0xff, 0xff, 0x00, 0x3};
2007         int rc, baud;
2008
2009         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
2010
2011         if (dev->poll_mod_count) {
2012                 nfc_dev_err(&dev->interface->dev,
2013                                 "Cannot bring the DEP link up while polling");
2014                 return -EBUSY;
2015         }
2016
2017         if (dev->tgt_active_prot) {
2018                 nfc_dev_err(&dev->interface->dev,
2019                                 "There is already an active target");
2020                 return -EBUSY;
2021         }
2022
2023         baud = pn533_mod_to_baud(dev);
2024         if (baud < 0) {
2025                 nfc_dev_err(&dev->interface->dev,
2026                             "Invalid curr modulation %d", dev->poll_mod_curr);
2027                 return baud;
2028         }
2029
2030         cmd_len = sizeof(struct pn533_cmd_jump_dep) + gb_len;
2031         if (comm_mode == NFC_COMM_PASSIVE)
2032                 cmd_len += PASSIVE_DATA_LEN;
2033
2034         cmd = kzalloc(cmd_len, GFP_KERNEL);
2035         if (cmd == NULL)
2036                 return -ENOMEM;
2037
2038         pn533_tx_frame_init(dev->out_frame, PN533_CMD_IN_JUMP_FOR_DEP);
2039
2040         cmd->active = !comm_mode;
2041         cmd->next = 0;
2042         cmd->baud = baud;
2043         data_ptr = cmd->data;
2044         if (comm_mode == NFC_COMM_PASSIVE && cmd->baud > 0) {
2045                 memcpy(data_ptr, passive_data, PASSIVE_DATA_LEN);
2046                 cmd->next |= 1;
2047                 data_ptr += PASSIVE_DATA_LEN;
2048         }
2049
2050         if (gb != NULL && gb_len > 0) {
2051                 cmd->next |= 4; /* We have some Gi */
2052                 memcpy(data_ptr, gb, gb_len);
2053         } else {
2054                 cmd->next = 0;
2055         }
2056
2057         memcpy(PN533_FRAME_CMD_PARAMS_PTR(dev->out_frame), cmd, cmd_len);
2058         dev->out_frame->datalen += cmd_len;
2059
2060         pn533_tx_frame_finish(dev->out_frame);
2061
2062         rc = pn533_send_cmd_frame_async(dev, dev->out_frame, dev->in_frame,
2063                                         PN533_NORMAL_FRAME_MAX_LEN,
2064                                         pn533_in_dep_link_up_complete, cmd);
2065         if (rc < 0)
2066                 kfree(cmd);
2067
2068         return rc;
2069 }
2070
2071 static int pn533_dep_link_down(struct nfc_dev *nfc_dev)
2072 {
2073         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2074
2075         pn533_poll_reset_mod_list(dev);
2076
2077         if (dev->tgt_mode || dev->tgt_active_prot) {
2078                 pn533_send_ack(dev, GFP_KERNEL);
2079                 usb_kill_urb(dev->in_urb);
2080         }
2081
2082         dev->tgt_active_prot = 0;
2083         dev->tgt_mode = 0;
2084
2085         skb_queue_purge(&dev->resp_q);
2086
2087         return 0;
2088 }
2089
2090 static int pn533_build_tx_frame(struct pn533 *dev, struct sk_buff *skb,
2091                                 bool target)
2092 {
2093         int payload_len = skb->len;
2094         struct pn533_frame *out_frame;
2095         u8 tg;
2096
2097         nfc_dev_dbg(&dev->interface->dev, "%s - Sending %d bytes", __func__,
2098                                                                 payload_len);
2099
2100         if (payload_len > PN533_CMD_DATAEXCH_DATA_MAXLEN) {
2101                 /* TODO: Implement support to multi-part data exchange */
2102                 nfc_dev_err(&dev->interface->dev, "Data length greater than the"
2103                                                 " max allowed: %d",
2104                                                 PN533_CMD_DATAEXCH_DATA_MAXLEN);
2105                 return -ENOSYS;
2106         }
2107
2108         skb_push(skb, PN533_FRAME_HEADER_LEN);
2109
2110         if (target == true) {
2111                 switch (dev->device_type) {
2112                 case PN533_DEVICE_PASORI:
