drivers/nfc/pn533.c

   1 /*
   2  * Copyright (C) 2011 Instituto Nokia de Tecnologia
   3  *
   4  * Authors:
   5  *    Lauro Ramos Venancio <lauro.venancio@openbossa.org>
   6  *    Aloisio Almeida Jr <aloisio.almeida@openbossa.org>
   7  *
   8  * This program is free software; you can redistribute it and/or modify
   9  * it under the terms of the GNU General Public License as published by
  10  * the Free Software Foundation; either version 2 of the License, or
  11  * (at your option) any later version.
  12  *
  13  * This program is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  16  * GNU General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License
  19  * along with this program; if not, write to the
  20  * Free Software Foundation, Inc.,
  21  * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
  22  */
  23
  24 #include <linux/device.h>
  25 #include <linux/kernel.h>
  26 #include <linux/module.h>
  27 #include <linux/slab.h>
  28 #include <linux/usb.h>
  29 #include <linux/nfc.h>
  30 #include <linux/netdevice.h>
  31 #include <net/nfc/nfc.h>
  32
  33 #define VERSION "0.1"
  34
  35 #define PN533_VENDOR_ID 0x4CC
  36 #define PN533_PRODUCT_ID 0x2533
  37
  38 #define SCM_VENDOR_ID 0x4E6
  39 #define SCL3711_PRODUCT_ID 0x5591
  40
  41 static const struct usb_device_id pn533_table[] = {
  42         { USB_DEVICE(PN533_VENDOR_ID, PN533_PRODUCT_ID) },
  43         { USB_DEVICE(SCM_VENDOR_ID, SCL3711_PRODUCT_ID) },
  44         { }
  45 };
  46 MODULE_DEVICE_TABLE(usb, pn533_table);
  47
  48 /* How much time we spend listening for initiators */
  49 #define PN533_LISTEN_TIME 2
  50
  51 /* frame definitions */
  52 #define PN533_FRAME_TAIL_SIZE 2
  53 #define PN533_FRAME_SIZE(f) (sizeof(struct pn533_frame) + f->datalen + \
  54                                 PN533_FRAME_TAIL_SIZE)
  55 #define PN533_FRAME_ACK_SIZE (sizeof(struct pn533_frame) + 1)
  56 #define PN533_FRAME_CHECKSUM(f) (f->data[f->datalen])
  57 #define PN533_FRAME_POSTAMBLE(f) (f->data[f->datalen + 1])
  58
  59 /* start of frame */
  60 #define PN533_SOF 0x00FF
  61
  62 /* frame identifier: in/out/error */
  63 #define PN533_FRAME_IDENTIFIER(f) (f->data[0])
  64 #define PN533_DIR_OUT 0xD4
  65 #define PN533_DIR_IN 0xD5
  66
  67 /* PN533 Commands */
  68 #define PN533_FRAME_CMD(f) (f->data[1])
  69 #define PN533_FRAME_CMD_PARAMS_PTR(f) (&f->data[2])
  70 #define PN533_FRAME_CMD_PARAMS_LEN(f) (f->datalen - 2)
  71
  72 #define PN533_CMD_GET_FIRMWARE_VERSION 0x02
  73 #define PN533_CMD_RF_CONFIGURATION 0x32
  74 #define PN533_CMD_IN_DATA_EXCHANGE 0x40
  75 #define PN533_CMD_IN_LIST_PASSIVE_TARGET 0x4A
  76 #define PN533_CMD_IN_ATR 0x50
  77 #define PN533_CMD_IN_RELEASE 0x52
  78 #define PN533_CMD_IN_JUMP_FOR_DEP 0x56
  79
  80 #define PN533_CMD_TG_INIT_AS_TARGET 0x8c
  81 #define PN533_CMD_TG_GET_DATA 0x86
  82 #define PN533_CMD_TG_SET_DATA 0x8e
  83
  84 #define PN533_CMD_RESPONSE(cmd) (cmd + 1)
  85
  86 /* PN533 Return codes */
  87 #define PN533_CMD_RET_MASK 0x3F
  88 #define PN533_CMD_MI_MASK 0x40
  89 #define PN533_CMD_RET_SUCCESS 0x00
  90
  91 /* PN533 status codes */
  92 #define PN533_STATUS_TARGET_RELEASED 0x29
  93
  94 struct pn533;
  95
  96 typedef int (*pn533_cmd_complete_t) (struct pn533 *dev, void *arg,
  97                                         u8 *params, int params_len);
  98
  99 /* structs for pn533 commands */
 100
 101 /* PN533_CMD_GET_FIRMWARE_VERSION */
 102 struct pn533_fw_version {
 103         u8 ic;
 104         u8 ver;
 105         u8 rev;
 106         u8 support;
 107 };
 108
 109 /* PN533_CMD_RF_CONFIGURATION */
 110 #define PN533_CFGITEM_TIMING 0x02
 111 #define PN533_CFGITEM_MAX_RETRIES 0x05
 112
 113 #define PN533_CONFIG_TIMING_102 0xb
 114 #define PN533_CONFIG_TIMING_204 0xc
 115 #define PN533_CONFIG_TIMING_409 0xd
 116 #define PN533_CONFIG_TIMING_819 0xe
 117
 118 #define PN533_CONFIG_MAX_RETRIES_NO_RETRY 0x00
 119 #define PN533_CONFIG_MAX_RETRIES_ENDLESS 0xFF
 120
 121 struct pn533_config_max_retries {
 122         u8 mx_rty_atr;
 123         u8 mx_rty_psl;
 124         u8 mx_rty_passive_act;
 125 } __packed;
 126
 127 struct pn533_config_timing {
 128         u8 rfu;
 129         u8 atr_res_timeout;
 130         u8 dep_timeout;
 131 } __packed;
 132
 133 /* PN533_CMD_IN_LIST_PASSIVE_TARGET */
 134
 135 /* felica commands opcode */
 136 #define PN533_FELICA_OPC_SENSF_REQ 0
 137 #define PN533_FELICA_OPC_SENSF_RES 1
 138 /* felica SENSF_REQ parameters */
 139 #define PN533_FELICA_SENSF_SC_ALL 0xFFFF
 140 #define PN533_FELICA_SENSF_RC_NO_SYSTEM_CODE 0
 141 #define PN533_FELICA_SENSF_RC_SYSTEM_CODE 1
 142 #define PN533_FELICA_SENSF_RC_ADVANCED_PROTOCOL 2
 143
 144 /* type B initiator_data values */
 145 #define PN533_TYPE_B_AFI_ALL_FAMILIES 0
 146 #define PN533_TYPE_B_POLL_METHOD_TIMESLOT 0
 147 #define PN533_TYPE_B_POLL_METHOD_PROBABILISTIC 1
 148
 149 union pn533_cmd_poll_initdata {
 150         struct {
 151                 u8 afi;
 152                 u8 polling_method;
 153         } __packed type_b;
 154         struct {
 155                 u8 opcode;
 156                 __be16 sc;
 157                 u8 rc;
 158                 u8 tsn;
 159         } __packed felica;
 160 };
 161
 162 /* Poll modulations */
 163 enum {
 164         PN533_POLL_MOD_106KBPS_A,
 165         PN533_POLL_MOD_212KBPS_FELICA,
 166         PN533_POLL_MOD_424KBPS_FELICA,
 167         PN533_POLL_MOD_106KBPS_JEWEL,
 168         PN533_POLL_MOD_847KBPS_B,
 169         PN533_LISTEN_MOD,
 170
 171         __PN533_POLL_MOD_AFTER_LAST,
 172 };
 173 #define PN533_POLL_MOD_MAX (__PN533_POLL_MOD_AFTER_LAST - 1)
 174
 175 struct pn533_poll_modulations {
 176         struct {
 177                 u8 maxtg;
 178                 u8 brty;
 179                 union pn533_cmd_poll_initdata initiator_data;
 180         } __packed data;
 181         u8 len;
 182 };
 183
 184 const struct pn533_poll_modulations poll_mod[] = {
 185         [PN533_POLL_MOD_106KBPS_A] = {
 186                 .data = {
 187                         .maxtg = 1,
 188                         .brty = 0,
 189                 },
 190                 .len = 2,
 191         },
 192         [PN533_POLL_MOD_212KBPS_FELICA] = {
 193                 .data = {
 194                         .maxtg = 1,
 195                         .brty = 1,
 196                         .initiator_data.felica = {
 197                                 .opcode = PN533_FELICA_OPC_SENSF_REQ,
 198                                 .sc = PN533_FELICA_SENSF_SC_ALL,
 199                                 .rc = PN533_FELICA_SENSF_RC_NO_SYSTEM_CODE,
 200                                 .tsn = 0,
 201                         },
 202                 },
 203                 .len = 7,
 204         },
 205         [PN533_POLL_MOD_424KBPS_FELICA] = {
 206                 .data = {
 207                         .maxtg = 1,
 208                         .brty = 2,
 209                         .initiator_data.felica = {
 210                                 .opcode = PN533_FELICA_OPC_SENSF_REQ,
 211                                 .sc = PN533_FELICA_SENSF_SC_ALL,
 212                                 .rc = PN533_FELICA_SENSF_RC_NO_SYSTEM_CODE,
 213                                 .tsn = 0,
 214                         },
 215                  },
 216                 .len = 7,
 217         },
 218         [PN533_POLL_MOD_106KBPS_JEWEL] = {
 219                 .data = {
 220                         .maxtg = 1,
 221                         .brty = 4,
 222                 },
 223                 .len = 2,
 224         },
 225         [PN533_POLL_MOD_847KBPS_B] = {
 226                 .data = {
 227                         .maxtg = 1,
 228                         .brty = 8,
 229                         .initiator_data.type_b = {
 230                                 .afi = PN533_TYPE_B_AFI_ALL_FAMILIES,
 231                                 .polling_method =
 232                                         PN533_TYPE_B_POLL_METHOD_TIMESLOT,
 233                         },
 234                 },
 235                 .len = 3,
 236         },
 237         [PN533_LISTEN_MOD] = {
 238                 .len = 0,
 239         },
 240 };
 241
 242 /* PN533_CMD_IN_ATR */
 243
 244 struct pn533_cmd_activate_param {
 245         u8 tg;
 246         u8 next;
 247 } __packed;
 248
 249 struct pn533_cmd_activate_response {
 250         u8 status;
 251         u8 nfcid3t[10];
 252         u8 didt;
 253         u8 bst;
 254         u8 brt;
 255         u8 to;
 256         u8 ppt;
 257         /* optional */
 258         u8 gt[];
 259 } __packed;
 260
 261 /* PN533_CMD_IN_JUMP_FOR_DEP */
 262 struct pn533_cmd_jump_dep {
 263         u8 active;
 264         u8 baud;
 265         u8 next;
 266         u8 data[];
 267 } __packed;
 268
 269 struct pn533_cmd_jump_dep_response {
 270         u8 status;
 271         u8 tg;
 272         u8 nfcid3t[10];
 273         u8 didt;
 274         u8 bst;
 275         u8 brt;
 276         u8 to;
 277         u8 ppt;
 278         /* optional */
 279         u8 gt[];
 280 } __packed;
 281
 282
 283 /* PN533_TG_INIT_AS_TARGET */
 284 #define PN533_INIT_TARGET_PASSIVE 0x1
 285 #define PN533_INIT_TARGET_DEP 0x2
 286
 287 #define PN533_INIT_TARGET_RESP_FRAME_MASK 0x3
 288 #define PN533_INIT_TARGET_RESP_ACTIVE     0x1
 289 #define PN533_INIT_TARGET_RESP_DEP        0x4
 290
 291 struct pn533_cmd_init_target {
 292         u8 mode;
 293         u8 mifare[6];
 294         u8 felica[18];
 295         u8 nfcid3[10];
 296         u8 gb_len;
 297         u8 gb[];
 298 } __packed;
 299
 300 struct pn533_cmd_init_target_response {
 301         u8 mode;
 302         u8 cmd[];
 303 } __packed;
 304
 305 struct pn533 {
 306         struct usb_device *udev;
 307         struct usb_interface *interface;
 308         struct nfc_dev *nfc_dev;
 309
 310         struct urb *out_urb;
 311         int out_maxlen;
 312         struct pn533_frame *out_frame;
 313
 314         struct urb *in_urb;
 315         int in_maxlen;
 316         struct pn533_frame *in_frame;
 317
 318         struct sk_buff_head resp_q;
 319
 320         struct workqueue_struct *wq;
 321         struct work_struct cmd_work;
 322         struct work_struct poll_work;
 323         struct work_struct mi_work;
 324         struct work_struct tg_work;
 325         struct timer_list listen_timer;
 326         struct pn533_frame *wq_in_frame;
 327         int wq_in_error;
 328         int cancel_listen;
