drivers/nfc/pn533.c

   1 /*
   2  * Copyright (C) 2011 Instituto Nokia de Tecnologia
   3  * Copyright (C) 2012-2013 Tieto Poland
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License as published by
   7  * the Free Software Foundation; either version 2 of the License, or
   8  * (at your option) any later version.
   9  *
  10  * This program is distributed in the hope that it will be useful,
  11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  13  * GNU General Public License for more details.
  14  *
  15  * You should have received a copy of the GNU General Public License
  16  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  17  */
  18
  19 #include <linux/device.h>
  20 #include <linux/kernel.h>
  21 #include <linux/module.h>
  22 #include <linux/slab.h>
  23 #include <linux/usb.h>
  24 #include <linux/nfc.h>
  25 #include <linux/netdevice.h>
  26 #include <net/nfc/nfc.h>
  27
  28 #define VERSION "0.2"
  29
  30 #define PN533_VENDOR_ID 0x4CC
  31 #define PN533_PRODUCT_ID 0x2533
  32
  33 #define SCM_VENDOR_ID 0x4E6
  34 #define SCL3711_PRODUCT_ID 0x5591
  35
  36 #define SONY_VENDOR_ID         0x054c
  37 #define PASORI_PRODUCT_ID      0x02e1
  38
  39 #define ACS_VENDOR_ID 0x072f
  40 #define ACR122U_PRODUCT_ID 0x2200
  41
  42 #define PN533_DEVICE_STD     0x1
  43 #define PN533_DEVICE_PASORI  0x2
  44 #define PN533_DEVICE_ACR122U 0x3
  45
  46 #define PN533_ALL_PROTOCOLS (NFC_PROTO_JEWEL_MASK | NFC_PROTO_MIFARE_MASK |\
  47                              NFC_PROTO_FELICA_MASK | NFC_PROTO_ISO14443_MASK |\
  48                              NFC_PROTO_NFC_DEP_MASK |\
  49                              NFC_PROTO_ISO14443_B_MASK)
  50
  51 #define PN533_NO_TYPE_B_PROTOCOLS (NFC_PROTO_JEWEL_MASK | \
  52                                    NFC_PROTO_MIFARE_MASK | \
  53                                    NFC_PROTO_FELICA_MASK | \
  54                                    NFC_PROTO_ISO14443_MASK | \
  55                                    NFC_PROTO_NFC_DEP_MASK)
  56
  57 static const struct usb_device_id pn533_table[] = {
  58         { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE,
  59           .idVendor             = PN533_VENDOR_ID,
  60           .idProduct            = PN533_PRODUCT_ID,
  61           .driver_info          = PN533_DEVICE_STD,
  62         },
  63         { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE,
  64           .idVendor             = SCM_VENDOR_ID,
  65           .idProduct            = SCL3711_PRODUCT_ID,
  66           .driver_info          = PN533_DEVICE_STD,
  67         },
  68         { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE,
  69           .idVendor             = SONY_VENDOR_ID,
  70           .idProduct            = PASORI_PRODUCT_ID,
  71           .driver_info          = PN533_DEVICE_PASORI,
  72         },
  73         { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE,
  74           .idVendor             = ACS_VENDOR_ID,
  75           .idProduct            = ACR122U_PRODUCT_ID,
  76           .driver_info          = PN533_DEVICE_ACR122U,
  77         },
  78         { }
  79 };
  80 MODULE_DEVICE_TABLE(usb, pn533_table);
  81
  82 /* How much time we spend listening for initiators */
  83 #define PN533_LISTEN_TIME 2
  84 /* Delay between each poll frame (ms) */
  85 #define PN533_POLL_INTERVAL 10
  86
  87 /* Standard pn533 frame definitions (standard and extended)*/
  88 #define PN533_STD_FRAME_HEADER_LEN (sizeof(struct pn533_std_frame) \
  89                                         + 2) /* data[0] TFI, data[1] CC */
  90 #define PN533_STD_FRAME_TAIL_LEN 2 /* data[len] DCS, data[len + 1] postamble*/
  91
  92 #define PN533_EXT_FRAME_HEADER_LEN (sizeof(struct pn533_ext_frame) \
  93                                         + 2) /* data[0] TFI, data[1] CC */
  94
  95 #define PN533_CMD_DATAEXCH_DATA_MAXLEN  262
  96 #define PN533_CMD_DATAFRAME_MAXLEN      240     /* max data length (send) */
  97
  98 /*
  99  * Max extended frame payload len, excluding TFI and CC
 100  * which are already in PN533_FRAME_HEADER_LEN.