2113                         if (dev->tgt_active_prot == NFC_PROTO_FELICA) {
2114                                 out_frame = (struct pn533_frame *) skb->data;
2115                                 pn533_tx_frame_init(out_frame,
2116                                                     PN533_CMD_IN_COMM_THRU);
2117
2118                                 break;
2119                         }
2120
2121                 default:
2122                         skb_push(skb, PN533_CMD_DATAEXCH_HEAD_LEN);
2123                         out_frame = (struct pn533_frame *) skb->data;
2124                         pn533_tx_frame_init(out_frame,
2125                                             PN533_CMD_IN_DATA_EXCHANGE);
2126                         tg = 1;
2127                         memcpy(PN533_FRAME_CMD_PARAMS_PTR(out_frame),
2128                                &tg, sizeof(u8));
2129                         out_frame->datalen += sizeof(u8);
2130
2131                         break;
2132                 }
2133
2134         } else {
2135                 skb_push(skb, PN533_CMD_DATAEXCH_HEAD_LEN - 1);
2136                 out_frame = (struct pn533_frame *) skb->data;
2137                 pn533_tx_frame_init(out_frame, PN533_CMD_TG_SET_DATA);
2138         }
2139
2140
2141         /* The data is already in the out_frame, just update the datalen */
2142         out_frame->datalen += payload_len;
2143
2144         pn533_tx_frame_finish(out_frame);
2145         skb_put(skb, PN533_FRAME_TAIL_LEN);
2146
2147         return 0;
2148 }
2149
2150 struct pn533_data_exchange_arg {
2151         struct sk_buff *skb_resp;
2152         struct sk_buff *skb_out;
2153         data_exchange_cb_t cb;
2154         void *cb_context;
2155 };
2156
2157 static struct sk_buff *pn533_build_response(struct pn533 *dev)
2158 {
2159         struct sk_buff *skb, *tmp, *t;
2160         unsigned int skb_len = 0, tmp_len = 0;
2161
2162         nfc_dev_dbg(&dev->interface->dev, "%s\n", __func__);
2163
2164         if (skb_queue_empty(&dev->resp_q))
2165                 return NULL;
2166
2167         if (skb_queue_len(&dev->resp_q) == 1) {
2168                 skb = skb_dequeue(&dev->resp_q);
2169                 goto out;
2170         }
2171
2172         skb_queue_walk_safe(&dev->resp_q, tmp, t)
2173                 skb_len += tmp->len;
2174
2175         nfc_dev_dbg(&dev->interface->dev, "%s total length %d\n",
2176                     __func__, skb_len);
2177
2178         skb = alloc_skb(skb_len, GFP_KERNEL);
2179         if (skb == NULL)
2180                 goto out;
2181
2182         skb_put(skb, skb_len);
2183
2184         skb_queue_walk_safe(&dev->resp_q, tmp, t) {
2185                 memcpy(skb->data + tmp_len, tmp->data, tmp->len);
2186                 tmp_len += tmp->len;
2187         }
2188
2189 out:
2190         skb_queue_purge(&dev->resp_q);
2191
2192         return skb;
2193 }
2194
2195 static int pn533_data_exchange_complete(struct pn533 *dev, void *_arg,
2196                                                 u8 *params, int params_len)
2197 {
2198         struct pn533_data_exchange_arg *arg = _arg;
2199         struct sk_buff *skb = NULL, *skb_resp = arg->skb_resp;
2200         struct pn533_frame *in_frame = (struct pn533_frame *) skb_resp->data;
2201         int err = 0;
2202         u8 status;
2203         u8 cmd_ret;
2204
2205         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
2206
2207         dev_kfree_skb(arg->skb_out);
2208
2209         if (params_len < 0) { /* error */
2210                 err = params_len;
2211                 goto error;
2212         }
2213
2214         status = params[0];
2215
2216         cmd_ret = status & PN533_CMD_RET_MASK;
2217         if (cmd_ret != PN533_CMD_RET_SUCCESS) {
2218                 nfc_dev_err(&dev->interface->dev, "PN533 reported error %d when"
2219                                                 " exchanging data", cmd_ret);
2220                 err = -EIO;
2221                 goto error;
