drivers/nfc/pn533.c

   1 /*
   2  * Copyright (C) 2011 Instituto Nokia de Tecnologia
   3  *
   4  * Authors:
   5  *    Lauro Ramos Venancio <lauro.venancio@openbossa.org>
   6  *    Aloisio Almeida Jr <aloisio.almeida@openbossa.org>
   7  *
   8  * This program is free software; you can redistribute it and/or modify
   9  * it under the terms of the GNU General Public License as published by
  10  * the Free Software Foundation; either version 2 of the License, or
  11  * (at your option) any later version.
  12  *
  13  * This program is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  16  * GNU General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License
  19  * along with this program; if not, write to the
  20  * Free Software Foundation, Inc.,
  21  * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
  22  */
  23
  24 #include <linux/device.h>
  25 #include <linux/kernel.h>
  26 #include <linux/module.h>
  27 #include <linux/slab.h>
  28 #include <linux/usb.h>
  29 #include <linux/nfc.h>
  30 #include <linux/netdevice.h>
  31 #include <net/nfc/nfc.h>
  32
  33 #define VERSION "0.1"
  34
  35 #define PN533_VENDOR_ID 0x4CC
  36 #define PN533_PRODUCT_ID 0x2533
  37
  38 #define SCM_VENDOR_ID 0x4E6
  39 #define SCL3711_PRODUCT_ID 0x5591
  40
  41 static const struct usb_device_id pn533_table[] = {
  42         { USB_DEVICE(PN533_VENDOR_ID, PN533_PRODUCT_ID) },
  43         { USB_DEVICE(SCM_VENDOR_ID, SCL3711_PRODUCT_ID) },
  44         { }
  45 };
  46 MODULE_DEVICE_TABLE(usb, pn533_table);
  47
  48 /* frame definitions */
  49 #define PN533_FRAME_TAIL_SIZE 2
  50 #define PN533_FRAME_SIZE(f) (sizeof(struct pn533_frame) + f->datalen + \
  51                                 PN533_FRAME_TAIL_SIZE)
  52 #define PN533_FRAME_ACK_SIZE (sizeof(struct pn533_frame) + 1)
  53 #define PN533_FRAME_CHECKSUM(f) (f->data[f->datalen])
  54 #define PN533_FRAME_POSTAMBLE(f) (f->data[f->datalen + 1])
  55
  56 /* start of frame */
  57 #define PN533_SOF 0x00FF
  58
  59 /* frame identifier: in/out/error */
  60 #define PN533_FRAME_IDENTIFIER(f) (f->data[0])
  61 #define PN533_DIR_OUT 0xD4
  62 #define PN533_DIR_IN 0xD5
  63
  64 /* PN533 Commands */
  65 #define PN533_FRAME_CMD(f) (f->data[1])
  66 #define PN533_FRAME_CMD_PARAMS_PTR(f) (&f->data[2])
  67 #define PN533_FRAME_CMD_PARAMS_LEN(f) (f->datalen - 2)
  68
  69 #define PN533_CMD_GET_FIRMWARE_VERSION 0x02
  70 #define PN533_CMD_RF_CONFIGURATION 0x32
  71 #define PN533_CMD_IN_DATA_EXCHANGE 0x40
  72 #define PN533_CMD_IN_LIST_PASSIVE_TARGET 0x4A
  73 #define PN533_CMD_IN_ATR 0x50
  74 #define PN533_CMD_IN_RELEASE 0x52
  75 #define PN533_CMD_IN_JUMP_FOR_DEP 0x56
  76
  77 #define PN533_CMD_RESPONSE(cmd) (cmd + 1)
  78
  79 /* PN533 Return codes */
  80 #define PN533_CMD_RET_MASK 0x3F
  81 #define PN533_CMD_MI_MASK 0x40
  82 #define PN533_CMD_RET_SUCCESS 0x00
  83
  84 struct pn533;
  85
  86 typedef int (*pn533_cmd_complete_t) (struct pn533 *dev, void *arg,
  87                                         u8 *params, int params_len);
  88
  89 /* structs for pn533 commands */
  90
  91 /* PN533_CMD_GET_FIRMWARE_VERSION */
  92 struct pn533_fw_version {
  93         u8 ic;
  94         u8 ver;
  95         u8 rev;
  96         u8 support;
  97 };
  98
  99 /* PN533_CMD_RF_CONFIGURATION */
 100 #define PN533_CFGITEM_MAX_RETRIES 0x05
 101
 102 #define PN533_CONFIG_MAX_RETRIES_NO_RETRY 0x00
 103 #define PN533_CONFIG_MAX_RETRIES_ENDLESS 0xFF
 104
 105 struct pn533_config_max_retries {
 106         u8 mx_rty_atr;
 107         u8 mx_rty_psl;
 108         u8 mx_rty_passive_act;
 109 } __packed;
 110
 111 /* PN533_CMD_IN_LIST_PASSIVE_TARGET */
 112
 113 /* felica commands opcode */
 114 #define PN533_FELICA_OPC_SENSF_REQ 0
 115 #define PN533_FELICA_OPC_SENSF_RES 1
 116 /* felica SENSF_REQ parameters */
 117 #define PN533_FELICA_SENSF_SC_ALL 0xFFFF
 118 #define PN533_FELICA_SENSF_RC_NO_SYSTEM_CODE 0
 119 #define PN533_FELICA_SENSF_RC_SYSTEM_CODE 1
 120 #define PN533_FELICA_SENSF_RC_ADVANCED_PROTOCOL 2
 121
 122 /* type B initiator_data values */
 123 #define PN533_TYPE_B_AFI_ALL_FAMILIES 0
 124 #define PN533_TYPE_B_POLL_METHOD_TIMESLOT 0
 125 #define PN533_TYPE_B_POLL_METHOD_PROBABILISTIC 1
 126
 127 union pn533_cmd_poll_initdata {
 128         struct {
 129                 u8 afi;
 130                 u8 polling_method;
 131         } __packed type_b;
 132         struct {
 133                 u8 opcode;
 134                 __be16 sc;
 135                 u8 rc;
 136                 u8 tsn;
 137         } __packed felica;
 138 };
 139
 140 /* Poll modulations */
 141 enum {
 142         PN533_POLL_MOD_106KBPS_A,
 143         PN533_POLL_MOD_212KBPS_FELICA,
 144         PN533_POLL_MOD_424KBPS_FELICA,
 145         PN533_POLL_MOD_106KBPS_JEWEL,
 146         PN533_POLL_MOD_847KBPS_B,
 147
 148         __PN533_POLL_MOD_AFTER_LAST,
 149 };
 150 #define PN533_POLL_MOD_MAX (__PN533_POLL_MOD_AFTER_LAST - 1)
 151
 152 struct pn533_poll_modulations {
 153         struct {
 154                 u8 maxtg;
 155                 u8 brty;
 156                 union pn533_cmd_poll_initdata initiator_data;
 157         } __packed data;
 158         u8 len;
 159 };
 160
 161 const struct pn533_poll_modulations poll_mod[] = {
 162         [PN533_POLL_MOD_106KBPS_A] = {
 163                 .data = {
 164                         .maxtg = 1,
 165                         .brty = 0,
 166                 },
 167                 .len = 2,
 168         },
 169         [PN533_POLL_MOD_212KBPS_FELICA] = {
 170                 .data = {
 171                         .maxtg = 1,
 172                         .brty = 1,
 173                         .initiator_data.felica = {
 174                                 .opcode = PN533_FELICA_OPC_SENSF_REQ,
 175                                 .sc = PN533_FELICA_SENSF_SC_ALL,
 176                                 .rc = PN533_FELICA_SENSF_RC_NO_SYSTEM_CODE,
 177                                 .tsn = 0,
 178                         },
 179                 },
 180                 .len = 7,
 181         },
 182         [PN533_POLL_MOD_424KBPS_FELICA] = {
 183                 .data = {
 184                         .maxtg = 1,
 185                         .brty = 2,
 186                         .initiator_data.felica = {
 187                                 .opcode = PN533_FELICA_OPC_SENSF_REQ,
 188                                 .sc = PN533_FELICA_SENSF_SC_ALL,
 189                                 .rc = PN533_FELICA_SENSF_RC_NO_SYSTEM_CODE,
 190                                 .tsn = 0,
 191                         },
 192                  },
 193                 .len = 7,
 194         },
 195         [PN533_POLL_MOD_106KBPS_JEWEL] = {
 196                 .data = {
 197                         .maxtg = 1,
 198                         .brty = 4,
 199                 },
 200                 .len = 2,
 201         },
 202         [PN533_POLL_MOD_847KBPS_B] = {
 203                 .data = {
 204                         .maxtg = 1,
 205                         .brty = 8,
 206                         .initiator_data.type_b = {
 207                                 .afi = PN533_TYPE_B_AFI_ALL_FAMILIES,
 208                                 .polling_method =
 209                                         PN533_TYPE_B_POLL_METHOD_TIMESLOT,
 210                         },
 211                 },
 212                 .len = 3,
 213         },
 214 };
 215
 216 /* PN533_CMD_IN_ATR */
 217
 218 struct pn533_cmd_activate_param {
 219         u8 tg;
 220         u8 next;
 221 } __packed;
 222
 223 struct pn533_cmd_activate_response {
 224         u8 status;
 225         u8 nfcid3t[10];
 226         u8 didt;
 227         u8 bst;
 228         u8 brt;
 229         u8 to;
 230         u8 ppt;
 231         /* optional */
 232         u8 gt[];
 233 } __packed;
 234
 235 /* PN533_CMD_IN_JUMP_FOR_DEP */
 236 struct pn533_cmd_jump_dep {
 237         u8 active;
 238         u8 baud;
 239         u8 next;
 240         u8 gt[];
 241 } __packed;
 242
 243 struct pn533_cmd_jump_dep_response {
 244         u8 status;
 245         u8 tg;
 246         u8 nfcid3t[10];
 247         u8 didt;
 248         u8 bst;
 249         u8 brt;
 250         u8 to;
 251         u8 ppt;
 252         /* optional */