 101  */
 102 #define PN533_STD_FRAME_MAX_PAYLOAD_LEN 263
 103
 104 #define PN533_STD_FRAME_ACK_SIZE 6 /* Preamble (1), SoPC (2), ACK Code (2),
 105                                   Postamble (1) */
 106 #define PN533_STD_FRAME_CHECKSUM(f) (f->data[f->datalen])
 107 #define PN533_STD_FRAME_POSTAMBLE(f) (f->data[f->datalen + 1])
 108 /* Half start code (3), LEN (4) should be 0xffff for extended frame */
 109 #define PN533_STD_IS_EXTENDED(hdr) ((hdr)->datalen == 0xFF \
 110                                         && (hdr)->datalen_checksum == 0xFF)
 111 #define PN533_EXT_FRAME_CHECKSUM(f) (f->data[be16_to_cpu(f->datalen)])
 112
 113 /* start of frame */
 114 #define PN533_STD_FRAME_SOF 0x00FF
 115
 116 /* standard frame identifier: in/out/error */
 117 #define PN533_STD_FRAME_IDENTIFIER(f) (f->data[0]) /* TFI */
 118 #define PN533_STD_FRAME_DIR_OUT 0xD4
 119 #define PN533_STD_FRAME_DIR_IN 0xD5
 120
 121 /* ACS ACR122 pn533 frame definitions */
 122 #define PN533_ACR122_TX_FRAME_HEADER_LEN (sizeof(struct pn533_acr122_tx_frame) \
 123                                           + 2)
 124 #define PN533_ACR122_TX_FRAME_TAIL_LEN 0
 125 #define PN533_ACR122_RX_FRAME_HEADER_LEN (sizeof(struct pn533_acr122_rx_frame) \
 126                                           + 2)
 127 #define PN533_ACR122_RX_FRAME_TAIL_LEN 2
 128 #define PN533_ACR122_FRAME_MAX_PAYLOAD_LEN PN533_STD_FRAME_MAX_PAYLOAD_LEN
 129
 130 /* CCID messages types */
 131 #define PN533_ACR122_PC_TO_RDR_ICCPOWERON 0x62
 132 #define PN533_ACR122_PC_TO_RDR_ESCAPE 0x6B
 133
 134 #define PN533_ACR122_RDR_TO_PC_ESCAPE 0x83
 135
 136 /* PN533 Commands */
 137 #define PN533_FRAME_CMD(f) (f->data[1])
 138
 139 #define PN533_CMD_GET_FIRMWARE_VERSION 0x02
 140 #define PN533_CMD_RF_CONFIGURATION 0x32
 141 #define PN533_CMD_IN_DATA_EXCHANGE 0x40
 142 #define PN533_CMD_IN_COMM_THRU     0x42
 143 #define PN533_CMD_IN_LIST_PASSIVE_TARGET 0x4A
 144 #define PN533_CMD_IN_ATR 0x50
 145 #define PN533_CMD_IN_RELEASE 0x52
 146 #define PN533_CMD_IN_JUMP_FOR_DEP 0x56
 147
 148 #define PN533_CMD_TG_INIT_AS_TARGET 0x8c
 149 #define PN533_CMD_TG_GET_DATA 0x86
 150 #define PN533_CMD_TG_SET_DATA 0x8e
 151 #define PN533_CMD_TG_SET_META_DATA 0x94
 152 #define PN533_CMD_UNDEF 0xff
 153
 154 #define PN533_CMD_RESPONSE(cmd) (cmd + 1)
 155
 156 /* PN533 Return codes */
 157 #define PN533_CMD_RET_MASK 0x3F
 158 #define PN533_CMD_MI_MASK 0x40
 159 #define PN533_CMD_RET_SUCCESS 0x00
 160
 161 struct pn533;
 162
 163 typedef int (*pn533_send_async_complete_t) (struct pn533 *dev, void *arg,
 164                                         struct sk_buff *resp);
 165
 166 /* structs for pn533 commands */
 167
 168 /* PN533_CMD_GET_FIRMWARE_VERSION */
 169 struct pn533_fw_version {
 170         u8 ic;
 171         u8 ver;
 172         u8 rev;
 173         u8 support;
 174 };
 175
 176 /* PN533_CMD_RF_CONFIGURATION */
 177 #define PN533_CFGITEM_RF_FIELD    0x01
 178 #define PN533_CFGITEM_TIMING      0x02
 179 #define PN533_CFGITEM_MAX_RETRIES 0x05
 180 #define PN533_CFGITEM_PASORI      0x82
 181
 182 #define PN533_CFGITEM_RF_FIELD_AUTO_RFCA 0x2
 183 #define PN533_CFGITEM_RF_FIELD_ON        0x1
 184 #define PN533_CFGITEM_RF_FIELD_OFF       0x0
 185
 186 #define PN533_CONFIG_TIMING_102 0xb
 187 #define PN533_CONFIG_TIMING_204 0xc
 188 #define PN533_CONFIG_TIMING_409 0xd
 189 #define PN533_CONFIG_TIMING_819 0xe
 190
 191 #define PN533_CONFIG_MAX_RETRIES_NO_RETRY 0x00
 192 #define PN533_CONFIG_MAX_RETRIES_ENDLESS 0xFF
 193
 194 struct pn533_config_max_retries {
 195         u8 mx_rty_atr;
 196         u8 mx_rty_psl;
 197         u8 mx_rty_passive_act;