2222         }
2223
2224         skb_put(skb_resp, PN533_FRAME_SIZE(in_frame));
2225         skb_pull(skb_resp, PN533_FRAME_HEADER_LEN);
2226         skb_pull(skb_resp, PN533_CMD_DATAEXCH_HEAD_LEN);
2227         skb_trim(skb_resp, skb_resp->len - PN533_FRAME_TAIL_LEN);
2228         skb_queue_tail(&dev->resp_q, skb_resp);
2229
2230         if (status & PN533_CMD_MI_MASK) {
2231                 queue_work(dev->wq, &dev->mi_work);
2232                 return -EINPROGRESS;
2233         }
2234
2235         skb = pn533_build_response(dev);
2236         if (skb == NULL)
2237                 goto error;
2238
2239         arg->cb(arg->cb_context, skb, 0);
2240         kfree(arg);
2241         return 0;
2242
2243 error:
2244         skb_queue_purge(&dev->resp_q);
2245         dev_kfree_skb(skb_resp);
2246         arg->cb(arg->cb_context, NULL, err);
2247         kfree(arg);
2248         return 0;
2249 }
2250
2251 static int pn533_transceive(struct nfc_dev *nfc_dev,
2252                             struct nfc_target *target, struct sk_buff *skb,
2253                             data_exchange_cb_t cb, void *cb_context)
2254 {
2255         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2256         struct pn533_frame *out_frame, *in_frame;
2257         struct pn533_data_exchange_arg *arg;
2258         struct sk_buff *skb_resp;
2259         int skb_resp_len;
2260         int rc;
2261
2262         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
2263
2264         if (!dev->tgt_active_prot) {
2265                 nfc_dev_err(&dev->interface->dev, "Cannot exchange data if"
2266                                                 " there is no active target");
2267                 rc = -EINVAL;
2268                 goto error;
2269         }
2270
2271         rc = pn533_build_tx_frame(dev, skb, true);
2272         if (rc)
2273                 goto error;
2274
2275         skb_resp_len = PN533_FRAME_HEADER_LEN +
2276                        PN533_CMD_DATAEXCH_HEAD_LEN +
2277                        PN533_CMD_DATAEXCH_DATA_MAXLEN +
2278                        PN533_FRAME_TAIL_LEN;
2279
2280         skb_resp = nfc_alloc_recv_skb(skb_resp_len, GFP_KERNEL);
2281         if (!skb_resp) {
2282                 rc = -ENOMEM;
2283                 goto error;
2284         }
2285
2286         in_frame = (struct pn533_frame *) skb_resp->data;
2287         out_frame = (struct pn533_frame *) skb->data;
2288
2289         arg = kmalloc(sizeof(struct pn533_data_exchange_arg), GFP_KERNEL);
2290         if (!arg) {
2291                 rc = -ENOMEM;
2292                 goto free_skb_resp;
2293         }
2294
2295         arg->skb_resp = skb_resp;
2296         arg->skb_out = skb;
2297         arg->cb = cb;
2298         arg->cb_context = cb_context;
2299
2300         rc = pn533_send_cmd_frame_async(dev, out_frame, in_frame, skb_resp_len,
2301                                         pn533_data_exchange_complete, arg);
2302         if (rc) {
2303                 nfc_dev_err(&dev->interface->dev, "Error %d when trying to"
2304                                                 " perform data_exchange", rc);
2305                 goto free_arg;
2306         }
2307
2308         return 0;
2309
2310 free_arg:
2311         kfree(arg);
2312 free_skb_resp:
2313         kfree_skb(skb_resp);
2314 error:
2315         kfree_skb(skb);
2316         return rc;
2317 }
2318
2319 static int pn533_tm_send_complete(struct pn533 *dev, void *arg,
2320                                   u8 *params, int params_len)
2321 {
2322         struct sk_buff *skb_out = arg;
2323
2324         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
2325
2326         dev_kfree_skb(skb_out);
2327
2328         if (params_len < 0) {
2329                 nfc_dev_err(&dev->interface->dev,
2330                             "Error %d when sending data",
2331                             params_len);
2332
2333                 return params_len;
2334         }