 329
 330         pn533_cmd_complete_t cmd_complete;
 331         void *cmd_complete_arg;
 332         struct mutex cmd_lock;
 333         u8 cmd;
 334
 335         struct pn533_poll_modulations *poll_mod_active[PN533_POLL_MOD_MAX + 1];
 336         u8 poll_mod_count;
 337         u8 poll_mod_curr;
 338         u32 poll_protocols;
 339         u32 listen_protocols;
 340
 341         u8 *gb;
 342         size_t gb_len;
 343
 344         u8 tgt_available_prots;
 345         u8 tgt_active_prot;
 346         u8 tgt_mode;
 347 };
 348
 349 struct pn533_frame {
 350         u8 preamble;
 351         __be16 start_frame;
 352         u8 datalen;
 353         u8 datalen_checksum;
 354         u8 data[];
 355 } __packed;
 356
 357 /* The rule: value + checksum = 0 */
 358 static inline u8 pn533_checksum(u8 value)
 359 {
 360         return ~value + 1;
 361 }
 362
 363 /* The rule: sum(data elements) + checksum = 0 */
 364 static u8 pn533_data_checksum(u8 *data, int datalen)
 365 {
 366         u8 sum = 0;
 367         int i;
 368
 369         for (i = 0; i < datalen; i++)
 370                 sum += data[i];
 371
 372         return pn533_checksum(sum);
 373 }
 374
 375 /**
 376  * pn533_tx_frame_ack - create a ack frame
 377  * @frame:      The frame to be set as ack
 378  *
 379  * Ack is different type of standard frame. As a standard frame, it has
 380  * preamble and start_frame. However the checksum of this frame must fail,
 381  * i.e. datalen + datalen_checksum must NOT be zero. When the checksum test
 382  * fails and datalen = 0 and datalen_checksum = 0xFF, the frame is a ack.
 383  * After datalen_checksum field, the postamble is placed.
 384  */
 385 static void pn533_tx_frame_ack(struct pn533_frame *frame)
 386 {
 387         frame->preamble = 0;
 388         frame->start_frame = cpu_to_be16(PN533_SOF);
 389         frame->datalen = 0;
 390         frame->datalen_checksum = 0xFF;
 391         /* data[0] is used as postamble */
 392         frame->data[0] = 0;
 393 }
 394
 395 static void pn533_tx_frame_init(struct pn533_frame *frame, u8 cmd)
 396 {
 397         frame->preamble = 0;
 398         frame->start_frame = cpu_to_be16(PN533_SOF);
 399         PN533_FRAME_IDENTIFIER(frame) = PN533_DIR_OUT;
 400         PN533_FRAME_CMD(frame) = cmd;
 401         frame->datalen = 2;
 402 }
 403
 404 static void pn533_tx_frame_finish(struct pn533_frame *frame)
 405 {
 406         frame->datalen_checksum = pn533_checksum(frame->datalen);
 407
 408         PN533_FRAME_CHECKSUM(frame) =
 409                 pn533_data_checksum(frame->data, frame->datalen);
 410
 411         PN533_FRAME_POSTAMBLE(frame) = 0;
 412 }
 413
 414 static bool pn533_rx_frame_is_valid(struct pn533_frame *frame)
 415 {
 416         u8 checksum;
 417
 418         if (frame->start_frame != cpu_to_be16(PN533_SOF))
 419                 return false;
 420
 421         checksum = pn533_checksum(frame->datalen);
 422         if (checksum != frame->datalen_checksum)
 423                 return false;
 424
 425         checksum = pn533_data_checksum(frame->data, frame->datalen);
 426         if (checksum != PN533_FRAME_CHECKSUM(frame))
 427                 return false;
 428
 429         return true;
 430 }
 431
 432 static bool pn533_rx_frame_is_ack(struct pn533_frame *frame)
 433 {
 434         if (frame->start_frame != cpu_to_be16(PN533_SOF))
 435                 return false;
 436
 437         if (frame->datalen != 0 || frame->datalen_checksum != 0xFF)
 438                 return false;
 439
 440         return true;
 441 }
 442
 443 static bool pn533_rx_frame_is_cmd_response(struct pn533_frame *frame, u8 cmd)
 444 {
 445         return (PN533_FRAME_CMD(frame) == PN533_CMD_RESPONSE(cmd));
 446 }
 447
 448
 449 static void pn533_wq_cmd_complete(struct work_struct *work)
 450 {
 451         struct pn533 *dev = container_of(work, struct pn533, cmd_work);
 452         struct pn533_frame *in_frame;
 453         int rc;
 454
 455         in_frame = dev->wq_in_frame;
 456
 457         if (dev->wq_in_error)
 458                 rc = dev->cmd_complete(dev, dev->cmd_complete_arg, NULL,
 459                                                         dev->wq_in_error);
 460         else
 461                 rc = dev->cmd_complete(dev, dev->cmd_complete_arg,
 462                                         PN533_FRAME_CMD_PARAMS_PTR(in_frame),
 463                                         PN533_FRAME_CMD_PARAMS_LEN(in_frame));
 464
 465         if (rc != -EINPROGRESS)
 466                 mutex_unlock(&dev->cmd_lock);
 467 }
 468
 469 static void pn533_recv_response(struct urb *urb)
 470 {
 471         struct pn533 *dev = urb->context;
 472         struct pn533_frame *in_frame;
 473
 474         dev->wq_in_frame = NULL;
 475
 476         switch (urb->status) {
 477         case 0:
 478                 /* success */
 479                 break;
 480         case -ECONNRESET:
 481         case -ENOENT:
 482         case -ESHUTDOWN:
 483                 nfc_dev_dbg(&dev->interface->dev, "Urb shutting down with"
 484                                                 " status: %d", urb->status);
 485                 dev->wq_in_error = urb->status;
 486                 goto sched_wq;
 487         default:
 488                 nfc_dev_err(&dev->interface->dev, "Nonzero urb status received:"
 489                                                         " %d", urb->status);
 490                 dev->wq_in_error = urb->status;
 491                 goto sched_wq;
 492         }
 493
 494         in_frame = dev->in_urb->transfer_buffer;
 495
 496         if (!pn533_rx_frame_is_valid(in_frame)) {
 497                 nfc_dev_err(&dev->interface->dev, "Received an invalid frame");
 498                 dev->wq_in_error = -EIO;
 499                 goto sched_wq;
 500         }
 501
 502         if (!pn533_rx_frame_is_cmd_response(in_frame, dev->cmd)) {
 503                 nfc_dev_err(&dev->interface->dev, "The received frame is not "
 504                                                 "response to the last command");
 505                 dev->wq_in_error = -EIO;
 506                 goto sched_wq;
 507         }
 508
 509         nfc_dev_dbg(&dev->interface->dev, "Received a valid frame");
 510         dev->wq_in_error = 0;
 511         dev->wq_in_frame = in_frame;
 512
 513 sched_wq:
 514         queue_work(dev->wq, &dev->cmd_work);
 515 }
 516
 517 static int pn533_submit_urb_for_response(struct pn533 *dev, gfp_t flags)
 518 {
 519         dev->in_urb->complete = pn533_recv_response;
 520
 521         return usb_submit_urb(dev->in_urb, flags);
 522 }
 523
 524 static void pn533_recv_ack(struct urb *urb)
 525 {
 526         struct pn533 *dev = urb->context;
 527         struct pn533_frame *in_frame;
 528         int rc;
 529
 530         switch (urb->status) {
 531         case 0:
 532                 /* success */
 533                 break;
 534         case -ECONNRESET:
 535         case -ENOENT:
 536         case -ESHUTDOWN:
 537                 nfc_dev_dbg(&dev->interface->dev, "Urb shutting down with"
 538                                                 " status: %d", urb->status);
 539                 dev->wq_in_error = urb->status;
 540                 goto sched_wq;
 541         default:
 542                 nfc_dev_err(&dev->interface->dev, "Nonzero urb status received:"
 543                                                         " %d", urb->status);
 544                 dev->wq_in_error = urb->status;
 545                 goto sched_wq;
 546         }
 547
 548         in_frame = dev->in_urb->transfer_buffer;
 549
 550         if (!pn533_rx_frame_is_ack(in_frame)) {
 551                 nfc_dev_err(&dev->interface->dev, "Received an invalid ack");
 552                 dev->wq_in_error = -EIO;
 553                 goto sched_wq;
 554         }
 555
 556         nfc_dev_dbg(&dev->interface->dev, "Received a valid ack");
 557
 558         rc = pn533_submit_urb_for_response(dev, GFP_ATOMIC);
 559         if (rc) {
 560                 nfc_dev_err(&dev->interface->dev, "usb_submit_urb failed with"
 561                                                         " result %d", rc);
 562                 dev->wq_in_error = rc;
 563                 goto sched_wq;
 564         }
 565
 566         return;
 567
 568 sched_wq:
 569         dev->wq_in_frame = NULL;
 570         queue_work(dev->wq, &dev->cmd_work);
 571 }
 572
 573 static int pn533_submit_urb_for_ack(struct pn533 *dev, gfp_t flags)
 574 {
 575         dev->in_urb->complete = pn533_recv_ack;
 576
 577         return usb_submit_urb(dev->in_urb, flags);
 578 }
 579
 580 static int pn533_send_ack(struct pn533 *dev, gfp_t flags)
 581 {
 582         int rc;
 583
 584         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
 585
 586         pn533_tx_frame_ack(dev->out_frame);
 587
 588         dev->out_urb->transfer_buffer = dev->out_frame;
 589         dev->out_urb->transfer_buffer_length = PN533_FRAME_ACK_SIZE;
 590         rc = usb_submit_urb(dev->out_urb, flags);
 591
 592         return rc;
 593 }
 594
 595 static int __pn533_send_cmd_frame_async(struct pn533 *dev,
 596                                         struct pn533_frame *out_frame,
 597                                         struct pn533_frame *in_frame,
 598                                         int in_frame_len,
 599                                         pn533_cmd_complete_t cmd_complete,
 600                                         void *arg, gfp_t flags)
 601 {
 602         int rc;
 603
 604         nfc_dev_dbg(&dev->interface->dev, "Sending command 0x%x",
 605                                                 PN533_FRAME_CMD(out_frame));
 606
 607         dev->cmd = PN533_FRAME_CMD(out_frame);
 608         dev->cmd_complete = cmd_complete;
 609         dev->cmd_complete_arg = arg;
 610
 611         dev->out_urb->transfer_buffer = out_frame;
 612         dev->out_urb->transfer_buffer_length =
 613                                 PN533_FRAME_SIZE(out_frame);
 614
 615         dev->in_urb->transfer_buffer = in_frame;
 616         dev->in_urb->transfer_buffer_length = in_frame_len;
 617
 618         rc = usb_submit_urb(dev->out_urb, flags);
 619         if (rc)
 620                 return rc;
 621
 622         rc = pn533_submit_urb_for_ack(dev, flags);
 623         if (rc)
 624                 goto error;
 625
 626         return 0;
 627
 628 error:
 629         usb_unlink_urb(dev->out_urb);
 630         return rc;