 253         u8 gt[];
 254 } __packed;
 255
 256 struct pn533 {
 257         struct usb_device *udev;
 258         struct usb_interface *interface;
 259         struct nfc_dev *nfc_dev;
 260
 261         struct urb *out_urb;
 262         int out_maxlen;
 263         struct pn533_frame *out_frame;
 264
 265         struct urb *in_urb;
 266         int in_maxlen;
 267         struct pn533_frame *in_frame;
 268
 269         struct tasklet_struct tasklet;
 270         struct pn533_frame *tklt_in_frame;
 271         int tklt_in_error;
 272
 273         pn533_cmd_complete_t cmd_complete;
 274         void *cmd_complete_arg;
 275         struct semaphore cmd_lock;
 276         u8 cmd;
 277
 278         struct pn533_poll_modulations *poll_mod_active[PN533_POLL_MOD_MAX + 1];
 279         u8 poll_mod_count;
 280         u8 poll_mod_curr;
 281         u32 poll_protocols;
 282
 283         u8 tgt_available_prots;
 284         u8 tgt_active_prot;
 285 };
 286
 287 struct pn533_frame {
 288         u8 preamble;
 289         __be16 start_frame;
 290         u8 datalen;
 291         u8 datalen_checksum;
 292         u8 data[];
 293 } __packed;
 294
 295 /* The rule: value + checksum = 0 */
 296 static inline u8 pn533_checksum(u8 value)
 297 {
 298         return ~value + 1;
 299 }
 300
 301 /* The rule: sum(data elements) + checksum = 0 */
 302 static u8 pn533_data_checksum(u8 *data, int datalen)
 303 {
 304         u8 sum = 0;
 305         int i;
 306
 307         for (i = 0; i < datalen; i++)
 308                 sum += data[i];
 309
 310         return pn533_checksum(sum);
 311 }
 312
 313 /**
 314  * pn533_tx_frame_ack - create a ack frame
 315  * @frame:      The frame to be set as ack
 316  *
 317  * Ack is different type of standard frame. As a standard frame, it has
 318  * preamble and start_frame. However the checksum of this frame must fail,
 319  * i.e. datalen + datalen_checksum must NOT be zero. When the checksum test
 320  * fails and datalen = 0 and datalen_checksum = 0xFF, the frame is a ack.
 321  * After datalen_checksum field, the postamble is placed.
 322  */
 323 static void pn533_tx_frame_ack(struct pn533_frame *frame)
 324 {
 325         frame->preamble = 0;
 326         frame->start_frame = cpu_to_be16(PN533_SOF);
 327         frame->datalen = 0;
 328         frame->datalen_checksum = 0xFF;
 329         /* data[0] is used as postamble */
 330         frame->data[0] = 0;
 331 }
 332
 333 static void pn533_tx_frame_init(struct pn533_frame *frame, u8 cmd)
 334 {
 335         frame->preamble = 0;
 336         frame->start_frame = cpu_to_be16(PN533_SOF);
 337         PN533_FRAME_IDENTIFIER(frame) = PN533_DIR_OUT;
 338         PN533_FRAME_CMD(frame) = cmd;
 339         frame->datalen = 2;
 340 }
 341
 342 static void pn533_tx_frame_finish(struct pn533_frame *frame)
 343 {
 344         frame->datalen_checksum = pn533_checksum(frame->datalen);
 345
 346         PN533_FRAME_CHECKSUM(frame) =
 347                 pn533_data_checksum(frame->data, frame->datalen);
 348
 349         PN533_FRAME_POSTAMBLE(frame) = 0;
 350 }
 351
 352 static bool pn533_rx_frame_is_valid(struct pn533_frame *frame)
 353 {
 354         u8 checksum;
 355
 356         if (frame->start_frame != cpu_to_be16(PN533_SOF))
 357                 return false;
 358
 359         checksum = pn533_checksum(frame->datalen);
 360         if (checksum != frame->datalen_checksum)
 361                 return false;
 362
 363         checksum = pn533_data_checksum(frame->data, frame->datalen);
 364         if (checksum != PN533_FRAME_CHECKSUM(frame))
 365                 return false;
 366
 367         return true;
 368 }
 369
 370 static bool pn533_rx_frame_is_ack(struct pn533_frame *frame)
 371 {
 372         if (frame->start_frame != cpu_to_be16(PN533_SOF))
 373                 return false;
 374
 375         if (frame->datalen != 0 || frame->datalen_checksum != 0xFF)
 376                 return false;
 377
 378         return true;
 379 }
 380
 381 static bool pn533_rx_frame_is_cmd_response(struct pn533_frame *frame, u8 cmd)
 382 {
 383         return (PN533_FRAME_CMD(frame) == PN533_CMD_RESPONSE(cmd));
 384 }
 385
 386 static void pn533_tasklet_cmd_complete(unsigned long arg)
 387 {
 388         struct pn533 *dev = (struct pn533 *) arg;
 389         struct pn533_frame *in_frame = dev->tklt_in_frame;
 390         int rc;
 391
 392         if (dev->tklt_in_error)
 393                 rc = dev->cmd_complete(dev, dev->cmd_complete_arg, NULL,
 394                                                         dev->tklt_in_error);
 395         else
 396                 rc = dev->cmd_complete(dev, dev->cmd_complete_arg,
 397                                         PN533_FRAME_CMD_PARAMS_PTR(in_frame),
 398                                         PN533_FRAME_CMD_PARAMS_LEN(in_frame));
 399
 400         if (rc != -EINPROGRESS)
 401                 up(&dev->cmd_lock);
 402 }
 403
 404 static void pn533_recv_response(struct urb *urb)
 405 {
 406         struct pn533 *dev = urb->context;
 407         struct pn533_frame *in_frame;
 408
 409         dev->tklt_in_frame = NULL;
 410
 411         switch (urb->status) {
 412         case 0:
 413                 /* success */
 414                 break;
 415         case -ECONNRESET:
 416         case -ENOENT:
 417         case -ESHUTDOWN:
 418                 nfc_dev_dbg(&dev->interface->dev, "Urb shutting down with"
 419                                                 " status: %d", urb->status);
 420                 dev->tklt_in_error = urb->status;
 421                 goto sched_tasklet;
 422         default:
 423                 nfc_dev_err(&dev->interface->dev, "Nonzero urb status received:"
 424                                                         " %d", urb->status);
 425                 dev->tklt_in_error = urb->status;
 426                 goto sched_tasklet;
 427         }
 428
 429         in_frame = dev->in_urb->transfer_buffer;
 430
 431         if (!pn533_rx_frame_is_valid(in_frame)) {
 432                 nfc_dev_err(&dev->interface->dev, "Received an invalid frame");
 433                 dev->tklt_in_error = -EIO;
 434                 goto sched_tasklet;
 435         }
 436
 437         if (!pn533_rx_frame_is_cmd_response(in_frame, dev->cmd)) {
 438                 nfc_dev_err(&dev->interface->dev, "The received frame is not "
 439                                                 "response to the last command");
 440                 dev->tklt_in_error = -EIO;
 441                 goto sched_tasklet;
 442         }
 443
 444         nfc_dev_dbg(&dev->interface->dev, "Received a valid frame");
 445         dev->tklt_in_error = 0;
 446         dev->tklt_in_frame = in_frame;
 447
 448 sched_tasklet:
 449         tasklet_schedule(&dev->tasklet);
 450 }
 451
 452 static int pn533_submit_urb_for_response(struct pn533 *dev, gfp_t flags)
 453 {
 454         dev->in_urb->complete = pn533_recv_response;
 455
 456         return usb_submit_urb(dev->in_urb, flags);
 457 }
 458
 459 static void pn533_recv_ack(struct urb *urb)
 460 {
 461         struct pn533 *dev = urb->context;
 462         struct pn533_frame *in_frame;
 463         int rc;
 464
 465         switch (urb->status) {
 466         case 0:
 467                 /* success */
 468                 break;
 469         case -ECONNRESET:
 470         case -ENOENT:
 471         case -ESHUTDOWN:
 472                 nfc_dev_dbg(&dev->interface->dev, "Urb shutting down with"
 473                                                 " status: %d", urb->status);
 474                 dev->tklt_in_error = urb->status;
 475                 goto sched_tasklet;
 476         default:
 477                 nfc_dev_err(&dev->interface->dev, "Nonzero urb status received:"
 478                                                         " %d", urb->status);
 479                 dev->tklt_in_error = urb->status;
 480                 goto sched_tasklet;
 481         }
 482
 483         in_frame = dev->in_urb->transfer_buffer;
 484
 485         if (!pn533_rx_frame_is_ack(in_frame)) {
 486                 nfc_dev_err(&dev->interface->dev, "Received an invalid ack");
 487                 dev->tklt_in_error = -EIO;
 488                 goto sched_tasklet;
 489         }