2335
2336         if (params_len > 0 && params[0] != 0) {
2337                 nfc_tm_deactivated(dev->nfc_dev);
2338
2339                 dev->tgt_mode = 0;
2340
2341                 return 0;
2342         }
2343
2344         queue_work(dev->wq, &dev->tg_work);
2345
2346         return 0;
2347 }
2348
2349 static int pn533_tm_send(struct nfc_dev *nfc_dev, struct sk_buff *skb)
2350 {
2351         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2352         struct pn533_frame *out_frame;
2353         int rc;
2354
2355         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
2356
2357         rc = pn533_build_tx_frame(dev, skb, false);
2358         if (rc)
2359                 goto error;
2360
2361         out_frame = (struct pn533_frame *) skb->data;
2362
2363         rc = pn533_send_cmd_frame_async(dev, out_frame, dev->in_frame,
2364                                         PN533_NORMAL_FRAME_MAX_LEN,
2365                                         pn533_tm_send_complete, skb);
2366         if (rc) {
2367                 nfc_dev_err(&dev->interface->dev,
2368                             "Error %d when trying to send data", rc);
2369                 goto error;
2370         }
2371
2372         return 0;
2373
2374 error:
2375         kfree_skb(skb);
2376
2377         return rc;
2378 }
2379
2380 static void pn533_wq_mi_recv(struct work_struct *work)
2381 {
2382         struct pn533 *dev = container_of(work, struct pn533, mi_work);
2383         struct sk_buff *skb_cmd;
2384         struct pn533_data_exchange_arg *arg = dev->cmd_complete_arg;
2385         struct pn533_frame *out_frame, *in_frame;
2386         struct sk_buff *skb_resp;
2387         int skb_resp_len;
2388         int rc;
2389
2390         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
2391
2392         /* This is a zero payload size skb */
2393         skb_cmd = alloc_skb(PN533_FRAME_HEADER_LEN +
2394                             PN533_CMD_DATAEXCH_HEAD_LEN +
2395                             PN533_FRAME_TAIL_LEN,
2396                             GFP_KERNEL);
2397         if (skb_cmd == NULL)
2398                 goto error_cmd;
2399
2400         skb_reserve(skb_cmd,
2401                     PN533_FRAME_HEADER_LEN + PN533_CMD_DATAEXCH_HEAD_LEN);
2402
2403         rc = pn533_build_tx_frame(dev, skb_cmd, true);
2404         if (rc)
2405                 goto error_frame;
2406
2407         skb_resp_len = PN533_FRAME_HEADER_LEN +
2408                        PN533_CMD_DATAEXCH_HEAD_LEN +
2409                        PN533_CMD_DATAEXCH_DATA_MAXLEN +
2410                        PN533_FRAME_TAIL_LEN;
2411
2412         skb_resp = alloc_skb(skb_resp_len, GFP_KERNEL);
2413         if (!skb_resp) {
2414                 rc = -ENOMEM;
2415                 goto error_frame;
2416         }
2417
2418         in_frame = (struct pn533_frame *) skb_resp->data;
2419         out_frame = (struct pn533_frame *) skb_cmd->data;
2420
2421         arg->skb_resp = skb_resp;
2422         arg->skb_out = skb_cmd;
2423
2424         rc = __pn533_send_cmd_frame_async(dev, out_frame, in_frame,
2425                                           skb_resp_len,
2426                                           pn533_data_exchange_complete,
2427                                           dev->cmd_complete_arg);
2428         if (!rc)
2429                 return;
2430
2431         nfc_dev_err(&dev->interface->dev, "Error %d when trying to"
2432                                                 " perform data_exchange", rc);
2433
2434         kfree_skb(skb_resp);
2435
2436 error_frame:
2437         kfree_skb(skb_cmd);
2438
2439 error_cmd:
2440         pn533_send_ack(dev, GFP_KERNEL);
2441
2442         kfree(arg);
2443
2444         queue_work(dev->wq, &dev->cmd_work);
2445 }
2446
2447 static int pn533_set_configuration(struct pn533 *dev, u8 cfgitem, u8 *cfgdata,
2448                                                                 u8 cfgdata_len)
2449 {
2450         int rc;