 631 }
 632
 633 static int pn533_send_cmd_frame_async(struct pn533 *dev,
 634                                         struct pn533_frame *out_frame,
 635                                         struct pn533_frame *in_frame,
 636                                         int in_frame_len,
 637                                         pn533_cmd_complete_t cmd_complete,
 638                                         void *arg, gfp_t flags)
 639 {
 640         int rc;
 641
 642         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
 643
 644         if (!mutex_trylock(&dev->cmd_lock))
 645                 return -EBUSY;
 646
 647         rc = __pn533_send_cmd_frame_async(dev, out_frame, in_frame,
 648                                         in_frame_len, cmd_complete, arg, flags);
 649         if (rc)
 650                 goto error;
 651
 652         return 0;
 653 error:
 654         mutex_unlock(&dev->cmd_lock);
 655         return rc;
 656 }
 657
 658 struct pn533_sync_cmd_response {
 659         int rc;
 660         struct completion done;
 661 };
 662
 663 static int pn533_sync_cmd_complete(struct pn533 *dev, void *_arg,
 664                                         u8 *params, int params_len)
 665 {
 666         struct pn533_sync_cmd_response *arg = _arg;
 667
 668         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
 669
 670         arg->rc = 0;
 671
 672         if (params_len < 0) /* error */
 673                 arg->rc = params_len;
 674
 675         complete(&arg->done);
 676
 677         return 0;
 678 }
 679
 680 static int pn533_send_cmd_frame_sync(struct pn533 *dev,
 681                                                 struct pn533_frame *out_frame,
 682                                                 struct pn533_frame *in_frame,
 683                                                 int in_frame_len)
 684 {
 685         int rc;
 686         struct pn533_sync_cmd_response arg;
 687
 688         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
 689
 690         init_completion(&arg.done);
 691
 692         rc = pn533_send_cmd_frame_async(dev, out_frame, in_frame, in_frame_len,
 693                                 pn533_sync_cmd_complete, &arg, GFP_KERNEL);
 694         if (rc)
 695                 return rc;
 696
 697         wait_for_completion(&arg.done);
 698
 699         return arg.rc;
 700 }
 701
 702 static void pn533_send_complete(struct urb *urb)
 703 {
 704         struct pn533 *dev = urb->context;
 705
 706         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
 707
 708         switch (urb->status) {
 709         case 0:
 710                 /* success */
 711                 break;
 712         case -ECONNRESET:
 713         case -ENOENT:
 714         case -ESHUTDOWN:
 715                 nfc_dev_dbg(&dev->interface->dev, "Urb shutting down with"
 716                                                 " status: %d", urb->status);
 717                 break;
 718         default:
 719                 nfc_dev_dbg(&dev->interface->dev, "Nonzero urb status received:"
 720                                                         " %d", urb->status);
 721         }
 722 }
 723
 724 struct pn533_target_type_a {
 725         __be16 sens_res;
 726         u8 sel_res;
 727         u8 nfcid_len;
 728         u8 nfcid_data[];
 729 } __packed;
 730
 731
 732 #define PN533_TYPE_A_SENS_RES_NFCID1(x) ((u8)((be16_to_cpu(x) & 0x00C0) >> 6))
 733 #define PN533_TYPE_A_SENS_RES_SSD(x) ((u8)((be16_to_cpu(x) & 0x001F) >> 0))
 734 #define PN533_TYPE_A_SENS_RES_PLATCONF(x) ((u8)((be16_to_cpu(x) & 0x0F00) >> 8))
 735
 736 #define PN533_TYPE_A_SENS_RES_SSD_JEWEL 0x00
 737 #define PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL 0x0C
 738
 739 #define PN533_TYPE_A_SEL_PROT(x) (((x) & 0x60) >> 5)
 740 #define PN533_TYPE_A_SEL_CASCADE(x) (((x) & 0x04) >> 2)
 741
 742 #define PN533_TYPE_A_SEL_PROT_MIFARE 0
 743 #define PN533_TYPE_A_SEL_PROT_ISO14443 1
 744 #define PN533_TYPE_A_SEL_PROT_DEP 2
 745 #define PN533_TYPE_A_SEL_PROT_ISO14443_DEP 3
 746
 747 static bool pn533_target_type_a_is_valid(struct pn533_target_type_a *type_a,
 748                                                         int target_data_len)
 749 {
 750         u8 ssd;
 751         u8 platconf;
 752
 753         if (target_data_len < sizeof(struct pn533_target_type_a))
 754                 return false;
 755
 756         /* The lenght check of nfcid[] and ats[] are not being performed because
 757            the values are not being used */
 758
 759         /* Requirement 4.6.3.3 from NFC Forum Digital Spec */
 760         ssd = PN533_TYPE_A_SENS_RES_SSD(type_a->sens_res);
 761         platconf = PN533_TYPE_A_SENS_RES_PLATCONF(type_a->sens_res);
 762
 763         if ((ssd == PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
 764                         platconf != PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL) ||
 765                         (ssd != PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
 766                         platconf == PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL))
 767                 return false;
 768
 769         /* Requirements 4.8.2.1, 4.8.2.3, 4.8.2.5 and 4.8.2.7 from NFC Forum */
 770         if (PN533_TYPE_A_SEL_CASCADE(type_a->sel_res) != 0)
 771                 return false;
 772
 773         return true;
 774 }
 775
 776 static int pn533_target_found_type_a(struct nfc_target *nfc_tgt, u8 *tgt_data,
 777                                                         int tgt_data_len)
 778 {
 779         struct pn533_target_type_a *tgt_type_a;
 780
 781         tgt_type_a = (struct pn533_target_type_a *) tgt_data;
 782
 783         if (!pn533_target_type_a_is_valid(tgt_type_a, tgt_data_len))
 784                 return -EPROTO;
 785
 786         switch (PN533_TYPE_A_SEL_PROT(tgt_type_a->sel_res)) {
 787         case PN533_TYPE_A_SEL_PROT_MIFARE:
 788                 nfc_tgt->supported_protocols = NFC_PROTO_MIFARE_MASK;
 789                 break;
 790         case PN533_TYPE_A_SEL_PROT_ISO14443:
 791                 nfc_tgt->supported_protocols = NFC_PROTO_ISO14443_MASK;
 792                 break;
 793         case PN533_TYPE_A_SEL_PROT_DEP:
 794                 nfc_tgt->supported_protocols = NFC_PROTO_NFC_DEP_MASK;
 795                 break;
 796         case PN533_TYPE_A_SEL_PROT_ISO14443_DEP:
 797                 nfc_tgt->supported_protocols = NFC_PROTO_ISO14443_MASK |
 798                                                         NFC_PROTO_NFC_DEP_MASK;
 799                 break;
 800         }
 801
 802         nfc_tgt->sens_res = be16_to_cpu(tgt_type_a->sens_res);
 803         nfc_tgt->sel_res = tgt_type_a->sel_res;
 804         nfc_tgt->nfcid1_len = tgt_type_a->nfcid_len;
 805         memcpy(nfc_tgt->nfcid1, tgt_type_a->nfcid_data, nfc_tgt->nfcid1_len);
 806
 807         return 0;
 808 }
 809
 810 struct pn533_target_felica {
 811         u8 pol_res;
 812         u8 opcode;
 813         u8 nfcid2[8];
 814         u8 pad[8];
 815         /* optional */
 816         u8 syst_code[];
 817 } __packed;
 818
 819 #define PN533_FELICA_SENSF_NFCID2_DEP_B1 0x01
 820 #define PN533_FELICA_SENSF_NFCID2_DEP_B2 0xFE
 821
 822 static bool pn533_target_felica_is_valid(struct pn533_target_felica *felica,
 823                                                         int target_data_len)
 824 {
 825         if (target_data_len < sizeof(struct pn533_target_felica))
 826                 return false;
 827
 828         if (felica->opcode != PN533_FELICA_OPC_SENSF_RES)
 829                 return false;
 830
 831         return true;
 832 }
 833
 834 static int pn533_target_found_felica(struct nfc_target *nfc_tgt, u8 *tgt_data,
 835                                                         int tgt_data_len)
 836 {
 837         struct pn533_target_felica *tgt_felica;
 838
 839         tgt_felica = (struct pn533_target_felica *) tgt_data;
 840
 841         if (!pn533_target_felica_is_valid(tgt_felica, tgt_data_len))
 842                 return -EPROTO;
 843
 844         if (tgt_felica->nfcid2[0] == PN533_FELICA_SENSF_NFCID2_DEP_B1 &&
 845                                         tgt_felica->nfcid2[1] ==
 846                                         PN533_FELICA_SENSF_NFCID2_DEP_B2)
 847                 nfc_tgt->supported_protocols = NFC_PROTO_NFC_DEP_MASK;
 848         else
 849                 nfc_tgt->supported_protocols = NFC_PROTO_FELICA_MASK;
 850
 851         memcpy(nfc_tgt->sensf_res, &tgt_felica->opcode, 9);
 852         nfc_tgt->sensf_res_len = 9;
 853
 854         return 0;
 855 }
 856
 857 struct pn533_target_jewel {
 858         __be16 sens_res;
 859         u8 jewelid[4];
 860 } __packed;
 861
 862 static bool pn533_target_jewel_is_valid(struct pn533_target_jewel *jewel,
 863                                                         int target_data_len)
 864 {
 865         u8 ssd;
 866         u8 platconf;
 867
 868         if (target_data_len < sizeof(struct pn533_target_jewel))
 869                 return false;
 870
 871         /* Requirement 4.6.3.3 from NFC Forum Digital Spec */
 872         ssd = PN533_TYPE_A_SENS_RES_SSD(jewel->sens_res);
 873         platconf = PN533_TYPE_A_SENS_RES_PLATCONF(jewel->sens_res);
 874
 875         if ((ssd == PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
 876                         platconf != PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL) ||
 877                         (ssd != PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
 878                         platconf == PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL))
 879                 return false;
 880
 881         return true;
 882 }
 883
 884 static int pn533_target_found_jewel(struct nfc_target *nfc_tgt, u8 *tgt_data,
 885                                                         int tgt_data_len)
 886 {
 887         struct pn533_target_jewel *tgt_jewel;
 888
 889         tgt_jewel = (struct pn533_target_jewel *) tgt_data;
 890
 891         if (!pn533_target_jewel_is_valid(tgt_jewel, tgt_data_len))
 892                 return -EPROTO;
 893
 894         nfc_tgt->supported_protocols = NFC_PROTO_JEWEL_MASK;
 895         nfc_tgt->sens_res = be16_to_cpu(tgt_jewel->sens_res);
 896         nfc_tgt->nfcid1_len = 4;
 897         memcpy(nfc_tgt->nfcid1, tgt_jewel->jewelid, nfc_tgt->nfcid1_len);
 898
 899         return 0;
 900 }
 901
 902 struct pn533_type_b_prot_info {
 903         u8 bitrate;
 904         u8 fsci_type;