 490
 491         nfc_dev_dbg(&dev->interface->dev, "Received a valid ack");
 492
 493         rc = pn533_submit_urb_for_response(dev, GFP_ATOMIC);
 494         if (rc) {
 495                 nfc_dev_err(&dev->interface->dev, "usb_submit_urb failed with"
 496                                                         " result %d", rc);
 497                 dev->tklt_in_error = rc;
 498                 goto sched_tasklet;
 499         }
 500
 501         return;
 502
 503 sched_tasklet:
 504         dev->tklt_in_frame = NULL;
 505         tasklet_schedule(&dev->tasklet);
 506 }
 507
 508 static int pn533_submit_urb_for_ack(struct pn533 *dev, gfp_t flags)
 509 {
 510         dev->in_urb->complete = pn533_recv_ack;
 511
 512         return usb_submit_urb(dev->in_urb, flags);
 513 }
 514
 515 static int pn533_send_ack(struct pn533 *dev, gfp_t flags)
 516 {
 517         int rc;
 518
 519         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
 520
 521         pn533_tx_frame_ack(dev->out_frame);
 522
 523         dev->out_urb->transfer_buffer = dev->out_frame;
 524         dev->out_urb->transfer_buffer_length = PN533_FRAME_ACK_SIZE;
 525         rc = usb_submit_urb(dev->out_urb, flags);
 526
 527         return rc;
 528 }
 529
 530 static int __pn533_send_cmd_frame_async(struct pn533 *dev,
 531                                         struct pn533_frame *out_frame,
 532                                         struct pn533_frame *in_frame,
 533                                         int in_frame_len,
 534                                         pn533_cmd_complete_t cmd_complete,
 535                                         void *arg, gfp_t flags)
 536 {
 537         int rc;
 538
 539         nfc_dev_dbg(&dev->interface->dev, "Sending command 0x%x",
 540                                                 PN533_FRAME_CMD(out_frame));
 541
 542         dev->cmd = PN533_FRAME_CMD(out_frame);
 543         dev->cmd_complete = cmd_complete;
 544         dev->cmd_complete_arg = arg;
 545
 546         dev->out_urb->transfer_buffer = out_frame;
 547         dev->out_urb->transfer_buffer_length =
 548                                 PN533_FRAME_SIZE(out_frame);
 549
 550         dev->in_urb->transfer_buffer = in_frame;
 551         dev->in_urb->transfer_buffer_length = in_frame_len;
 552
 553         rc = usb_submit_urb(dev->out_urb, flags);
 554         if (rc)
 555                 return rc;
 556
 557         rc = pn533_submit_urb_for_ack(dev, flags);
 558         if (rc)
 559                 goto error;
 560
 561         return 0;
 562
 563 error:
 564         usb_unlink_urb(dev->out_urb);
 565         return rc;
 566 }
 567
 568 static int pn533_send_cmd_frame_async(struct pn533 *dev,
 569                                         struct pn533_frame *out_frame,
 570                                         struct pn533_frame *in_frame,
 571                                         int in_frame_len,
 572                                         pn533_cmd_complete_t cmd_complete,
 573                                         void *arg, gfp_t flags)
 574 {
 575         int rc;
 576
 577         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
 578
 579         if (down_trylock(&dev->cmd_lock))
 580                 return -EBUSY;
 581
 582         rc = __pn533_send_cmd_frame_async(dev, out_frame, in_frame,
 583                                         in_frame_len, cmd_complete, arg, flags);
 584         if (rc)
 585                 goto error;
 586
 587         return 0;
 588 error:
 589         up(&dev->cmd_lock);
 590         return rc;
 591 }
 592
 593 struct pn533_sync_cmd_response {
 594         int rc;
 595         struct completion done;
 596 };
 597
 598 static int pn533_sync_cmd_complete(struct pn533 *dev, void *_arg,
 599                                         u8 *params, int params_len)
 600 {
 601         struct pn533_sync_cmd_response *arg = _arg;
 602
 603         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
 604
 605         arg->rc = 0;
 606
 607         if (params_len < 0) /* error */
 608                 arg->rc = params_len;
 609
 610         complete(&arg->done);
 611
 612         return 0;
 613 }
 614
 615 static int pn533_send_cmd_frame_sync(struct pn533 *dev,
 616                                                 struct pn533_frame *out_frame,
 617                                                 struct pn533_frame *in_frame,
 618                                                 int in_frame_len)
 619 {
 620         int rc;
 621         struct pn533_sync_cmd_response arg;
 622
 623         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
 624
 625         init_completion(&arg.done);
 626
 627         rc = pn533_send_cmd_frame_async(dev, out_frame, in_frame, in_frame_len,
 628                                 pn533_sync_cmd_complete, &arg, GFP_KERNEL);
 629         if (rc)
 630                 return rc;
 631
 632         wait_for_completion(&arg.done);
 633
 634         return arg.rc;
 635 }
 636
 637 static void pn533_send_complete(struct urb *urb)
 638 {
 639         struct pn533 *dev = urb->context;
 640
 641         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
 642
 643         switch (urb->status) {
 644         case 0:
 645                 /* success */
 646                 break;
 647         case -ECONNRESET:
 648         case -ENOENT:
 649         case -ESHUTDOWN:
 650                 nfc_dev_dbg(&dev->interface->dev, "Urb shutting down with"
 651                                                 " status: %d", urb->status);
 652                 break;
 653         default:
 654                 nfc_dev_dbg(&dev->interface->dev, "Nonzero urb status received:"
 655                                                         " %d", urb->status);
 656         }
 657 }
 658
 659 struct pn533_target_type_a {
 660         __be16 sens_res;
 661         u8 sel_res;
 662         u8 nfcid_len;
 663         u8 nfcid_data[];
 664 } __packed;
 665
 666
 667 #define PN533_TYPE_A_SENS_RES_NFCID1(x) ((u8)((be16_to_cpu(x) & 0x00C0) >> 6))
 668 #define PN533_TYPE_A_SENS_RES_SSD(x) ((u8)((be16_to_cpu(x) & 0x001F) >> 0))
 669 #define PN533_TYPE_A_SENS_RES_PLATCONF(x) ((u8)((be16_to_cpu(x) & 0x0F00) >> 8))
 670
 671 #define PN533_TYPE_A_SENS_RES_SSD_JEWEL 0x00
 672 #define PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL 0x0C
 673
 674 #define PN533_TYPE_A_SEL_PROT(x) (((x) & 0x60) >> 5)
 675 #define PN533_TYPE_A_SEL_CASCADE(x) (((x) & 0x04) >> 2)
 676
 677 #define PN533_TYPE_A_SEL_PROT_MIFARE 0
 678 #define PN533_TYPE_A_SEL_PROT_ISO14443 1
 679 #define PN533_TYPE_A_SEL_PROT_DEP 2
 680 #define PN533_TYPE_A_SEL_PROT_ISO14443_DEP 3
 681
 682 static bool pn533_target_type_a_is_valid(struct pn533_target_type_a *type_a,
 683                                                         int target_data_len)
 684 {
 685         u8 ssd;
 686         u8 platconf;
 687
 688         if (target_data_len < sizeof(struct pn533_target_type_a))
 689                 return false;
 690
 691         /* The lenght check of nfcid[] and ats[] are not being performed because
 692            the values are not being used */
 693
 694         /* Requirement 4.6.3.3 from NFC Forum Digital Spec */
 695         ssd = PN533_TYPE_A_SENS_RES_SSD(type_a->sens_res);
 696         platconf = PN533_TYPE_A_SENS_RES_PLATCONF(type_a->sens_res);
 697
 698         if ((ssd == PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
 699                         platconf != PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL) ||
 700                         (ssd != PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
 701                         platconf == PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL))
 702                 return false;
 703
 704         /* Requirements 4.8.2.1, 4.8.2.3, 4.8.2.5 and 4.8.2.7 from NFC Forum */
 705         if (PN533_TYPE_A_SEL_CASCADE(type_a->sel_res) != 0)
 706                 return false;
 707
 708         return true;
 709 }
 710
 711 static int pn533_target_found_type_a(struct nfc_target *nfc_tgt, u8 *tgt_data,
 712                                                         int tgt_data_len)
 713 {
 714         struct pn533_target_type_a *tgt_type_a;
 715