2451         u8 *params;
2452
2453         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
2454
2455         pn533_tx_frame_init(dev->out_frame, PN533_CMD_RF_CONFIGURATION);
2456
2457         params = PN533_FRAME_CMD_PARAMS_PTR(dev->out_frame);
2458         params[0] = cfgitem;
2459         memcpy(&params[1], cfgdata, cfgdata_len);
2460         dev->out_frame->datalen += (1 + cfgdata_len);
2461
2462         pn533_tx_frame_finish(dev->out_frame);
2463
2464         rc = pn533_send_cmd_frame_sync(dev, dev->out_frame, dev->in_frame,
2465                                        PN533_NORMAL_FRAME_MAX_LEN);
2466
2467         return rc;
2468 }
2469
2470 static int pn533_fw_reset(struct pn533 *dev)
2471 {
2472         int rc;
2473         u8 *params;
2474
2475         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
2476
2477         pn533_tx_frame_init(dev->out_frame, 0x18);
2478
2479         params = PN533_FRAME_CMD_PARAMS_PTR(dev->out_frame);
2480         params[0] = 0x1;
2481         dev->out_frame->datalen += 1;
2482
2483         pn533_tx_frame_finish(dev->out_frame);
2484
2485         rc = pn533_send_cmd_frame_sync(dev, dev->out_frame, dev->in_frame,
2486                                        PN533_NORMAL_FRAME_MAX_LEN);
2487
2488         return 0;
2489 }
2490
2491 static struct nfc_ops pn533_nfc_ops = {
2492         .dev_up = NULL,
2493         .dev_down = NULL,
2494         .dep_link_up = pn533_dep_link_up,
2495         .dep_link_down = pn533_dep_link_down,
2496         .start_poll = pn533_start_poll,
2497         .stop_poll = pn533_stop_poll,
2498         .activate_target = pn533_activate_target,
2499         .deactivate_target = pn533_deactivate_target,
2500         .im_transceive = pn533_transceive,
2501         .tm_send = pn533_tm_send,
2502 };
2503
2504 static int pn533_setup(struct pn533 *dev)
2505 {
2506         struct pn533_config_max_retries max_retries;
2507         struct pn533_config_timing timing;
2508         u8 pasori_cfg[3] = {0x08, 0x01, 0x08};
2509         int rc;
2510
2511         switch (dev->device_type) {
2512         case PN533_DEVICE_STD:
2513                 max_retries.mx_rty_atr = PN533_CONFIG_MAX_RETRIES_ENDLESS;
2514                 max_retries.mx_rty_psl = 2;
2515                 max_retries.mx_rty_passive_act =
2516                         PN533_CONFIG_MAX_RETRIES_NO_RETRY;
2517
2518                 timing.rfu = PN533_CONFIG_TIMING_102;
2519                 timing.atr_res_timeout = PN533_CONFIG_TIMING_204;
2520                 timing.dep_timeout = PN533_CONFIG_TIMING_409;
2521
2522                 break;
2523
2524         case PN533_DEVICE_PASORI:
2525                 max_retries.mx_rty_atr = 0x2;
2526                 max_retries.mx_rty_psl = 0x1;
2527                 max_retries.mx_rty_passive_act =
2528                         PN533_CONFIG_MAX_RETRIES_NO_RETRY;
2529
2530                 timing.rfu = PN533_CONFIG_TIMING_102;
2531                 timing.atr_res_timeout = PN533_CONFIG_TIMING_102;
2532                 timing.dep_timeout = PN533_CONFIG_TIMING_204;
2533
2534                 break;
2535
2536         default:
2537                 nfc_dev_err(&dev->interface->dev, "Unknown device type %d\n",
2538                             dev->device_type);
2539                 return -EINVAL;
2540         }
2541
2542         rc = pn533_set_configuration(dev, PN533_CFGITEM_MAX_RETRIES,
2543                                      (u8 *)&max_retries, sizeof(max_retries));
2544         if (rc) {
2545                 nfc_dev_err(&dev->interface->dev,
2546                             "Error on setting MAX_RETRIES config");
2547                 return rc;
2548         }
2549
2550
2551         rc = pn533_set_configuration(dev, PN533_CFGITEM_TIMING,
2552                                      (u8 *)&timing, sizeof(timing));
2553         if (rc) {
2554                 nfc_dev_err(&dev->interface->dev,
2555                             "Error on setting RF timings");