 905         u8 fwi_adc_fo;
 906 } __packed;
 907
 908 #define PN533_TYPE_B_PROT_FCSI(x) (((x) & 0xF0) >> 4)
 909 #define PN533_TYPE_B_PROT_TYPE(x) (((x) & 0x0F) >> 0)
 910 #define PN533_TYPE_B_PROT_TYPE_RFU_MASK 0x8
 911
 912 struct pn533_type_b_sens_res {
 913         u8 opcode;
 914         u8 nfcid[4];
 915         u8 appdata[4];
 916         struct pn533_type_b_prot_info prot_info;
 917 } __packed;
 918
 919 #define PN533_TYPE_B_OPC_SENSB_RES 0x50
 920
 921 struct pn533_target_type_b {
 922         struct pn533_type_b_sens_res sensb_res;
 923         u8 attrib_res_len;
 924         u8 attrib_res[];
 925 } __packed;
 926
 927 static bool pn533_target_type_b_is_valid(struct pn533_target_type_b *type_b,
 928                                                         int target_data_len)
 929 {
 930         if (target_data_len < sizeof(struct pn533_target_type_b))
 931                 return false;
 932
 933         if (type_b->sensb_res.opcode != PN533_TYPE_B_OPC_SENSB_RES)
 934                 return false;
 935
 936         if (PN533_TYPE_B_PROT_TYPE(type_b->sensb_res.prot_info.fsci_type) &
 937                                                 PN533_TYPE_B_PROT_TYPE_RFU_MASK)
 938                 return false;
 939
 940         return true;
 941 }
 942
 943 static int pn533_target_found_type_b(struct nfc_target *nfc_tgt, u8 *tgt_data,
 944                                                         int tgt_data_len)
 945 {
 946         struct pn533_target_type_b *tgt_type_b;
 947
 948         tgt_type_b = (struct pn533_target_type_b *) tgt_data;
 949
 950         if (!pn533_target_type_b_is_valid(tgt_type_b, tgt_data_len))
 951                 return -EPROTO;
 952
 953         nfc_tgt->supported_protocols = NFC_PROTO_ISO14443_MASK;
 954
 955         return 0;
 956 }
 957
 958 struct pn533_poll_response {
 959         u8 nbtg;
 960         u8 tg;
 961         u8 target_data[];
 962 } __packed;
 963
 964 static int pn533_target_found(struct pn533 *dev,
 965                         struct pn533_poll_response *resp, int resp_len)
 966 {
 967         int target_data_len;
 968         struct nfc_target nfc_tgt;
 969         int rc;
 970
 971         nfc_dev_dbg(&dev->interface->dev, "%s - modulation=%d", __func__,
 972                                                         dev->poll_mod_curr);
 973
 974         if (resp->tg != 1)
 975                 return -EPROTO;
 976
 977         memset(&nfc_tgt, 0, sizeof(struct nfc_target));
 978
 979         target_data_len = resp_len - sizeof(struct pn533_poll_response);
 980
 981         switch (dev->poll_mod_curr) {
 982         case PN533_POLL_MOD_106KBPS_A:
 983                 rc = pn533_target_found_type_a(&nfc_tgt, resp->target_data,
 984                                                         target_data_len);
 985                 break;
 986         case PN533_POLL_MOD_212KBPS_FELICA:
 987         case PN533_POLL_MOD_424KBPS_FELICA:
 988                 rc = pn533_target_found_felica(&nfc_tgt, resp->target_data,
 989                                                         target_data_len);
 990                 break;
 991         case PN533_POLL_MOD_106KBPS_JEWEL:
 992                 rc = pn533_target_found_jewel(&nfc_tgt, resp->target_data,
 993                                                         target_data_len);
 994                 break;
 995         case PN533_POLL_MOD_847KBPS_B:
 996                 rc = pn533_target_found_type_b(&nfc_tgt, resp->target_data,
 997                                                         target_data_len);
 998                 break;
 999         default:
1000                 nfc_dev_err(&dev->interface->dev, "Unknown current poll"
1001                                                                 " modulation");
1002                 return -EPROTO;
1003         }
1004
1005         if (rc)
1006                 return rc;
1007
1008         if (!(nfc_tgt.supported_protocols & dev->poll_protocols)) {
1009                 nfc_dev_dbg(&dev->interface->dev, "The target found does not"
1010                                                 " have the desired protocol");
1011                 return -EAGAIN;
1012         }
1013
1014         nfc_dev_dbg(&dev->interface->dev, "Target found - supported protocols: "
1015                                         "0x%x", nfc_tgt.supported_protocols);
1016
1017         dev->tgt_available_prots = nfc_tgt.supported_protocols;
1018
1019         nfc_targets_found(dev->nfc_dev, &nfc_tgt, 1);
1020
1021         return 0;
1022 }
1023
1024 static inline void pn533_poll_next_mod(struct pn533 *dev)
1025 {
1026         dev->poll_mod_curr = (dev->poll_mod_curr + 1) % dev->poll_mod_count;
1027 }
1028
1029 static void pn533_poll_reset_mod_list(struct pn533 *dev)
1030 {
1031         dev->poll_mod_count = 0;
1032 }
1033
1034 static void pn533_poll_add_mod(struct pn533 *dev, u8 mod_index)
1035 {
1036         dev->poll_mod_active[dev->poll_mod_count] =
1037                 (struct pn533_poll_modulations *) &poll_mod[mod_index];
1038         dev->poll_mod_count++;
1039 }
1040
1041 static void pn533_poll_create_mod_list(struct pn533 *dev,
1042                                        u32 im_protocols, u32 tm_protocols)
1043 {
1044         pn533_poll_reset_mod_list(dev);
1045
1046         if (im_protocols & NFC_PROTO_MIFARE_MASK
1047             || im_protocols & NFC_PROTO_ISO14443_MASK
1048             || im_protocols & NFC_PROTO_NFC_DEP_MASK)
1049                 pn533_poll_add_mod(dev, PN533_POLL_MOD_106KBPS_A);
1050
1051         if (im_protocols & NFC_PROTO_FELICA_MASK
1052             || im_protocols & NFC_PROTO_NFC_DEP_MASK) {
1053                 pn533_poll_add_mod(dev, PN533_POLL_MOD_212KBPS_FELICA);
1054                 pn533_poll_add_mod(dev, PN533_POLL_MOD_424KBPS_FELICA);
1055         }
1056
1057         if (im_protocols & NFC_PROTO_JEWEL_MASK)
1058                 pn533_poll_add_mod(dev, PN533_POLL_MOD_106KBPS_JEWEL);
1059
1060         if (im_protocols & NFC_PROTO_ISO14443_MASK)
1061                 pn533_poll_add_mod(dev, PN533_POLL_MOD_847KBPS_B);
1062
1063         if (tm_protocols)
1064                 pn533_poll_add_mod(dev, PN533_LISTEN_MOD);
1065 }
1066
1067 static int pn533_start_poll_complete(struct pn533 *dev, void *arg,
1068                                      u8 *params, int params_len)
1069 {
1070         struct pn533_poll_response *resp;
1071         int rc;
1072
1073         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1074
1075         resp = (struct pn533_poll_response *) params;
1076         if (resp->nbtg) {
1077                 rc = pn533_target_found(dev, resp, params_len);
1078
1079                 /* We must stop the poll after a valid target found */
1080                 if (rc == 0) {
1081                         pn533_poll_reset_mod_list(dev);
1082                         return 0;
1083                 }
1084         }
1085
1086         return -EAGAIN;
1087 }
1088
1089 static int pn533_init_target_frame(struct pn533_frame *frame,
1090                                    u8 *gb, size_t gb_len)
1091 {
1092         struct pn533_cmd_init_target *cmd;
1093         size_t cmd_len;
1094         u8 felica_params[18] = {0x1, 0xfe, /* DEP */
1095                                 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, /* random */
1096                                 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
1097                                 0xff, 0xff}; /* System code */
1098         u8 mifare_params[6] = {0x1, 0x1, /* SENS_RES */
1099                                0x0, 0x0, 0x0,
1100                                0x40}; /* SEL_RES for DEP */
1101
1102         cmd_len = sizeof(struct pn533_cmd_init_target) + gb_len + 1;
1103         cmd = kzalloc(cmd_len, GFP_KERNEL);
1104         if (cmd == NULL)
1105                 return -ENOMEM;
1106
1107         pn533_tx_frame_init(frame, PN533_CMD_TG_INIT_AS_TARGET);
1108
1109         /* DEP support only */
1110         cmd->mode |= PN533_INIT_TARGET_DEP;
1111
1112         /* Felica params */
1113         memcpy(cmd->felica, felica_params, 18);
1114         get_random_bytes(cmd->felica + 2, 6);
1115
1116         /* NFCID3 */
1117         memset(cmd->nfcid3, 0, 10);
1118         memcpy(cmd->nfcid3, cmd->felica, 8);
1119
1120         /* MIFARE params */
1121         memcpy(cmd->mifare, mifare_params, 6);
1122
1123         /* General bytes */
1124         cmd->gb_len = gb_len;
1125         memcpy(cmd->gb, gb, gb_len);
1126
1127         /* Len Tk */
1128         cmd->gb[gb_len] = 0;
1129
1130         memcpy(PN533_FRAME_CMD_PARAMS_PTR(frame), cmd, cmd_len);
1131
1132         frame->datalen += cmd_len;
1133
1134         pn533_tx_frame_finish(frame);
1135
1136         kfree(cmd);
1137
1138         return 0;
1139 }
1140
1141 #define PN533_CMD_DATAEXCH_HEAD_LEN (sizeof(struct pn533_frame) + 3)
1142 #define PN533_CMD_DATAEXCH_DATA_MAXLEN 262
1143 static int pn533_tm_get_data_complete(struct pn533 *dev, void *arg,
1144                                       u8 *params, int params_len)
1145 {
1146         struct sk_buff *skb_resp = arg;
1147         struct pn533_frame *in_frame = (struct pn533_frame *) skb_resp->data;
1148
1149         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1150
1151         if (params_len < 0) {
1152                 nfc_dev_err(&dev->interface->dev,
1153                             "Error %d when starting as a target",
1154                             params_len);
1155
1156                 return params_len;
1157         }
1158
1159         if (params_len > 0 && params[0] != 0) {
1160                 nfc_tm_deactivated(dev->nfc_dev);
1161
1162                 dev->tgt_mode = 0;
1163
1164                 kfree_skb(skb_resp);
1165                 return 0;
1166         }
1167
1168         skb_put(skb_resp, PN533_FRAME_SIZE(in_frame));
1169         skb_pull(skb_resp, PN533_CMD_DATAEXCH_HEAD_LEN);
1170         skb_trim(skb_resp, skb_resp->len - PN533_FRAME_TAIL_SIZE);
1171
1172         return nfc_tm_data_received(dev->nfc_dev, skb_resp);
1173 }
1174
1175 static void pn533_wq_tg_get_data(struct work_struct *work)
1176 {
1177         struct pn533 *dev = container_of(work, struct pn533, tg_work);
1178         struct pn533_frame *in_frame;
1179         struct sk_buff *skb_resp;
1180         size_t skb_resp_len;
1181
1182         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1183
1184         skb_resp_len = PN533_CMD_DATAEXCH_HEAD_LEN +