 716         tgt_type_a = (struct pn533_target_type_a *) tgt_data;
 717
 718         if (!pn533_target_type_a_is_valid(tgt_type_a, tgt_data_len))
 719                 return -EPROTO;
 720
 721         switch (PN533_TYPE_A_SEL_PROT(tgt_type_a->sel_res)) {
 722         case PN533_TYPE_A_SEL_PROT_MIFARE:
 723                 nfc_tgt->supported_protocols = NFC_PROTO_MIFARE_MASK;
 724                 break;
 725         case PN533_TYPE_A_SEL_PROT_ISO14443:
 726                 nfc_tgt->supported_protocols = NFC_PROTO_ISO14443_MASK;
 727                 break;
 728         case PN533_TYPE_A_SEL_PROT_DEP:
 729                 nfc_tgt->supported_protocols = NFC_PROTO_NFC_DEP_MASK;
 730                 break;
 731         case PN533_TYPE_A_SEL_PROT_ISO14443_DEP:
 732                 nfc_tgt->supported_protocols = NFC_PROTO_ISO14443_MASK |
 733                                                         NFC_PROTO_NFC_DEP_MASK;
 734                 break;
 735         }
 736
 737         nfc_tgt->sens_res = be16_to_cpu(tgt_type_a->sens_res);
 738         nfc_tgt->sel_res = tgt_type_a->sel_res;
 739         nfc_tgt->nfcid1_len = tgt_type_a->nfcid_len;
 740         memcpy(nfc_tgt->nfcid1, tgt_type_a->nfcid_data, nfc_tgt->nfcid1_len);
 741
 742         return 0;
 743 }
 744
 745 struct pn533_target_felica {
 746         u8 pol_res;
 747         u8 opcode;
 748         u8 nfcid2[8];
 749         u8 pad[8];
 750         /* optional */
 751         u8 syst_code[];
 752 } __packed;
 753
 754 #define PN533_FELICA_SENSF_NFCID2_DEP_B1 0x01
 755 #define PN533_FELICA_SENSF_NFCID2_DEP_B2 0xFE
 756
 757 static bool pn533_target_felica_is_valid(struct pn533_target_felica *felica,
 758                                                         int target_data_len)
 759 {
 760         if (target_data_len < sizeof(struct pn533_target_felica))
 761                 return false;
 762
 763         if (felica->opcode != PN533_FELICA_OPC_SENSF_RES)
 764                 return false;
 765
 766         return true;
 767 }
 768
 769 static int pn533_target_found_felica(struct nfc_target *nfc_tgt, u8 *tgt_data,
 770                                                         int tgt_data_len)
 771 {
 772         struct pn533_target_felica *tgt_felica;
 773
 774         tgt_felica = (struct pn533_target_felica *) tgt_data;
 775
 776         if (!pn533_target_felica_is_valid(tgt_felica, tgt_data_len))
 777                 return -EPROTO;
 778
 779         if (tgt_felica->nfcid2[0] == PN533_FELICA_SENSF_NFCID2_DEP_B1 &&
 780                                         tgt_felica->nfcid2[1] ==
 781                                         PN533_FELICA_SENSF_NFCID2_DEP_B2)
 782                 nfc_tgt->supported_protocols = NFC_PROTO_NFC_DEP_MASK;
 783         else
 784                 nfc_tgt->supported_protocols = NFC_PROTO_FELICA_MASK;
 785
 786         memcpy(nfc_tgt->sensf_res, &tgt_felica->opcode, 9);
 787         nfc_tgt->sensf_res_len = 9;
 788
 789         return 0;
 790 }
 791
 792 struct pn533_target_jewel {
 793         __be16 sens_res;
 794         u8 jewelid[4];
 795 } __packed;
 796
 797 static bool pn533_target_jewel_is_valid(struct pn533_target_jewel *jewel,
 798                                                         int target_data_len)
 799 {
 800         u8 ssd;
 801         u8 platconf;
 802
 803         if (target_data_len < sizeof(struct pn533_target_jewel))
 804                 return false;
 805
 806         /* Requirement 4.6.3.3 from NFC Forum Digital Spec */
 807         ssd = PN533_TYPE_A_SENS_RES_SSD(jewel->sens_res);
 808         platconf = PN533_TYPE_A_SENS_RES_PLATCONF(jewel->sens_res);
 809
 810         if ((ssd == PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
 811                         platconf != PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL) ||
 812                         (ssd != PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
 813                         platconf == PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL))
 814                 return false;
 815
 816         return true;
 817 }
 818
 819 static int pn533_target_found_jewel(struct nfc_target *nfc_tgt, u8 *tgt_data,
 820                                                         int tgt_data_len)
 821 {
 822         struct pn533_target_jewel *tgt_jewel;
 823
 824         tgt_jewel = (struct pn533_target_jewel *) tgt_data;
 825
 826         if (!pn533_target_jewel_is_valid(tgt_jewel, tgt_data_len))
 827                 return -EPROTO;
 828
 829         nfc_tgt->supported_protocols = NFC_PROTO_JEWEL_MASK;
 830         nfc_tgt->sens_res = be16_to_cpu(tgt_jewel->sens_res);
 831         nfc_tgt->nfcid1_len = 4;
 832         memcpy(nfc_tgt->nfcid1, tgt_jewel->jewelid, nfc_tgt->nfcid1_len);
 833
 834         return 0;
 835 }
 836
 837 struct pn533_type_b_prot_info {
 838         u8 bitrate;
 839         u8 fsci_type;
 840         u8 fwi_adc_fo;
 841 } __packed;
 842
 843 #define PN533_TYPE_B_PROT_FCSI(x) (((x) & 0xF0) >> 4)
 844 #define PN533_TYPE_B_PROT_TYPE(x) (((x) & 0x0F) >> 0)
 845 #define PN533_TYPE_B_PROT_TYPE_RFU_MASK 0x8
 846
 847 struct pn533_type_b_sens_res {
 848         u8 opcode;
 849         u8 nfcid[4];
 850         u8 appdata[4];
 851         struct pn533_type_b_prot_info prot_info;
 852 } __packed;
 853
 854 #define PN533_TYPE_B_OPC_SENSB_RES 0x50
 855
 856 struct pn533_target_type_b {
 857         struct pn533_type_b_sens_res sensb_res;
 858         u8 attrib_res_len;
 859         u8 attrib_res[];
 860 } __packed;
 861
 862 static bool pn533_target_type_b_is_valid(struct pn533_target_type_b *type_b,
 863                                                         int target_data_len)
 864 {
 865         if (target_data_len < sizeof(struct pn533_target_type_b))
 866                 return false;
 867
 868         if (type_b->sensb_res.opcode != PN533_TYPE_B_OPC_SENSB_RES)
 869                 return false;
 870
 871         if (PN533_TYPE_B_PROT_TYPE(type_b->sensb_res.prot_info.fsci_type) &
 872                                                 PN533_TYPE_B_PROT_TYPE_RFU_MASK)
 873                 return false;
 874
 875         return true;
 876 }
 877
 878 static int pn533_target_found_type_b(struct nfc_target *nfc_tgt, u8 *tgt_data,
 879                                                         int tgt_data_len)
 880 {
 881         struct pn533_target_type_b *tgt_type_b;
 882
 883         tgt_type_b = (struct pn533_target_type_b *) tgt_data;
 884
 885         if (!pn533_target_type_b_is_valid(tgt_type_b, tgt_data_len))
 886                 return -EPROTO;
 887
 888         nfc_tgt->supported_protocols = NFC_PROTO_ISO14443_MASK;
 889
 890         return 0;
 891 }
 892
 893 struct pn533_poll_response {
 894         u8 nbtg;
 895         u8 tg;
 896         u8 target_data[];
 897 } __packed;
 898
 899 static int pn533_target_found(struct pn533 *dev,
 900                         struct pn533_poll_response *resp, int resp_len)
 901 {
 902         int target_data_len;
 903         struct nfc_target nfc_tgt;
 904         int rc;
 905
 906         nfc_dev_dbg(&dev->interface->dev, "%s - modulation=%d", __func__,
 907                                                         dev->poll_mod_curr);
 908
 909         if (resp->tg != 1)
 910                 return -EPROTO;
 911
 912         memset(&nfc_tgt, 0, sizeof(struct nfc_target));
 913
 914         target_data_len = resp_len - sizeof(struct pn533_poll_response);
 915
 916         switch (dev->poll_mod_curr) {
 917         case PN533_POLL_MOD_106KBPS_A:
 918                 rc = pn533_target_found_type_a(&nfc_tgt, resp->target_data,
 919                                                         target_data_len);
 920                 break;
 921         case PN533_POLL_MOD_212KBPS_FELICA:
 922         case PN533_POLL_MOD_424KBPS_FELICA:
 923                 rc = pn533_target_found_felica(&nfc_tgt, resp->target_data,
 924                                                         target_data_len);
 925                 break;
 926         case PN533_POLL_MOD_106KBPS_JEWEL:
 927                 rc = pn533_target_found_jewel(&nfc_tgt, resp->target_data,
 928                                                         target_data_len);
 929                 break;
 930         case PN533_POLL_MOD_847KBPS_B:
 931                 rc = pn533_target_found_type_b(&nfc_tgt, resp->target_data,
 932                                                         target_data_len);
 933                 break;
 934         default:
 935                 nfc_dev_err(&dev->interface->dev, "Unknown current poll"
 936                                                                 " modulation");
 937                 return -EPROTO;
 938         }
 939
 940         if (rc)
 941                 return rc;
 942
 943         if (!(nfc_tgt.supported_protocols & dev->poll_protocols)) {
 944                 nfc_dev_dbg(&dev->interface->dev, "The target found does not"
 945                                                 " have the desired protocol");
 946                 return -EAGAIN;
 947         }
 948
 949         nfc_dev_dbg(&dev->interface->dev, "Target found - supported protocols: "
 950                                         "0x%x", nfc_tgt.supported_protocols);
 951
 952         dev->tgt_available_prots = nfc_tgt.supported_protocols;
 953
 954         nfc_targets_found(dev->nfc_dev, &nfc_tgt, 1);
 955
 956         return 0;
 957 }
 958
 959 static void pn533_poll_reset_mod_list(struct pn533 *dev)
 960 {
 961         dev->poll_mod_count = 0;
 962 }
 963
 964 static void pn533_poll_add_mod(struct pn533 *dev, u8 mod_index)
 965 {
 966         dev->poll_mod_active[dev->poll_mod_count] =
 967                 (struct pn533_poll_modulations *) &poll_mod[mod_index];
 968         dev->poll_mod_count++;
 969 }
 970
 971 static void pn533_poll_create_mod_list(struct pn533 *dev, u32 protocols)
 972 {
 973         pn533_poll_reset_mod_list(dev);
 974
 975         if (protocols & NFC_PROTO_MIFARE_MASK
 976                                         || protocols & NFC_PROTO_ISO14443_MASK
 977                                         || protocols & NFC_PROTO_NFC_DEP_MASK)
 978                 pn533_poll_add_mod(dev, PN533_POLL_MOD_106KBPS_A);
 979
 980         if (protocols & NFC_PROTO_FELICA_MASK
 981                                         || protocols & NFC_PROTO_NFC_DEP_MASK) {
 982                 pn533_poll_add_mod(dev, PN533_POLL_MOD_212KBPS_FELICA);
 983                 pn533_poll_add_mod(dev, PN533_POLL_MOD_424KBPS_FELICA);
 984         }
 985
 986         if (protocols & NFC_PROTO_JEWEL_MASK)
 987                 pn533_poll_add_mod(dev, PN533_POLL_MOD_106KBPS_JEWEL);
 988
 989         if (protocols & NFC_PROTO_ISO14443_MASK)
 990                 pn533_poll_add_mod(dev, PN533_POLL_MOD_847KBPS_B);
 991 }
 992
 993 static void pn533_start_poll_frame(struct pn533_frame *frame,
 994                                         struct pn533_poll_modulations *mod)
 995 {
 996
 997         pn533_tx_frame_init(frame, PN533_CMD_IN_LIST_PASSIVE_TARGET);
 998
 999         memcpy(PN533_FRAME_CMD_PARAMS_PTR(frame), &mod->data, mod->len);
1000         frame->datalen += mod->len;
1001
1002         pn533_tx_frame_finish(frame);
1003 }
1004
1005 static int pn533_start_poll_complete(struct pn533 *dev, void *arg,
1006                                                 u8 *params, int params_len)
1007 {
1008         struct pn533_poll_response *resp;
1009         struct pn533_poll_modulations *next_mod;
1010         int rc;
1011
1012         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1013
1014         if (params_len == -ENOENT) {
1015                 nfc_dev_dbg(&dev->interface->dev, "Polling operation has been"
1016                                                                 " stopped");
1017                 goto stop_poll;
1018         }
1019
1020         if (params_len < 0) {
1021                 nfc_dev_err(&dev->interface->dev, "Error %d when running poll",
1022                                                                 params_len);
1023                 goto stop_poll;
1024         }
1025
1026         resp = (struct pn533_poll_response *) params;
1027         if (resp->nbtg) {
1028                 rc = pn533_target_found(dev, resp, params_len);
1029
1030                 /* We must stop the poll after a valid target found */
1031                 if (rc == 0)
1032                         goto stop_poll;
1033
1034                 if (rc != -EAGAIN)
1035                         nfc_dev_err(&dev->interface->dev, "The target found is"
1036                                         " not valid - continuing to poll");
1037         }
1038
1039         dev->poll_mod_curr = (dev->poll_mod_curr + 1) % dev->poll_mod_count;
1040
1041         next_mod = dev->poll_mod_active[dev->poll_mod_curr];
1042
1043         nfc_dev_dbg(&dev->interface->dev, "Polling next modulation (0x%x)",
1044                                                         dev->poll_mod_curr);
1045
1046         pn533_start_poll_frame(dev->out_frame, next_mod);
1047
1048         /* Don't need to down the semaphore again */
1049         rc = __pn533_send_cmd_frame_async(dev, dev->out_frame, dev->in_frame,
1050                                 dev->in_maxlen, pn533_start_poll_complete,
1051                                 NULL, GFP_ATOMIC);
1052
1053         if (rc == -EPERM) {
1054                 nfc_dev_dbg(&dev->interface->dev, "Cannot poll next modulation"
1055                                         " because poll has been stopped");
1056                 goto stop_poll;
1057         }
1058
1059         if (rc) {
1060                 nfc_dev_err(&dev->interface->dev, "Error %d when trying to poll"
1061                                                         " next modulation", rc);
1062                 goto stop_poll;
1063         }
1064
1065         /* Inform caller function to do not up the semaphore */
1066         return -EINPROGRESS;
1067
1068 stop_poll:
1069         pn533_poll_reset_mod_list(dev);
1070         dev->poll_protocols = 0;
1071         return 0;
1072 }
1073
1074 static int pn533_start_poll(struct nfc_dev *nfc_dev, u32 protocols)
1075 {
1076         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
1077         struct pn533_poll_modulations *start_mod;
1078         int rc;
1079
1080         nfc_dev_dbg(&dev->interface->dev, "%s - protocols=0x%x", __func__,
1081                                                                 protocols);
1082
1083         if (dev->poll_mod_count) {
1084                 nfc_dev_err(&dev->interface->dev, "Polling operation already"
1085                                                                 " active");
1086                 return -EBUSY;
1087         }
1088
1089         if (dev->tgt_active_prot) {
1090                 nfc_dev_err(&dev->interface->dev, "Cannot poll with a target"
1091                                                         " already activated");
1092                 return -EBUSY;
1093         }
1094
1095         pn533_poll_create_mod_list(dev, protocols);
1096
1097         if (!dev->poll_mod_count) {
1098                 nfc_dev_err(&dev->interface->dev, "No valid protocols"
1099                                                                 " specified");
1100                 rc = -EINVAL;
1101                 goto error;
1102         }
1103
1104         nfc_dev_dbg(&dev->interface->dev, "It will poll %d modulations types",
1105                                                         dev->poll_mod_count);
1106
1107         dev->poll_mod_curr = 0;
1108         start_mod = dev->poll_mod_active[dev->poll_mod_curr];
1109
1110         pn533_start_poll_frame(dev->out_frame, start_mod);
1111
1112         rc = pn533_send_cmd_frame_async(dev, dev->out_frame, dev->in_frame,
1113                                 dev->in_maxlen, pn533_start_poll_complete,
1114                                 NULL, GFP_KERNEL);
1115
1116         if (rc) {
1117                 nfc_dev_err(&dev->interface->dev, "Error %d when trying to"
1118                                                         " start poll", rc);
1119                 goto error;
1120         }
1121
1122         dev->poll_protocols = protocols;
1123
1124         return 0;
1125
1126 error:
1127         pn533_poll_reset_mod_list(dev);
1128         return rc;
1129 }
1130
1131 static void pn533_stop_poll(struct nfc_dev *nfc_dev)
1132 {
1133         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
1134
1135         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1136