2556                 return rc;
2557         }
2558
2559         switch (dev->device_type) {
2560         case PN533_DEVICE_STD:
2561                 break;
2562
2563         case PN533_DEVICE_PASORI:
2564                 pn533_fw_reset(dev);
2565
2566                 rc = pn533_set_configuration(dev, PN533_CFGITEM_PASORI,
2567                                              pasori_cfg, 3);
2568                 if (rc) {
2569                         nfc_dev_err(&dev->interface->dev,
2570                                     "Error while settings PASORI config");
2571                         return rc;
2572                 }
2573
2574                 pn533_fw_reset(dev);
2575
2576                 break;
2577         }
2578
2579         return 0;
2580 }
2581
2582 static int pn533_probe(struct usb_interface *interface,
2583                         const struct usb_device_id *id)
2584 {
2585         struct pn533_fw_version *fw_ver;
2586         struct pn533 *dev;
2587         struct usb_host_interface *iface_desc;
2588         struct usb_endpoint_descriptor *endpoint;
2589         int in_endpoint = 0;
2590         int out_endpoint = 0;
2591         int rc = -ENOMEM;
2592         int i;
2593         u32 protocols;
2594
2595         dev = kzalloc(sizeof(*dev), GFP_KERNEL);
2596         if (!dev)
2597                 return -ENOMEM;
2598
2599         dev->udev = usb_get_dev(interface_to_usbdev(interface));
2600         dev->interface = interface;
2601         mutex_init(&dev->cmd_lock);
2602
2603         iface_desc = interface->cur_altsetting;
2604         for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
2605                 endpoint = &iface_desc->endpoint[i].desc;
2606
2607                 if (!in_endpoint && usb_endpoint_is_bulk_in(endpoint))
2608                         in_endpoint = endpoint->bEndpointAddress;
2609
2610                 if (!out_endpoint && usb_endpoint_is_bulk_out(endpoint))
2611                         out_endpoint = endpoint->bEndpointAddress;
2612         }
2613
2614         if (!in_endpoint || !out_endpoint) {
2615                 nfc_dev_err(&interface->dev, "Could not find bulk-in or"
2616                                                         " bulk-out endpoint");
2617                 rc = -ENODEV;
2618                 goto error;
2619         }
2620
2621         dev->in_frame = kmalloc(PN533_NORMAL_FRAME_MAX_LEN, GFP_KERNEL);
2622         dev->in_urb = usb_alloc_urb(0, GFP_KERNEL);
2623         dev->out_frame = kmalloc(PN533_NORMAL_FRAME_MAX_LEN, GFP_KERNEL);
2624         dev->out_urb = usb_alloc_urb(0, GFP_KERNEL);
2625
2626         if (!dev->in_frame || !dev->out_frame ||
2627                 !dev->in_urb || !dev->out_urb)
2628                 goto error;
2629
2630         usb_fill_bulk_urb(dev->in_urb, dev->udev,
2631                         usb_rcvbulkpipe(dev->udev, in_endpoint),
2632                         NULL, 0, NULL, dev);
2633         usb_fill_bulk_urb(dev->out_urb, dev->udev,
2634                         usb_sndbulkpipe(dev->udev, out_endpoint),
2635                         NULL, 0,
2636                         pn533_send_complete, dev);
2637
2638         INIT_WORK(&dev->cmd_work, pn533_wq_cmd);
2639         INIT_WORK(&dev->cmd_complete_work, pn533_wq_cmd_complete);
2640         INIT_WORK(&dev->mi_work, pn533_wq_mi_recv);
2641         INIT_WORK(&dev->tg_work, pn533_wq_tg_get_data);
2642         INIT_WORK(&dev->poll_work, pn533_wq_poll);
2643         dev->wq = alloc_ordered_workqueue("pn533", 0);
2644         if (dev->wq == NULL)
2645                 goto error;
2646
2647         init_timer(&dev->listen_timer);
2648         dev->listen_timer.data = (unsigned long) dev;
2649         dev->listen_timer.function = pn533_listen_mode_timer;
2650
2651         skb_queue_head_init(&dev->resp_q);
2652
2653         INIT_LIST_HEAD(&dev->cmd_queue);
2654
2655         usb_set_intfdata(interface, dev);
2656
2657         pn533_tx_frame_init(dev->out_frame, PN533_CMD_GET_FIRMWARE_VERSION);