1185                 PN533_CMD_DATAEXCH_DATA_MAXLEN +
1186                 PN533_FRAME_TAIL_SIZE;
1187
1188         skb_resp = nfc_alloc_recv_skb(skb_resp_len, GFP_KERNEL);
1189         if (!skb_resp)
1190                 return;
1191
1192         in_frame = (struct pn533_frame *)skb_resp->data;
1193
1194         pn533_tx_frame_init(dev->out_frame, PN533_CMD_TG_GET_DATA);
1195         pn533_tx_frame_finish(dev->out_frame);
1196
1197         pn533_send_cmd_frame_async(dev, dev->out_frame, in_frame,
1198                                    skb_resp_len,
1199                                    pn533_tm_get_data_complete,
1200                                    skb_resp, GFP_KERNEL);
1201
1202         return;
1203 }
1204
1205 #define ATR_REQ_GB_OFFSET 17
1206 static int pn533_init_target_complete(struct pn533 *dev, void *arg,
1207                                       u8 *params, int params_len)
1208 {
1209         struct pn533_cmd_init_target_response *resp;
1210         u8 frame, comm_mode = NFC_COMM_PASSIVE, *gb;
1211         size_t gb_len;
1212         int rc;
1213
1214         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1215
1216         if (params_len < 0) {
1217                 nfc_dev_err(&dev->interface->dev,
1218                             "Error %d when starting as a target",
1219                             params_len);
1220
1221                 return params_len;
1222         }
1223
1224         if (params_len < ATR_REQ_GB_OFFSET + 1)
1225                 return -EINVAL;
1226
1227         resp = (struct pn533_cmd_init_target_response *) params;
1228
1229         nfc_dev_dbg(&dev->interface->dev, "Target mode 0x%x param len %d\n",
1230                     resp->mode, params_len);
1231
1232         frame = resp->mode & PN533_INIT_TARGET_RESP_FRAME_MASK;
1233         if (frame == PN533_INIT_TARGET_RESP_ACTIVE)
1234                 comm_mode = NFC_COMM_ACTIVE;
1235
1236         /* Again, only DEP */
1237         if ((resp->mode & PN533_INIT_TARGET_RESP_DEP) == 0)
1238                 return -EOPNOTSUPP;
1239
1240         gb = resp->cmd + ATR_REQ_GB_OFFSET;
1241         gb_len = params_len - (ATR_REQ_GB_OFFSET + 1);
1242
1243         rc = nfc_tm_activated(dev->nfc_dev, NFC_PROTO_NFC_DEP_MASK,
1244                               comm_mode, gb, gb_len);
1245         if (rc < 0) {
1246                 nfc_dev_err(&dev->interface->dev,
1247                             "Error when signaling target activation");
1248                 return rc;
1249         }
1250
1251         dev->tgt_mode = 1;
1252
1253         queue_work(dev->wq, &dev->tg_work);
1254
1255         return 0;
1256 }
1257
1258 static void pn533_listen_mode_timer(unsigned long data)
1259 {
1260         struct pn533 *dev = (struct pn533 *) data;
1261
1262         nfc_dev_dbg(&dev->interface->dev, "Listen mode timeout");
1263
1264         /* An ack will cancel the last issued command (poll) */
1265         pn533_send_ack(dev, GFP_ATOMIC);
1266
1267         dev->cancel_listen = 1;
1268
1269         mutex_unlock(&dev->cmd_lock);
1270
1271         pn533_poll_next_mod(dev);
1272
1273         queue_work(dev->wq, &dev->poll_work);
1274 }
1275
1276 static int pn533_poll_complete(struct pn533 *dev, void *arg,
1277                                u8 *params, int params_len)
1278 {
1279         struct pn533_poll_modulations *cur_mod;
1280         int rc;
1281
1282         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1283
1284         if (params_len == -ENOENT) {
1285                 if (dev->poll_mod_count != 0)
1286                         return 0;
1287
1288                 nfc_dev_err(&dev->interface->dev,
1289                             "Polling operation has been stopped");
1290
1291                 goto stop_poll;
1292         }
1293
1294         if (params_len < 0) {
1295                 nfc_dev_err(&dev->interface->dev,
1296                             "Error %d when running poll", params_len);
1297
1298                 goto stop_poll;
1299         }
1300
1301         cur_mod = dev->poll_mod_active[dev->poll_mod_curr];
1302
1303         if (cur_mod->len == 0) {
1304                 del_timer(&dev->listen_timer);
1305
1306                 return pn533_init_target_complete(dev, arg, params, params_len);
1307         } else {
1308                 rc = pn533_start_poll_complete(dev, arg, params, params_len);
1309                 if (!rc)
1310                         return rc;
1311         }
1312
1313         pn533_poll_next_mod(dev);
1314
1315         queue_work(dev->wq, &dev->poll_work);
1316
1317         return 0;
1318
1319 stop_poll:
1320         pn533_poll_reset_mod_list(dev);
1321         dev->poll_protocols = 0;
1322         return 0;
1323 }
1324
1325 static void pn533_build_poll_frame(struct pn533 *dev,
1326                                    struct pn533_frame *frame,
1327                                    struct pn533_poll_modulations *mod)
1328 {
1329         nfc_dev_dbg(&dev->interface->dev, "mod len %d\n", mod->len);
1330
1331         if (mod->len == 0) {
1332                 /* Listen mode */
1333                 pn533_init_target_frame(frame, dev->gb, dev->gb_len);
1334         } else {
1335                 /* Polling mode */
1336                 pn533_tx_frame_init(frame, PN533_CMD_IN_LIST_PASSIVE_TARGET);
1337
1338                 memcpy(PN533_FRAME_CMD_PARAMS_PTR(frame), &mod->data, mod->len);
1339                 frame->datalen += mod->len;
1340
1341                 pn533_tx_frame_finish(frame);
1342         }
1343 }
1344
1345 static int pn533_send_poll_frame(struct pn533 *dev)
1346 {
1347         struct pn533_poll_modulations *cur_mod;
1348         int rc;
1349
1350         cur_mod = dev->poll_mod_active[dev->poll_mod_curr];
1351
1352         pn533_build_poll_frame(dev, dev->out_frame, cur_mod);
1353
1354         rc = pn533_send_cmd_frame_async(dev, dev->out_frame, dev->in_frame,
1355                                 dev->in_maxlen, pn533_poll_complete,
1356                                 NULL, GFP_KERNEL);
1357         if (rc)
1358                 nfc_dev_err(&dev->interface->dev, "Polling loop error %d", rc);
1359
1360         return rc;
1361 }
1362
1363 static void pn533_wq_poll(struct work_struct *work)
1364 {
1365         struct pn533 *dev = container_of(work, struct pn533, poll_work);
1366         struct pn533_poll_modulations *cur_mod;
1367         int rc;
1368
1369         cur_mod = dev->poll_mod_active[dev->poll_mod_curr];
1370
1371         nfc_dev_dbg(&dev->interface->dev,
1372                     "%s cancel_listen %d modulation len %d",
1373                     __func__, dev->cancel_listen, cur_mod->len);
1374
1375         if (dev->cancel_listen == 1) {
1376                 dev->cancel_listen = 0;
1377                 usb_kill_urb(dev->in_urb);
1378         }
1379
1380         rc = pn533_send_poll_frame(dev);
1381         if (rc)
1382                 return;
1383
1384         if (cur_mod->len == 0 && dev->poll_mod_count > 1)
1385                 mod_timer(&dev->listen_timer, jiffies + PN533_LISTEN_TIME * HZ);
1386
1387         return;
1388 }
1389
1390 static int pn533_start_poll(struct nfc_dev *nfc_dev,
1391                             u32 im_protocols, u32 tm_protocols)
1392 {
1393         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
1394
1395         nfc_dev_dbg(&dev->interface->dev,
1396                     "%s: im protocols 0x%x tm protocols 0x%x",
1397                     __func__, im_protocols, tm_protocols);
1398
1399         if (dev->tgt_active_prot) {
1400                 nfc_dev_err(&dev->interface->dev,
1401                             "Cannot poll with a target already activated");
1402                 return -EBUSY;
1403         }
1404
1405         if (dev->tgt_mode) {
1406                 nfc_dev_err(&dev->interface->dev,
1407                             "Cannot poll while already being activated");
1408                 return -EBUSY;
1409         }
1410
1411         if (tm_protocols) {
1412                 dev->gb = nfc_get_local_general_bytes(nfc_dev, &dev->gb_len);
1413                 if (dev->gb == NULL)
1414                         tm_protocols = 0;
1415         }
1416
1417         dev->poll_mod_curr = 0;
1418         pn533_poll_create_mod_list(dev, im_protocols, tm_protocols);
1419         dev->poll_protocols = im_protocols;
1420         dev->listen_protocols = tm_protocols;
1421
1422         return pn533_send_poll_frame(dev);
1423 }
1424
1425 static void pn533_stop_poll(struct nfc_dev *nfc_dev)
1426 {
1427         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
1428
1429         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1430
1431         del_timer(&dev->listen_timer);
1432
1433         if (!dev->poll_mod_count) {
1434                 nfc_dev_dbg(&dev->interface->dev, "Polling operation was not"
1435                                                                 " running");
1436                 return;
1437         }
1438
1439         /* An ack will cancel the last issued command (poll) */
1440         pn533_send_ack(dev, GFP_KERNEL);
1441
1442         /* prevent pn533_start_poll_complete to issue a new poll meanwhile */
1443         usb_kill_urb(dev->in_urb);
1444
1445         pn533_poll_reset_mod_list(dev);
1446 }
1447
1448 static int pn533_activate_target_nfcdep(struct pn533 *dev)
1449 {
1450         struct pn533_cmd_activate_param param;
1451         struct pn533_cmd_activate_response *resp;
1452         u16 gt_len;
1453         int rc;
1454
1455         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1456
1457         pn533_tx_frame_init(dev->out_frame, PN533_CMD_IN_ATR);
1458
1459         param.tg = 1;
1460         param.next = 0;
1461         memcpy(PN533_FRAME_CMD_PARAMS_PTR(dev->out_frame), &param,
1462                                 sizeof(struct pn533_cmd_activate_param));
1463         dev->out_frame->datalen += sizeof(struct pn533_cmd_activate_param);
1464
1465         pn533_tx_frame_finish(dev->out_frame);
1466
1467         rc = pn533_send_cmd_frame_sync(dev, dev->out_frame, dev->in_frame,
1468                                                                 dev->in_maxlen);
1469         if (rc)
1470                 return rc;
1471
1472         resp = (struct pn533_cmd_activate_response *)
1473                                 PN533_FRAME_CMD_PARAMS_PTR(dev->in_frame);
1474         rc = resp->status & PN533_CMD_RET_MASK;
1475         if (rc != PN533_CMD_RET_SUCCESS)
1476                 return -EIO;