1137         if (!dev->poll_mod_count) {
1138                 nfc_dev_dbg(&dev->interface->dev, "Polling operation was not"
1139                                                                 " running");
1140                 return;
1141         }
1142
1143         /* An ack will cancel the last issued command (poll) */
1144         pn533_send_ack(dev, GFP_KERNEL);
1145
1146         /* prevent pn533_start_poll_complete to issue a new poll meanwhile */
1147         usb_kill_urb(dev->in_urb);
1148 }
1149
1150 static int pn533_activate_target_nfcdep(struct pn533 *dev)
1151 {
1152         struct pn533_cmd_activate_param param;
1153         struct pn533_cmd_activate_response *resp;
1154         u16 gt_len;
1155         int rc;
1156
1157         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1158
1159         pn533_tx_frame_init(dev->out_frame, PN533_CMD_IN_ATR);
1160
1161         param.tg = 1;
1162         param.next = 0;
1163         memcpy(PN533_FRAME_CMD_PARAMS_PTR(dev->out_frame), &param,
1164                                 sizeof(struct pn533_cmd_activate_param));
1165         dev->out_frame->datalen += sizeof(struct pn533_cmd_activate_param);
1166
1167         pn533_tx_frame_finish(dev->out_frame);
1168
1169         rc = pn533_send_cmd_frame_sync(dev, dev->out_frame, dev->in_frame,
1170                                                                 dev->in_maxlen);
1171         if (rc)
1172                 return rc;
1173
1174         resp = (struct pn533_cmd_activate_response *)
1175                                 PN533_FRAME_CMD_PARAMS_PTR(dev->in_frame);
1176         rc = resp->status & PN533_CMD_RET_MASK;
1177         if (rc != PN533_CMD_RET_SUCCESS)
1178                 return -EIO;
1179
1180         /* ATR_RES general bytes are located at offset 16 */
1181         gt_len = PN533_FRAME_CMD_PARAMS_LEN(dev->in_frame) - 16;
1182         rc = nfc_set_remote_general_bytes(dev->nfc_dev, resp->gt, gt_len);
1183
1184         return rc;
1185 }
1186
1187 static int pn533_activate_target(struct nfc_dev *nfc_dev, u32 target_idx,
1188                                                                 u32 protocol)
1189 {
1190         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
1191         int rc;
1192
1193         nfc_dev_dbg(&dev->interface->dev, "%s - protocol=%u", __func__,
1194                                                                 protocol);
1195
1196         if (dev->poll_mod_count) {
1197                 nfc_dev_err(&dev->interface->dev, "Cannot activate while"
1198                                                                 " polling");
1199                 return -EBUSY;
1200         }
1201
1202         if (dev->tgt_active_prot) {
1203                 nfc_dev_err(&dev->interface->dev, "There is already an active"
1204                                                                 " target");
1205                 return -EBUSY;
1206         }
1207
1208         if (!dev->tgt_available_prots) {
1209                 nfc_dev_err(&dev->interface->dev, "There is no available target"
1210                                                                 " to activate");
1211                 return -EINVAL;
1212         }
1213
1214         if (!(dev->tgt_available_prots & (1 << protocol))) {
1215                 nfc_dev_err(&dev->interface->dev, "The target does not support"
1216                                         " the requested protocol %u", protocol);
1217                 return -EINVAL;
1218         }
1219
1220         if (protocol == NFC_PROTO_NFC_DEP) {
1221                 rc = pn533_activate_target_nfcdep(dev);
1222                 if (rc) {
1223                         nfc_dev_err(&dev->interface->dev, "Error %d when"
1224                                                 " activating target with"
1225                                                 " NFC_DEP protocol", rc);
1226                         return rc;
1227                 }
1228         }
1229
1230         dev->tgt_active_prot = protocol;
1231         dev->tgt_available_prots = 0;
1232
1233         return 0;
1234 }
1235
1236 static void pn533_deactivate_target(struct nfc_dev *nfc_dev, u32 target_idx)
1237 {
1238         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
1239         u8 tg;
1240         u8 status;
1241         int rc;
1242
1243         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1244
1245         if (!dev->tgt_active_prot) {
1246                 nfc_dev_err(&dev->interface->dev, "There is no active target");
1247                 return;
1248         }
1249
1250         dev->tgt_active_prot = 0;
1251
1252         pn533_tx_frame_init(dev->out_frame, PN533_CMD_IN_RELEASE);
1253
1254         tg = 1;
1255         memcpy(PN533_FRAME_CMD_PARAMS_PTR(dev->out_frame), &tg, sizeof(u8));
1256         dev->out_frame->datalen += sizeof(u8);
1257
1258         pn533_tx_frame_finish(dev->out_frame);
1259
1260         rc = pn533_send_cmd_frame_sync(dev, dev->out_frame, dev->in_frame,
1261                                                                 dev->in_maxlen);
1262         if (rc) {
1263                 nfc_dev_err(&dev->interface->dev, "Error when sending release"
1264                                                 " command to the controller");
1265                 return;
1266         }
1267
1268         status = PN533_FRAME_CMD_PARAMS_PTR(dev->in_frame)[0];
1269         rc = status & PN533_CMD_RET_MASK;
1270         if (rc != PN533_CMD_RET_SUCCESS)
1271                 nfc_dev_err(&dev->interface->dev, "Error 0x%x when releasing"
1272                                                         " the target", rc);
1273
1274         return;
1275 }
1276
1277
1278 static int pn533_in_dep_link_up_complete(struct pn533 *dev, void *arg,
1279                                                 u8 *params, int params_len)
1280 {
1281         struct pn533_cmd_jump_dep *cmd;
1282         struct pn533_cmd_jump_dep_response *resp;
1283         struct nfc_target nfc_target;
1284         u8 target_gt_len;
1285         int rc;
1286
1287         if (params_len == -ENOENT) {
1288                 nfc_dev_dbg(&dev->interface->dev, "");
1289                 return 0;
1290         }
1291
1292         if (params_len < 0) {
1293                 nfc_dev_err(&dev->interface->dev,
1294                                 "Error %d when bringing DEP link up",
1295                                                                 params_len);
1296                 return 0;
1297         }
1298
1299         if (dev->tgt_available_prots &&
1300             !(dev->tgt_available_prots & (1 << NFC_PROTO_NFC_DEP))) {
1301                 nfc_dev_err(&dev->interface->dev,
1302                         "The target does not support DEP");
1303                 return -EINVAL;
1304         }
1305
1306         resp = (struct pn533_cmd_jump_dep_response *) params;
1307         cmd = (struct pn533_cmd_jump_dep *) arg;
1308         rc = resp->status & PN533_CMD_RET_MASK;
1309         if (rc != PN533_CMD_RET_SUCCESS) {
1310                 nfc_dev_err(&dev->interface->dev,
1311                                 "Bringing DEP link up failed %d", rc);
1312                 return 0;
1313         }
1314
1315         if (!dev->tgt_available_prots) {
1316                 nfc_dev_dbg(&dev->interface->dev, "Creating new target");
1317
1318                 nfc_target.supported_protocols = NFC_PROTO_NFC_DEP_MASK;
1319                 nfc_target.nfcid1_len = 10;
1320                 memcpy(nfc_target.nfcid1, resp->nfcid3t, nfc_target.nfcid1_len);
1321                 rc = nfc_targets_found(dev->nfc_dev, &nfc_target, 1);
1322                 if (rc)
1323                         return 0;
1324
1325                 dev->tgt_available_prots = 0;
1326         }
1327
1328         dev->tgt_active_prot = NFC_PROTO_NFC_DEP;
1329
1330         /* ATR_RES general bytes are located at offset 17 */
1331         target_gt_len = PN533_FRAME_CMD_PARAMS_LEN(dev->in_frame) - 17;
1332         rc = nfc_set_remote_general_bytes(dev->nfc_dev,
1333                                                 resp->gt, target_gt_len);
1334         if (rc == 0)
1335                 rc = nfc_dep_link_is_up(dev->nfc_dev,
1336                                                 dev->nfc_dev->targets[0].idx,