2658         pn533_tx_frame_finish(dev->out_frame);
2659
2660         rc = pn533_send_cmd_frame_sync(dev, dev->out_frame, dev->in_frame,
2661                                        PN533_NORMAL_FRAME_MAX_LEN);
2662         if (rc)
2663                 goto destroy_wq;
2664
2665         fw_ver = (struct pn533_fw_version *)
2666                                 PN533_FRAME_CMD_PARAMS_PTR(dev->in_frame);
2667         nfc_dev_info(&dev->interface->dev, "NXP PN533 firmware ver %d.%d now"
2668                                         " attached", fw_ver->ver, fw_ver->rev);
2669
2670         dev->device_type = id->driver_info;
2671         switch (dev->device_type) {
2672         case PN533_DEVICE_STD:
2673                 protocols = PN533_ALL_PROTOCOLS;
2674                 break;
2675
2676         case PN533_DEVICE_PASORI:
2677                 protocols = PN533_NO_TYPE_B_PROTOCOLS;
2678                 break;
2679
2680         default:
2681                 nfc_dev_err(&dev->interface->dev, "Unknown device type %d\n",
2682                             dev->device_type);
2683                 rc = -EINVAL;
2684                 goto destroy_wq;
2685         }
2686
2687         dev->nfc_dev = nfc_allocate_device(&pn533_nfc_ops, protocols,
2688                                            PN533_FRAME_HEADER_LEN +
2689                                            PN533_CMD_DATAEXCH_HEAD_LEN,
2690                                            PN533_FRAME_TAIL_LEN);
2691         if (!dev->nfc_dev)
2692                 goto destroy_wq;
2693
2694         nfc_set_parent_dev(dev->nfc_dev, &interface->dev);
2695         nfc_set_drvdata(dev->nfc_dev, dev);
2696
2697         rc = nfc_register_device(dev->nfc_dev);
2698         if (rc)
2699                 goto free_nfc_dev;
2700
2701         rc = pn533_setup(dev);
2702         if (rc)
2703                 goto unregister_nfc_dev;
2704
2705         return 0;
2706
2707 unregister_nfc_dev:
2708         nfc_unregister_device(dev->nfc_dev);
2709
2710 free_nfc_dev:
2711         nfc_free_device(dev->nfc_dev);
2712
2713 destroy_wq:
2714         destroy_workqueue(dev->wq);
2715 error:
2716         kfree(dev->in_frame);
2717         usb_free_urb(dev->in_urb);
2718         kfree(dev->out_frame);
2719         usb_free_urb(dev->out_urb);
2720         kfree(dev);
2721         return rc;
2722 }
2723
2724 static void pn533_disconnect(struct usb_interface *interface)
2725 {
2726         struct pn533 *dev;
2727         struct pn533_cmd *cmd, *n;
2728
2729         dev = usb_get_intfdata(interface);
2730         usb_set_intfdata(interface, NULL);
2731
2732         nfc_unregister_device(dev->nfc_dev);
2733         nfc_free_device(dev->nfc_dev);
2734
2735         usb_kill_urb(dev->in_urb);
2736         usb_kill_urb(dev->out_urb);
2737
2738         destroy_workqueue(dev->wq);
2739
2740         skb_queue_purge(&dev->resp_q);
2741
2742         del_timer(&dev->listen_timer);
2743
2744         list_for_each_entry_safe(cmd, n, &dev->cmd_queue, queue) {
2745                 list_del(&cmd->queue);
2746                 kfree(cmd);
2747         }
2748
2749         kfree(dev->in_frame);
2750         usb_free_urb(dev->in_urb);
2751         kfree(dev->out_frame);
2752         usb_free_urb(dev->out_urb);
2753         kfree(dev);
2754
2755         nfc_dev_info(&interface->dev, "NXP PN533 NFC device disconnected");
2756 }
2757
2758 static struct usb_driver pn533_driver = {
2759         .name =         "pn533",
2760         .probe =        pn533_probe,
2761         .disconnect =   pn533_disconnect,
2762         .id_table =     pn533_table,
2763 };
2764
2765 module_usb_driver(pn533_driver);
2766
2767 MODULE_AUTHOR("Lauro Ramos Venancio <lauro.venancio@openbossa.org>,"
2768                         " Aloisio Almeida Jr <aloisio.almeida@openbossa.org>");
2769 MODULE_DESCRIPTION("PN533 usb driver ver " VERSION);
2770 MODULE_VERSION(VERSION);
2771 MODULE_LICENSE("GPL");