1477
1478         /* ATR_RES general bytes are located at offset 16 */
1479         gt_len = PN533_FRAME_CMD_PARAMS_LEN(dev->in_frame) - 16;
1480         rc = nfc_set_remote_general_bytes(dev->nfc_dev, resp->gt, gt_len);
1481
1482         return rc;
1483 }
1484
1485 static int pn533_activate_target(struct nfc_dev *nfc_dev,
1486                                  struct nfc_target *target, u32 protocol)
1487 {
1488         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
1489         int rc;
1490
1491         nfc_dev_dbg(&dev->interface->dev, "%s - protocol=%u", __func__,
1492                                                                 protocol);
1493
1494         if (dev->poll_mod_count) {
1495                 nfc_dev_err(&dev->interface->dev, "Cannot activate while"
1496                                                                 " polling");
1497                 return -EBUSY;
1498         }
1499
1500         if (dev->tgt_active_prot) {
1501                 nfc_dev_err(&dev->interface->dev, "There is already an active"
1502                                                                 " target");
1503                 return -EBUSY;
1504         }
1505
1506         if (!dev->tgt_available_prots) {
1507                 nfc_dev_err(&dev->interface->dev, "There is no available target"
1508                                                                 " to activate");
1509                 return -EINVAL;
1510         }
1511
1512         if (!(dev->tgt_available_prots & (1 << protocol))) {
1513                 nfc_dev_err(&dev->interface->dev, "The target does not support"
1514                                         " the requested protocol %u", protocol);
1515                 return -EINVAL;
1516         }
1517
1518         if (protocol == NFC_PROTO_NFC_DEP) {
1519                 rc = pn533_activate_target_nfcdep(dev);
1520                 if (rc) {
1521                         nfc_dev_err(&dev->interface->dev, "Error %d when"
1522                                                 " activating target with"
1523                                                 " NFC_DEP protocol", rc);
1524                         return rc;
1525                 }
1526         }
1527
1528         dev->tgt_active_prot = protocol;
1529         dev->tgt_available_prots = 0;
1530
1531         return 0;
1532 }
1533
1534 static void pn533_deactivate_target(struct nfc_dev *nfc_dev,
1535                                     struct nfc_target *target)
1536 {
1537         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
1538         u8 tg;
1539         u8 status;
1540         int rc;
1541
1542         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1543
1544         if (!dev->tgt_active_prot) {
1545                 nfc_dev_err(&dev->interface->dev, "There is no active target");
1546                 return;
1547         }
1548
1549         dev->tgt_active_prot = 0;
1550
1551         skb_queue_purge(&dev->resp_q);
1552
1553         pn533_tx_frame_init(dev->out_frame, PN533_CMD_IN_RELEASE);
1554
1555         tg = 1;
1556         memcpy(PN533_FRAME_CMD_PARAMS_PTR(dev->out_frame), &tg, sizeof(u8));
1557         dev->out_frame->datalen += sizeof(u8);
1558
1559         pn533_tx_frame_finish(dev->out_frame);
1560
1561         rc = pn533_send_cmd_frame_sync(dev, dev->out_frame, dev->in_frame,
1562                                                                 dev->in_maxlen);
1563         if (rc) {
1564                 nfc_dev_err(&dev->interface->dev, "Error when sending release"
1565                                                 " command to the controller");
1566                 return;
1567         }
1568
1569         status = PN533_FRAME_CMD_PARAMS_PTR(dev->in_frame)[0];
1570         rc = status & PN533_CMD_RET_MASK;
1571         if (rc != PN533_CMD_RET_SUCCESS)
1572                 nfc_dev_err(&dev->interface->dev, "Error 0x%x when releasing"
1573                                                         " the target", rc);
1574
1575         return;
1576 }
1577
1578
1579 static int pn533_in_dep_link_up_complete(struct pn533 *dev, void *arg,
1580                                                 u8 *params, int params_len)
1581 {
1582         struct pn533_cmd_jump_dep *cmd;
1583         struct pn533_cmd_jump_dep_response *resp;
1584         struct nfc_target nfc_target;
1585         u8 target_gt_len;
1586         int rc;
1587
1588         if (params_len == -ENOENT) {
1589                 nfc_dev_dbg(&dev->interface->dev, "");
1590                 return 0;
1591         }
1592
1593         if (params_len < 0) {
1594                 nfc_dev_err(&dev->interface->dev,
1595                                 "Error %d when bringing DEP link up",
1596                                                                 params_len);
1597                 return 0;
1598         }
1599
1600         if (dev->tgt_available_prots &&
1601             !(dev->tgt_available_prots & (1 << NFC_PROTO_NFC_DEP))) {
1602                 nfc_dev_err(&dev->interface->dev,
1603                         "The target does not support DEP");
1604                 return -EINVAL;
1605         }
1606
1607         resp = (struct pn533_cmd_jump_dep_response *) params;
1608         cmd = (struct pn533_cmd_jump_dep *) arg;
1609         rc = resp->status & PN533_CMD_RET_MASK;
1610         if (rc != PN533_CMD_RET_SUCCESS) {
1611                 nfc_dev_err(&dev->interface->dev,
1612                                 "Bringing DEP link up failed %d", rc);
1613                 return 0;
1614         }
1615
1616         if (!dev->tgt_available_prots) {
1617                 nfc_dev_dbg(&dev->interface->dev, "Creating new target");
1618
1619                 nfc_target.supported_protocols = NFC_PROTO_NFC_DEP_MASK;
1620                 nfc_target.nfcid1_len = 10;
1621                 memcpy(nfc_target.nfcid1, resp->nfcid3t, nfc_target.nfcid1_len);
1622                 rc = nfc_targets_found(dev->nfc_dev, &nfc_target, 1);
1623                 if (rc)
1624                         return 0;
1625
1626                 dev->tgt_available_prots = 0;
1627         }
1628
1629         dev->tgt_active_prot = NFC_PROTO_NFC_DEP;
1630
1631         /* ATR_RES general bytes are located at offset 17 */
1632         target_gt_len = PN533_FRAME_CMD_PARAMS_LEN(dev->in_frame) - 17;
1633         rc = nfc_set_remote_general_bytes(dev->nfc_dev,
1634                                                 resp->gt, target_gt_len);
1635         if (rc == 0)
1636                 rc = nfc_dep_link_is_up(dev->nfc_dev,
1637                                                 dev->nfc_dev->targets[0].idx,
1638                                                 !cmd->active, NFC_RF_INITIATOR);
1639
1640         return 0;
1641 }
1642
1643 static int pn533_mod_to_baud(struct pn533 *dev)
1644 {
1645         switch (dev->poll_mod_curr) {
1646         case PN533_POLL_MOD_106KBPS_A:
1647                 return 0;
1648         case PN533_POLL_MOD_212KBPS_FELICA:
1649                 return 1;
1650         case PN533_POLL_MOD_424KBPS_FELICA:
1651                 return 2;
1652         default:
1653                 return -EINVAL;
1654         }
1655 }
1656
1657 #define PASSIVE_DATA_LEN 5
1658 static int pn533_dep_link_up(struct nfc_dev *nfc_dev, struct nfc_target *target,
1659                              u8 comm_mode, u8* gb, size_t gb_len)
1660 {
1661         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
1662         struct pn533_cmd_jump_dep *cmd;
1663         u8 cmd_len, *data_ptr;
1664         u8 passive_data[PASSIVE_DATA_LEN] = {0x00, 0xff, 0xff, 0x00, 0x3};
1665         int rc, baud;
1666
1667         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1668
1669         if (dev->poll_mod_count) {
1670                 nfc_dev_err(&dev->interface->dev,
1671                                 "Cannot bring the DEP link up while polling");
1672                 return -EBUSY;
1673         }
1674
1675         if (dev->tgt_active_prot) {
1676                 nfc_dev_err(&dev->interface->dev,
1677                                 "There is already an active target");
1678                 return -EBUSY;
1679         }
1680
1681         baud = pn533_mod_to_baud(dev);
1682         if (baud < 0) {
1683                 nfc_dev_err(&dev->interface->dev,
1684                             "Invalid curr modulation %d", dev->poll_mod_curr);
1685                 return baud;
1686         }
1687
1688         cmd_len = sizeof(struct pn533_cmd_jump_dep) + gb_len;
1689         if (comm_mode == NFC_COMM_PASSIVE)
1690                 cmd_len += PASSIVE_DATA_LEN;
1691
1692         cmd = kzalloc(cmd_len, GFP_KERNEL);
1693         if (cmd == NULL)
1694                 return -ENOMEM;
1695
1696         pn533_tx_frame_init(dev->out_frame, PN533_CMD_IN_JUMP_FOR_DEP);
1697
1698         cmd->active = !comm_mode;
1699         cmd->next = 0;
1700         cmd->baud = baud;
1701         data_ptr = cmd->data;
1702         if (comm_mode == NFC_COMM_PASSIVE && cmd->baud > 0) {
1703                 memcpy(data_ptr, passive_data, PASSIVE_DATA_LEN);
1704                 cmd->next |= 1;
1705                 data_ptr += PASSIVE_DATA_LEN;
1706         }
1707
1708         if (gb != NULL && gb_len > 0) {
1709                 cmd->next |= 4; /* We have some Gi */
1710                 memcpy(data_ptr, gb, gb_len);
1711         } else {
1712                 cmd->next = 0;
1713         }
1714
1715         memcpy(PN533_FRAME_CMD_PARAMS_PTR(dev->out_frame), cmd, cmd_len);
1716         dev->out_frame->datalen += cmd_len;
1717
1718         pn533_tx_frame_finish(dev->out_frame);
1719
1720         rc = pn533_send_cmd_frame_async(dev, dev->out_frame, dev->in_frame,
1721                                 dev->in_maxlen, pn533_in_dep_link_up_complete,
1722                                 cmd, GFP_KERNEL);
1723         if (rc)
1724                 goto out;
1725
1726
1727 out:
1728         kfree(cmd);
1729
1730         return rc;
1731 }
1732
1733 static int pn533_dep_link_down(struct nfc_dev *nfc_dev)
1734 {
1735         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
1736
1737         pn533_poll_reset_mod_list(dev);
1738
1739         if (dev->tgt_mode || dev->tgt_active_prot) {
1740                 pn533_send_ack(dev, GFP_KERNEL);
1741                 usb_kill_urb(dev->in_urb);
1742         }
1743
1744         dev->tgt_active_prot = 0;
1745         dev->tgt_mode = 0;
1746
1747         skb_queue_purge(&dev->resp_q);
1748