1337                                                 !cmd->active, NFC_RF_INITIATOR);
1338
1339         return 0;
1340 }
1341
1342 static int pn533_dep_link_up(struct nfc_dev *nfc_dev, int target_idx,
1343                              u8 comm_mode, u8* gb, size_t gb_len)
1344 {
1345         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
1346         struct pn533_cmd_jump_dep *cmd;
1347         u8 cmd_len;
1348         int rc;
1349
1350         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1351
1352         if (dev->poll_mod_count) {
1353                 nfc_dev_err(&dev->interface->dev,
1354                                 "Cannot bring the DEP link up while polling");
1355                 return -EBUSY;
1356         }
1357
1358         if (dev->tgt_active_prot) {
1359                 nfc_dev_err(&dev->interface->dev,
1360                                 "There is already an active target");
1361                 return -EBUSY;
1362         }
1363
1364         cmd_len = sizeof(struct pn533_cmd_jump_dep) + gb_len;
1365         cmd = kzalloc(cmd_len, GFP_KERNEL);
1366         if (cmd == NULL)
1367                 return -ENOMEM;
1368
1369         pn533_tx_frame_init(dev->out_frame, PN533_CMD_IN_JUMP_FOR_DEP);
1370
1371         cmd->active = !comm_mode;
1372         cmd->baud = 0;
1373         if (gb != NULL && gb_len > 0) {
1374                 cmd->next = 4; /* We have some Gi */
1375                 memcpy(cmd->gt, gb, gb_len);
1376         } else {
1377                 cmd->next = 0;
1378         }
1379
1380         memcpy(PN533_FRAME_CMD_PARAMS_PTR(dev->out_frame), cmd, cmd_len);
1381         dev->out_frame->datalen += cmd_len;
1382
1383         pn533_tx_frame_finish(dev->out_frame);
1384
1385         rc = pn533_send_cmd_frame_async(dev, dev->out_frame, dev->in_frame,
1386                                 dev->in_maxlen, pn533_in_dep_link_up_complete,
1387                                 cmd, GFP_KERNEL);
1388         if (rc)
1389                 goto out;
1390
1391
1392 out:
1393         kfree(cmd);
1394
1395         return rc;
1396 }
1397
1398 static int pn533_dep_link_down(struct nfc_dev *nfc_dev)
1399 {
1400         pn533_deactivate_target(nfc_dev, 0);
1401
1402         return 0;
1403 }
1404
1405 #define PN533_CMD_DATAEXCH_HEAD_LEN (sizeof(struct pn533_frame) + 3)
1406 #define PN533_CMD_DATAEXCH_DATA_MAXLEN 262
1407
1408 static int pn533_data_exchange_tx_frame(struct pn533 *dev, struct sk_buff *skb)
1409 {
1410         int payload_len = skb->len;
1411         struct pn533_frame *out_frame;
1412         u8 tg;
1413
1414         nfc_dev_dbg(&dev->interface->dev, "%s - Sending %d bytes", __func__,
1415                                                                 payload_len);
1416
1417         if (payload_len > PN533_CMD_DATAEXCH_DATA_MAXLEN) {
1418                 /* TODO: Implement support to multi-part data exchange */
1419                 nfc_dev_err(&dev->interface->dev, "Data length greater than the"
1420                                                 " max allowed: %d",
1421                                                 PN533_CMD_DATAEXCH_DATA_MAXLEN);
1422                 return -ENOSYS;
1423         }
1424
1425         skb_push(skb, PN533_CMD_DATAEXCH_HEAD_LEN);
1426         out_frame = (struct pn533_frame *) skb->data;
1427
1428         pn533_tx_frame_init(out_frame, PN533_CMD_IN_DATA_EXCHANGE);
1429
1430         tg = 1;
1431         memcpy(PN533_FRAME_CMD_PARAMS_PTR(out_frame), &tg, sizeof(u8));
1432         out_frame->datalen += sizeof(u8);
1433
1434         /* The data is already in the out_frame, just update the datalen */
1435         out_frame->datalen += payload_len;
1436
1437         pn533_tx_frame_finish(out_frame);
1438         skb_put(skb, PN533_FRAME_TAIL_SIZE);
1439
1440         return 0;
1441 }
1442
1443 struct pn533_data_exchange_arg {
1444         struct sk_buff *skb_resp;
1445         struct sk_buff *skb_out;
1446         data_exchange_cb_t cb;
1447         void *cb_context;
1448 };
1449
1450 static int pn533_data_exchange_complete(struct pn533 *dev, void *_arg,
1451                                                 u8 *params, int params_len)
1452 {
1453         struct pn533_data_exchange_arg *arg = _arg;
1454         struct sk_buff *skb_resp = arg->skb_resp;
1455         struct pn533_frame *in_frame = (struct pn533_frame *) skb_resp->data;
1456         int err = 0;
1457         u8 status;
1458         u8 cmd_ret;
1459
1460         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1461
1462         dev_kfree_skb_irq(arg->skb_out);
1463
1464         if (params_len < 0) { /* error */
1465                 err = params_len;
1466                 goto error;
1467         }
1468
1469         skb_put(skb_resp, PN533_FRAME_SIZE(in_frame));
1470
1471         status = params[0];
1472
1473         cmd_ret = status & PN533_CMD_RET_MASK;
1474         if (cmd_ret != PN533_CMD_RET_SUCCESS) {
1475                 nfc_dev_err(&dev->interface->dev, "PN533 reported error %d when"
1476                                                 " exchanging data", cmd_ret);
1477                 err = -EIO;
1478                 goto error;
1479         }
1480
1481         if (status & PN533_CMD_MI_MASK) {
1482                 /* TODO: Implement support to multi-part data exchange */
1483                 nfc_dev_err(&dev->interface->dev, "Multi-part message not yet"
1484                                                                 " supported");
1485                 /* Prevent the other messages from controller */
1486                 pn533_send_ack(dev, GFP_ATOMIC);
1487                 err = -ENOSYS;
1488                 goto error;
1489         }
1490
1491         skb_pull(skb_resp, PN533_CMD_DATAEXCH_HEAD_LEN);
1492         skb_trim(skb_resp, skb_resp->len - PN533_FRAME_TAIL_SIZE);
1493
1494         arg->cb(arg->cb_context, skb_resp, 0);
1495         kfree(arg);
1496         return 0;
1497
1498 error:
1499         dev_kfree_skb_irq(skb_resp);
1500         arg->cb(arg->cb_context, NULL, err);
1501         kfree(arg);
1502         return 0;
1503 }
1504
1505 static int pn533_data_exchange(struct nfc_dev *nfc_dev, u32 target_idx,
1506                                                 struct sk_buff *skb,
1507                                                 data_exchange_cb_t cb,
1508                                                 void *cb_context)
1509 {
1510         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
1511         struct pn533_frame *out_frame, *in_frame;
1512         struct pn533_data_exchange_arg *arg;
1513         struct sk_buff *skb_resp;
1514         int skb_resp_len;
1515         int rc;
1516
1517         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1518
1519         if (!dev->tgt_active_prot) {
1520                 nfc_dev_err(&dev->interface->dev, "Cannot exchange data if"
1521                                                 " there is no active target");
1522                 rc = -EINVAL;
1523                 goto error;
1524         }
1525
1526         rc = pn533_data_exchange_tx_frame(dev, skb);
1527         if (rc)
1528                 goto error;
1529
1530         skb_resp_len = PN533_CMD_DATAEXCH_HEAD_LEN +
1531                         PN533_CMD_DATAEXCH_DATA_MAXLEN +
1532                         PN533_FRAME_TAIL_SIZE;
1533
1534         skb_resp = nfc_alloc_recv_skb(skb_resp_len, GFP_KERNEL);
1535         if (!skb_resp) {
1536                 rc = -ENOMEM;
1537                 goto error;
1538         }
1539
1540         in_frame = (struct pn533_frame *) skb_resp->data;
1541         out_frame = (struct pn533_frame *) skb->data;
1542
1543         arg = kmalloc(sizeof(struct pn533_data_exchange_arg), GFP_KERNEL);
1544         if (!arg) {
1545                 rc = -ENOMEM;
1546                 goto free_skb_resp;
1547         }
1548
1549         arg->skb_resp = skb_resp;
1550         arg->skb_out = skb;
1551         arg->cb = cb;
1552         arg->cb_context = cb_context;
1553
1554         rc = pn533_send_cmd_frame_async(dev, out_frame, in_frame, skb_resp_len,
1555                                         pn533_data_exchange_complete, arg,
1556                                         GFP_KERNEL);
1557         if (rc) {