1749         return 0;
1750 }
1751
1752 static int pn533_build_tx_frame(struct pn533 *dev, struct sk_buff *skb,
1753                                 bool target)
1754 {
1755         int payload_len = skb->len;
1756         struct pn533_frame *out_frame;
1757         u8 tg;
1758
1759         nfc_dev_dbg(&dev->interface->dev, "%s - Sending %d bytes", __func__,
1760                                                                 payload_len);
1761
1762         if (payload_len > PN533_CMD_DATAEXCH_DATA_MAXLEN) {
1763                 /* TODO: Implement support to multi-part data exchange */
1764                 nfc_dev_err(&dev->interface->dev, "Data length greater than the"
1765                                                 " max allowed: %d",
1766                                                 PN533_CMD_DATAEXCH_DATA_MAXLEN);
1767                 return -ENOSYS;
1768         }
1769
1770         if (target == true) {
1771                 skb_push(skb, PN533_CMD_DATAEXCH_HEAD_LEN);
1772                 out_frame = (struct pn533_frame *) skb->data;
1773
1774                 pn533_tx_frame_init(out_frame, PN533_CMD_IN_DATA_EXCHANGE);
1775                 tg = 1;
1776                 memcpy(PN533_FRAME_CMD_PARAMS_PTR(out_frame), &tg, sizeof(u8));
1777                 out_frame->datalen += sizeof(u8);
1778         } else {
1779                 skb_push(skb, PN533_CMD_DATAEXCH_HEAD_LEN - 1);
1780                 out_frame = (struct pn533_frame *) skb->data;
1781                 pn533_tx_frame_init(out_frame, PN533_CMD_TG_SET_DATA);
1782         }
1783
1784
1785         /* The data is already in the out_frame, just update the datalen */
1786         out_frame->datalen += payload_len;
1787
1788         pn533_tx_frame_finish(out_frame);
1789         skb_put(skb, PN533_FRAME_TAIL_SIZE);
1790
1791         return 0;
1792 }
1793
1794 struct pn533_data_exchange_arg {
1795         struct sk_buff *skb_resp;
1796         struct sk_buff *skb_out;
1797         data_exchange_cb_t cb;
1798         void *cb_context;
1799 };
1800
1801 static struct sk_buff *pn533_build_response(struct pn533 *dev)
1802 {
1803         struct sk_buff *skb, *tmp, *t;
1804         unsigned int skb_len = 0, tmp_len = 0;
1805
1806         nfc_dev_dbg(&dev->interface->dev, "%s\n", __func__);
1807
1808         if (skb_queue_empty(&dev->resp_q))
1809                 return NULL;
1810
1811         if (skb_queue_len(&dev->resp_q) == 1) {
1812                 skb = skb_dequeue(&dev->resp_q);
1813                 goto out;
1814         }
1815
1816         skb_queue_walk_safe(&dev->resp_q, tmp, t)
1817                 skb_len += tmp->len;
1818
1819         nfc_dev_dbg(&dev->interface->dev, "%s total length %d\n",
1820                     __func__, skb_len);
1821
1822         skb = alloc_skb(skb_len, GFP_KERNEL);
1823         if (skb == NULL)
1824                 goto out;
1825
1826         skb_put(skb, skb_len);
1827
1828         skb_queue_walk_safe(&dev->resp_q, tmp, t) {
1829                 memcpy(skb->data + tmp_len, tmp->data, tmp->len);
1830                 tmp_len += tmp->len;
1831         }
1832
1833 out:
1834         skb_queue_purge(&dev->resp_q);
1835
1836         return skb;
1837 }
1838
1839 static int pn533_data_exchange_complete(struct pn533 *dev, void *_arg,
1840                                                 u8 *params, int params_len)
1841 {
1842         struct pn533_data_exchange_arg *arg = _arg;
1843         struct sk_buff *skb = NULL, *skb_resp = arg->skb_resp;
1844         struct pn533_frame *in_frame = (struct pn533_frame *) skb_resp->data;
1845         int err = 0;
1846         u8 status;
1847         u8 cmd_ret;
1848
1849         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1850
1851         dev_kfree_skb(arg->skb_out);
1852
1853         if (params_len < 0) { /* error */
1854                 err = params_len;
1855                 goto error;
1856         }
1857
1858         status = params[0];
1859
1860         cmd_ret = status & PN533_CMD_RET_MASK;
1861         if (cmd_ret != PN533_CMD_RET_SUCCESS) {
1862                 nfc_dev_err(&dev->interface->dev, "PN533 reported error %d when"
1863                                                 " exchanging data", cmd_ret);
1864                 err = -EIO;
1865                 goto error;
1866         }
1867
1868         skb_put(skb_resp, PN533_FRAME_SIZE(in_frame));
1869         skb_pull(skb_resp, PN533_CMD_DATAEXCH_HEAD_LEN);
1870         skb_trim(skb_resp, skb_resp->len - PN533_FRAME_TAIL_SIZE);
1871         skb_queue_tail(&dev->resp_q, skb_resp);
1872
1873         if (status & PN533_CMD_MI_MASK) {
1874                 queue_work(dev->wq, &dev->mi_work);
1875                 return -EINPROGRESS;
1876         }
1877
1878         skb = pn533_build_response(dev);
1879         if (skb == NULL)
1880                 goto error;
1881
1882         arg->cb(arg->cb_context, skb, 0);
1883         kfree(arg);
1884         return 0;
1885
1886 error:
1887         skb_queue_purge(&dev->resp_q);
1888         dev_kfree_skb(skb_resp);
1889         arg->cb(arg->cb_context, NULL, err);
1890         kfree(arg);
1891         return 0;
1892 }
1893
1894 static int pn533_transceive(struct nfc_dev *nfc_dev,
1895                             struct nfc_target *target, struct sk_buff *skb,
1896                             data_exchange_cb_t cb, void *cb_context)
1897 {
1898         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
1899         struct pn533_frame *out_frame, *in_frame;
1900         struct pn533_data_exchange_arg *arg;
1901         struct sk_buff *skb_resp;
1902         int skb_resp_len;
1903         int rc;
1904
1905         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1906
1907         if (!dev->tgt_active_prot) {
1908                 nfc_dev_err(&dev->interface->dev, "Cannot exchange data if"
1909                                                 " there is no active target");
1910                 rc = -EINVAL;
1911                 goto error;
1912         }
1913
1914         rc = pn533_build_tx_frame(dev, skb, true);
1915         if (rc)
1916                 goto error;
1917
1918         skb_resp_len = PN533_CMD_DATAEXCH_HEAD_LEN +
1919                         PN533_CMD_DATAEXCH_DATA_MAXLEN +
1920                         PN533_FRAME_TAIL_SIZE;
1921
1922         skb_resp = nfc_alloc_recv_skb(skb_resp_len, GFP_KERNEL);
1923         if (!skb_resp) {
1924                 rc = -ENOMEM;
1925                 goto error;
1926         }
1927
1928         in_frame = (struct pn533_frame *) skb_resp->data;
1929         out_frame = (struct pn533_frame *) skb->data;
1930
1931         arg = kmalloc(sizeof(struct pn533_data_exchange_arg), GFP_KERNEL);
1932         if (!arg) {
1933                 rc = -ENOMEM;
1934                 goto free_skb_resp;
1935         }
1936
1937         arg->skb_resp = skb_resp;
1938         arg->skb_out = skb;
1939         arg->cb = cb;
1940         arg->cb_context = cb_context;
1941
1942         rc = pn533_send_cmd_frame_async(dev, out_frame, in_frame, skb_resp_len,
1943                                         pn533_data_exchange_complete, arg,
1944                                         GFP_KERNEL);
1945         if (rc) {
1946                 nfc_dev_err(&dev->interface->dev, "Error %d when trying to"
1947                                                 " perform data_exchange", rc);
1948                 goto free_arg;
1949         }
1950
1951         return 0;
1952
1953 free_arg:
1954         kfree(arg);
1955 free_skb_resp:
1956         kfree_skb(skb_resp);
1957 error:
1958         kfree_skb(skb);
1959         return rc;
1960 }
1961
1962 static int pn533_tm_send_complete(struct pn533 *dev, void *arg,
1963                                   u8 *params, int params_len)
1964 {
1965         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1966
1967         if (params_len < 0) {
1968                 nfc_dev_err(&dev->interface->dev,
1969                             "Error %d when sending data",
1970                             params_len);
1971
1972                 return params_len;
1973         }
1974
1975         if (params_len > 0 && params[0] != 0) {
1976                 nfc_tm_deactivated(dev->nfc_dev);
1977
1978                 dev->tgt_mode = 0;
1979
1980                 return 0;
1981         }
1982
1983         queue_work(dev->wq, &dev->tg_work);
1984
1985         return 0;
1986 }
1987
1988 static int pn533_tm_send(struct nfc_dev *nfc_dev, struct sk_buff *skb)
1989 {
1990         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
1991         struct pn533_frame *out_frame;
1992         int rc;
1993
1994         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1995
1996         rc = pn533_build_tx_frame(dev, skb, false);
1997         if (rc)
1998                 goto error;
1999
2000         out_frame = (struct pn533_frame *) skb->data;
2001
2002         rc = pn533_send_cmd_frame_async(dev, out_frame, dev->in_frame,
2003                                         dev->in_maxlen, pn533_tm_send_complete,
2004                                         NULL, GFP_KERNEL);
2005         if (rc) {
2006                 nfc_dev_err(&dev->interface->dev,
2007                             "Error %d when trying to send data", rc);
2008                 goto error;
2009         }
2010
2011         return 0;
2012
2013 error:
2014         kfree_skb(skb);
2015
2016         return rc;
2017 }
2018
2019 static void pn533_wq_mi_recv(struct work_struct *work)
2020 {
2021         struct pn533 *dev = container_of(work, struct pn533, mi_work);
2022         struct sk_buff *skb_cmd;
2023         struct pn533_data_exchange_arg *arg = dev->cmd_complete_arg;
2024         struct pn533_frame *out_frame, *in_frame;
2025         struct sk_buff *skb_resp;
2026         int skb_resp_len;
2027         int rc;
2028
2029         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
2030
2031         /* This is a zero payload size skb */
2032         skb_cmd = alloc_skb(PN533_CMD_DATAEXCH_HEAD_LEN + PN533_FRAME_TAIL_SIZE,
2033                             GFP_KERNEL);
2034         if (skb_cmd == NULL)
2035                 goto error_cmd;
2036
2037         skb_reserve(skb_cmd, PN533_CMD_DATAEXCH_HEAD_LEN);
2038
2039         rc = pn533_build_tx_frame(dev, skb_cmd, true);
2040         if (rc)
2041                 goto error_frame;
2042
2043         skb_resp_len = PN533_CMD_DATAEXCH_HEAD_LEN +
2044                         PN533_CMD_DATAEXCH_DATA_MAXLEN +
2045                         PN533_FRAME_TAIL_SIZE;
2046         skb_resp = alloc_skb(skb_resp_len, GFP_KERNEL);
2047         if (!skb_resp) {
2048                 rc = -ENOMEM;
2049                 goto error_frame;
2050         }
2051
2052         in_frame = (struct pn533_frame *) skb_resp->data;
2053         out_frame = (struct pn533_frame *) skb_cmd->data;
2054
2055         arg->skb_resp = skb_resp;
2056         arg->skb_out = skb_cmd;
2057
2058         rc = __pn533_send_cmd_frame_async(dev, out_frame, in_frame,
2059                                           skb_resp_len,
2060                                           pn533_data_exchange_complete,
2061                                           dev->cmd_complete_arg, GFP_KERNEL);
2062         if (!rc)
2063                 return;
2064
2065         nfc_dev_err(&dev->interface->dev, "Error %d when trying to"
2066                                                 " perform data_exchange", rc);
2067
2068         kfree_skb(skb_resp);
2069
2070 error_frame:
2071         kfree_skb(skb_cmd);
2072
2073 error_cmd:
2074         pn533_send_ack(dev, GFP_KERNEL);
2075
2076         kfree(arg);
2077
2078         mutex_unlock(&dev->cmd_lock);
2079 }
2080
2081 static int pn533_set_configuration(struct pn533 *dev, u8 cfgitem, u8 *cfgdata,
2082                                                                 u8 cfgdata_len)
2083 {
2084         int rc;
2085         u8 *params;
2086
2087         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
2088
2089         pn533_tx_frame_init(dev->out_frame, PN533_CMD_RF_CONFIGURATION);
2090
2091         params = PN533_FRAME_CMD_PARAMS_PTR(dev->out_frame);
2092         params[0] = cfgitem;
2093         memcpy(&params[1], cfgdata, cfgdata_len);
2094         dev->out_frame->datalen += (1 + cfgdata_len);
2095
2096         pn533_tx_frame_finish(dev->out_frame);
2097
2098         rc = pn533_send_cmd_frame_sync(dev, dev->out_frame, dev->in_frame,
2099                                                                 dev->in_maxlen);
2100
2101         return rc;
2102 }
2103
2104 struct nfc_ops pn533_nfc_ops = {
2105         .dev_up = NULL,
2106         .dev_down = NULL,
2107         .dep_link_up = pn533_dep_link_up,
2108         .dep_link_down = pn533_dep_link_down,
2109         .start_poll = pn533_start_poll,
2110         .stop_poll = pn533_stop_poll,
2111         .activate_target = pn533_activate_target,
2112         .deactivate_target = pn533_deactivate_target,
2113         .im_transceive = pn533_transceive,
2114         .tm_send = pn533_tm_send,
2115 };
2116
2117 static int pn533_probe(struct usb_interface *interface,
2118                         const struct usb_device_id *id)
2119 {
2120         struct pn533_fw_version *fw_ver;
2121         struct pn533 *dev;
2122         struct usb_host_interface *iface_desc;
2123         struct usb_endpoint_descriptor *endpoint;
2124         struct pn533_config_max_retries max_retries;
2125         struct pn533_config_timing timing;
2126         int in_endpoint = 0;
2127         int out_endpoint = 0;
2128         int rc = -ENOMEM;
2129         int i;
2130         u32 protocols;
2131
2132         dev = kzalloc(sizeof(*dev), GFP_KERNEL);
2133         if (!dev)
2134                 return -ENOMEM;
2135
2136         dev->udev = usb_get_dev(interface_to_usbdev(interface));
2137         dev->interface = interface;
2138         mutex_init(&dev->cmd_lock);
2139
2140         iface_desc = interface->cur_altsetting;
2141         for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
2142                 endpoint = &iface_desc->endpoint[i].desc;
2143
2144                 if (!in_endpoint && usb_endpoint_is_bulk_in(endpoint)) {
2145                         dev->in_maxlen = le16_to_cpu(endpoint->wMaxPacketSize);
2146                         in_endpoint = endpoint->bEndpointAddress;
2147                 }
2148
2149                 if (!out_endpoint && usb_endpoint_is_bulk_out(endpoint)) {
2150                         dev->out_maxlen =
2151                                 le16_to_cpu(endpoint->wMaxPacketSize);
2152                         out_endpoint = endpoint->bEndpointAddress;
2153                 }
2154         }
2155
2156         if (!in_endpoint || !out_endpoint) {
2157                 nfc_dev_err(&interface->dev, "Could not find bulk-in or"
2158                                                         " bulk-out endpoint");
2159                 rc = -ENODEV;
2160                 goto error;
2161         }
2162
2163         dev->in_frame = kmalloc(dev->in_maxlen, GFP_KERNEL);
2164         dev->in_urb = usb_alloc_urb(0, GFP_KERNEL);
2165         dev->out_frame = kmalloc(dev->out_maxlen, GFP_KERNEL);
2166         dev->out_urb = usb_alloc_urb(0, GFP_KERNEL);
2167
2168         if (!dev->in_frame || !dev->out_frame ||
2169                 !dev->in_urb || !dev->out_urb)
2170                 goto error;
2171
2172         usb_fill_bulk_urb(dev->in_urb, dev->udev,
2173                         usb_rcvbulkpipe(dev->udev, in_endpoint),
2174                         NULL, 0, NULL, dev);
2175         usb_fill_bulk_urb(dev->out_urb, dev->udev,
2176                         usb_sndbulkpipe(dev->udev, out_endpoint),
2177                         NULL, 0,
2178                         pn533_send_complete, dev);
2179
2180         INIT_WORK(&dev->cmd_work, pn533_wq_cmd_complete);
2181         INIT_WORK(&dev->mi_work, pn533_wq_mi_recv);
2182         INIT_WORK(&dev->tg_work, pn533_wq_tg_get_data);
2183         INIT_WORK(&dev->poll_work, pn533_wq_poll);
2184         dev->wq = alloc_workqueue("pn533",
2185                                   WQ_NON_REENTRANT | WQ_UNBOUND | WQ_MEM_RECLAIM,
2186                                   1);
2187         if (dev->wq == NULL)
2188                 goto error;
2189
2190         init_timer(&dev->listen_timer);
2191         dev->listen_timer.data = (unsigned long) dev;
2192         dev->listen_timer.function = pn533_listen_mode_timer;
2193
2194         skb_queue_head_init(&dev->resp_q);
2195
2196         usb_set_intfdata(interface, dev);
2197
2198         pn533_tx_frame_init(dev->out_frame, PN533_CMD_GET_FIRMWARE_VERSION);
2199         pn533_tx_frame_finish(dev->out_frame);
2200
2201         rc = pn533_send_cmd_frame_sync(dev, dev->out_frame, dev->in_frame,
2202                                                                 dev->in_maxlen);
2203         if (rc)
2204                 goto destroy_wq;
2205
2206         fw_ver = (struct pn533_fw_version *)
2207                                 PN533_FRAME_CMD_PARAMS_PTR(dev->in_frame);
2208         nfc_dev_info(&dev->interface->dev, "NXP PN533 firmware ver %d.%d now"
2209                                         " attached", fw_ver->ver, fw_ver->rev);
2210
2211         protocols = NFC_PROTO_JEWEL_MASK
2212                         | NFC_PROTO_MIFARE_MASK | NFC_PROTO_FELICA_MASK
2213                         | NFC_PROTO_ISO14443_MASK
2214                         | NFC_PROTO_NFC_DEP_MASK;
2215
2216         dev->nfc_dev = nfc_allocate_device(&pn533_nfc_ops, protocols,
2217                                            PN533_CMD_DATAEXCH_HEAD_LEN,
2218                                            PN533_FRAME_TAIL_SIZE);
2219         if (!dev->nfc_dev)
2220                 goto destroy_wq;
2221
2222         nfc_set_parent_dev(dev->nfc_dev, &interface->dev);
2223         nfc_set_drvdata(dev->nfc_dev, dev);
2224
2225         rc = nfc_register_device(dev->nfc_dev);
2226         if (rc)
2227                 goto free_nfc_dev;
2228
2229         max_retries.mx_rty_atr = PN533_CONFIG_MAX_RETRIES_ENDLESS;
2230         max_retries.mx_rty_psl = 2;
2231         max_retries.mx_rty_passive_act = PN533_CONFIG_MAX_RETRIES_NO_RETRY;
2232
2233         rc = pn533_set_configuration(dev, PN533_CFGITEM_MAX_RETRIES,
2234                                 (u8 *) &max_retries, sizeof(max_retries));
2235
2236         if (rc) {
2237                 nfc_dev_err(&dev->interface->dev, "Error on setting MAX_RETRIES"
2238                                                                 " config");
2239                 goto unregister_nfc_dev;
2240         }
2241
2242         timing.rfu = PN533_CONFIG_TIMING_102;
2243         timing.atr_res_timeout = PN533_CONFIG_TIMING_204;
2244         timing.dep_timeout = PN533_CONFIG_TIMING_409;
2245
2246         rc = pn533_set_configuration(dev, PN533_CFGITEM_TIMING,
2247                                 (u8 *) &timing, sizeof(timing));
2248         if (rc) {
2249                 nfc_dev_err(&dev->interface->dev,
2250                             "Error on setting RF timings");
2251                 goto unregister_nfc_dev;
2252         }
2253
2254         return 0;
2255
2256 unregister_nfc_dev:
2257         nfc_unregister_device(dev->nfc_dev);
2258
2259 free_nfc_dev:
2260         nfc_free_device(dev->nfc_dev);
2261
2262 destroy_wq:
2263         destroy_workqueue(dev->wq);
2264 error:
2265         kfree(dev->in_frame);
2266         usb_free_urb(dev->in_urb);
2267         kfree(dev->out_frame);
2268         usb_free_urb(dev->out_urb);
2269         kfree(dev);
2270         return rc;
2271 }
2272
2273 static void pn533_disconnect(struct usb_interface *interface)
2274 {
2275         struct pn533 *dev;
2276
2277         dev = usb_get_intfdata(interface);
2278         usb_set_intfdata(interface, NULL);
2279
2280         nfc_unregister_device(dev->nfc_dev);
2281         nfc_free_device(dev->nfc_dev);
2282
2283         usb_kill_urb(dev->in_urb);
2284         usb_kill_urb(dev->out_urb);
2285
2286         destroy_workqueue(dev->wq);
2287
2288         skb_queue_purge(&dev->resp_q);
2289
2290         del_timer(&dev->listen_timer);
2291
2292         kfree(dev->in_frame);
2293         usb_free_urb(dev->in_urb);
2294         kfree(dev->out_frame);
2295         usb_free_urb(dev->out_urb);
2296         kfree(dev);
2297
2298         nfc_dev_info(&interface->dev, "NXP PN533 NFC device disconnected");
2299 }
2300
2301 static struct usb_driver pn533_driver = {
2302         .name =         "pn533",
2303         .probe =        pn533_probe,
2304         .disconnect =   pn533_disconnect,
2305         .id_table =     pn533_table,
2306 };
2307
2308 module_usb_driver(pn533_driver);
2309
2310 MODULE_AUTHOR("Lauro Ramos Venancio <lauro.venancio@openbossa.org>,"
2311                         " Aloisio Almeida Jr <aloisio.almeida@openbossa.org>");
2312 MODULE_DESCRIPTION("PN533 usb driver ver " VERSION);
2313 MODULE_VERSION(VERSION);
2314 MODULE_LICENSE("GPL");