1558                 nfc_dev_err(&dev->interface->dev, "Error %d when trying to"
1559                                                 " perform data_exchange", rc);
1560                 goto free_arg;
1561         }
1562
1563         return 0;
1564
1565 free_arg:
1566         kfree(arg);
1567 free_skb_resp:
1568         kfree_skb(skb_resp);
1569 error:
1570         kfree_skb(skb);
1571         return rc;
1572 }
1573
1574 static int pn533_set_configuration(struct pn533 *dev, u8 cfgitem, u8 *cfgdata,
1575                                                                 u8 cfgdata_len)
1576 {
1577         int rc;
1578         u8 *params;
1579
1580         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1581
1582         pn533_tx_frame_init(dev->out_frame, PN533_CMD_RF_CONFIGURATION);
1583
1584         params = PN533_FRAME_CMD_PARAMS_PTR(dev->out_frame);
1585         params[0] = cfgitem;
1586         memcpy(&params[1], cfgdata, cfgdata_len);
1587         dev->out_frame->datalen += (1 + cfgdata_len);
1588
1589         pn533_tx_frame_finish(dev->out_frame);
1590
1591         rc = pn533_send_cmd_frame_sync(dev, dev->out_frame, dev->in_frame,
1592                                                                 dev->in_maxlen);
1593
1594         return rc;
1595 }
1596
1597 struct nfc_ops pn533_nfc_ops = {
1598         .dev_up = NULL,
1599         .dev_down = NULL,
1600         .dep_link_up = pn533_dep_link_up,
1601         .dep_link_down = pn533_dep_link_down,
1602         .start_poll = pn533_start_poll,
1603         .stop_poll = pn533_stop_poll,
1604         .activate_target = pn533_activate_target,
1605         .deactivate_target = pn533_deactivate_target,
1606         .data_exchange = pn533_data_exchange,
1607 };
1608
1609 static int pn533_probe(struct usb_interface *interface,
1610                         const struct usb_device_id *id)
1611 {
1612         struct pn533_fw_version *fw_ver;
1613         struct pn533 *dev;
1614         struct usb_host_interface *iface_desc;
1615         struct usb_endpoint_descriptor *endpoint;
1616         struct pn533_config_max_retries max_retries;
1617         int in_endpoint = 0;
1618         int out_endpoint = 0;
1619         int rc = -ENOMEM;
1620         int i;
1621         u32 protocols;
1622
1623         dev = kzalloc(sizeof(*dev), GFP_KERNEL);
1624         if (!dev)
1625                 return -ENOMEM;
1626
1627         dev->udev = usb_get_dev(interface_to_usbdev(interface));
1628         dev->interface = interface;
1629         sema_init(&dev->cmd_lock, 1);
1630
1631         iface_desc = interface->cur_altsetting;
1632         for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
1633                 endpoint = &iface_desc->endpoint[i].desc;
1634
1635                 if (!in_endpoint && usb_endpoint_is_bulk_in(endpoint)) {
1636                         dev->in_maxlen = le16_to_cpu(endpoint->wMaxPacketSize);
1637                         in_endpoint = endpoint->bEndpointAddress;
1638                 }
1639
1640                 if (!out_endpoint && usb_endpoint_is_bulk_out(endpoint)) {
1641                         dev->out_maxlen =
1642                                 le16_to_cpu(endpoint->wMaxPacketSize);
1643                         out_endpoint = endpoint->bEndpointAddress;
1644                 }
1645         }
1646
1647         if (!in_endpoint || !out_endpoint) {
1648                 nfc_dev_err(&interface->dev, "Could not find bulk-in or"
1649                                                         " bulk-out endpoint");
1650                 rc = -ENODEV;
1651                 goto error;
1652         }
1653
1654         dev->in_frame = kmalloc(dev->in_maxlen, GFP_KERNEL);
1655         dev->in_urb = usb_alloc_urb(0, GFP_KERNEL);
1656         dev->out_frame = kmalloc(dev->out_maxlen, GFP_KERNEL);
1657         dev->out_urb = usb_alloc_urb(0, GFP_KERNEL);
1658
1659         if (!dev->in_frame || !dev->out_frame ||
1660                 !dev->in_urb || !dev->out_urb)
1661                 goto error;
1662
1663         usb_fill_bulk_urb(dev->in_urb, dev->udev,
1664                         usb_rcvbulkpipe(dev->udev, in_endpoint),
1665                         NULL, 0, NULL, dev);
1666         usb_fill_bulk_urb(dev->out_urb, dev->udev,
1667                         usb_sndbulkpipe(dev->udev, out_endpoint),
1668                         NULL, 0,
1669                         pn533_send_complete, dev);
1670
1671         tasklet_init(&dev->tasklet, pn533_tasklet_cmd_complete, (ulong)dev);
1672
1673         usb_set_intfdata(interface, dev);
1674
1675         pn533_tx_frame_init(dev->out_frame, PN533_CMD_GET_FIRMWARE_VERSION);
1676         pn533_tx_frame_finish(dev->out_frame);
1677
1678         rc = pn533_send_cmd_frame_sync(dev, dev->out_frame, dev->in_frame,
1679                                                                 dev->in_maxlen);
1680         if (rc)
1681                 goto kill_tasklet;
1682
1683         fw_ver = (struct pn533_fw_version *)
1684                                 PN533_FRAME_CMD_PARAMS_PTR(dev->in_frame);
1685         nfc_dev_info(&dev->interface->dev, "NXP PN533 firmware ver %d.%d now"
1686                                         " attached", fw_ver->ver, fw_ver->rev);
1687
1688         protocols = NFC_PROTO_JEWEL_MASK
1689                         | NFC_PROTO_MIFARE_MASK | NFC_PROTO_FELICA_MASK
1690                         | NFC_PROTO_ISO14443_MASK
1691                         | NFC_PROTO_NFC_DEP_MASK;
1692
1693         dev->nfc_dev = nfc_allocate_device(&pn533_nfc_ops, protocols,
1694                                            PN533_CMD_DATAEXCH_HEAD_LEN,
1695                                            PN533_FRAME_TAIL_SIZE);
1696         if (!dev->nfc_dev)
1697                 goto kill_tasklet;
1698
1699         nfc_set_parent_dev(dev->nfc_dev, &interface->dev);
1700         nfc_set_drvdata(dev->nfc_dev, dev);
1701
1702         rc = nfc_register_device(dev->nfc_dev);
1703         if (rc)
1704                 goto free_nfc_dev;
1705
1706         max_retries.mx_rty_atr = PN533_CONFIG_MAX_RETRIES_ENDLESS;
1707         max_retries.mx_rty_psl = 2;
1708         max_retries.mx_rty_passive_act = PN533_CONFIG_MAX_RETRIES_NO_RETRY;
1709
1710         rc = pn533_set_configuration(dev, PN533_CFGITEM_MAX_RETRIES,
1711                                 (u8 *) &max_retries, sizeof(max_retries));
1712
1713         if (rc) {
1714                 nfc_dev_err(&dev->interface->dev, "Error on setting MAX_RETRIES"
1715                                                                 " config");
1716                 goto free_nfc_dev;
1717         }
1718
1719         return 0;
1720
1721 free_nfc_dev:
1722         nfc_free_device(dev->nfc_dev);
1723 kill_tasklet:
1724         tasklet_kill(&dev->tasklet);
1725 error:
1726         kfree(dev->in_frame);
1727         usb_free_urb(dev->in_urb);
1728         kfree(dev->out_frame);
1729         usb_free_urb(dev->out_urb);
1730         kfree(dev);
1731         return rc;
1732 }
1733
1734 static void pn533_disconnect(struct usb_interface *interface)
1735 {
1736         struct pn533 *dev;
1737
1738         dev = usb_get_intfdata(interface);
1739         usb_set_intfdata(interface, NULL);
1740
1741         nfc_unregister_device(dev->nfc_dev);
1742         nfc_free_device(dev->nfc_dev);
1743
1744         usb_kill_urb(dev->in_urb);
1745         usb_kill_urb(dev->out_urb);
1746
1747         tasklet_kill(&dev->tasklet);
1748
1749         kfree(dev->in_frame);
1750         usb_free_urb(dev->in_urb);
1751         kfree(dev->out_frame);
1752         usb_free_urb(dev->out_urb);
1753         kfree(dev);
1754
1755         nfc_dev_info(&interface->dev, "NXP PN533 NFC device disconnected");
1756 }
1757
1758 static struct usb_driver pn533_driver = {
1759         .name =         "pn533",
1760         .probe =        pn533_probe,
1761         .disconnect =   pn533_disconnect,
1762         .id_table =     pn533_table,
1763 };
1764
1765 module_usb_driver(pn533_driver);
1766
1767 MODULE_AUTHOR("Lauro Ramos Venancio <lauro.venancio@openbossa.org>,"
1768                         " Aloisio Almeida Jr <aloisio.almeida@openbossa.org>");
1769 MODULE_DESCRIPTION("PN533 usb driver ver " VERSION);
1770 MODULE_VERSION(VERSION);
1771 MODULE_LICENSE("GPL");