 198 } __packed;
 199
 200 struct pn533_config_timing {
 201         u8 rfu;
 202         u8 atr_res_timeout;
 203         u8 dep_timeout;
 204 } __packed;
 205
 206 /* PN533_CMD_IN_LIST_PASSIVE_TARGET */
 207
 208 /* felica commands opcode */
 209 #define PN533_FELICA_OPC_SENSF_REQ 0
 210 #define PN533_FELICA_OPC_SENSF_RES 1
 211 /* felica SENSF_REQ parameters */
 212 #define PN533_FELICA_SENSF_SC_ALL 0xFFFF
 213 #define PN533_FELICA_SENSF_RC_NO_SYSTEM_CODE 0
 214 #define PN533_FELICA_SENSF_RC_SYSTEM_CODE 1
 215 #define PN533_FELICA_SENSF_RC_ADVANCED_PROTOCOL 2
 216
 217 /* type B initiator_data values */
 218 #define PN533_TYPE_B_AFI_ALL_FAMILIES 0
 219 #define PN533_TYPE_B_POLL_METHOD_TIMESLOT 0
 220 #define PN533_TYPE_B_POLL_METHOD_PROBABILISTIC 1
 221
 222 union pn533_cmd_poll_initdata {
 223         struct {
 224                 u8 afi;
 225                 u8 polling_method;
 226         } __packed type_b;
 227         struct {
 228                 u8 opcode;
 229                 __be16 sc;
 230                 u8 rc;
 231                 u8 tsn;
 232         } __packed felica;
 233 };
 234
 235 /* Poll modulations */
 236 enum {
 237         PN533_POLL_MOD_106KBPS_A,
 238         PN533_POLL_MOD_212KBPS_FELICA,
 239         PN533_POLL_MOD_424KBPS_FELICA,
 240         PN533_POLL_MOD_106KBPS_JEWEL,
 241         PN533_POLL_MOD_847KBPS_B,
 242         PN533_LISTEN_MOD,
 243
 244         __PN533_POLL_MOD_AFTER_LAST,
 245 };
 246 #define PN533_POLL_MOD_MAX (__PN533_POLL_MOD_AFTER_LAST - 1)
 247
 248 struct pn533_poll_modulations {
 249         struct {
 250                 u8 maxtg;
 251                 u8 brty;
 252                 union pn533_cmd_poll_initdata initiator_data;
 253         } __packed data;
 254         u8 len;
 255 };
 256
 257 static const struct pn533_poll_modulations poll_mod[] = {
 258         [PN533_POLL_MOD_106KBPS_A] = {
 259                 .data = {
 260                         .maxtg = 1,
 261                         .brty = 0,
 262                 },
 263                 .len = 2,
 264         },
 265         [PN533_POLL_MOD_212KBPS_FELICA] = {
 266                 .data = {
 267                         .maxtg = 1,
 268                         .brty = 1,
 269                         .initiator_data.felica = {
 270                                 .opcode = PN533_FELICA_OPC_SENSF_REQ,
 271                                 .sc = PN533_FELICA_SENSF_SC_ALL,
 272                                 .rc = PN533_FELICA_SENSF_RC_SYSTEM_CODE,
 273                                 .tsn = 0x03,
 274                         },
 275                 },
 276                 .len = 7,
 277         },
 278         [PN533_POLL_MOD_424KBPS_FELICA] = {
 279                 .data = {
 280                         .maxtg = 1,
 281                         .brty = 2,
 282                         .initiator_data.felica = {
 283                                 .opcode = PN533_FELICA_OPC_SENSF_REQ,
 284                                 .sc = PN533_FELICA_SENSF_SC_ALL,
 285                                 .rc = PN533_FELICA_SENSF_RC_SYSTEM_CODE,
 286                                 .tsn = 0x03,
 287                         },
 288                  },
 289                 .len = 7,
 290         },
 291         [PN533_POLL_MOD_106KBPS_JEWEL] = {
 292                 .data = {
 293                         .maxtg = 1,
 294                         .brty = 4,
 295                 },
 296                 .len = 2,
 297         },
 298         [PN533_POLL_MOD_847KBPS_B] = {
 299                 .data = {
 300                         .maxtg = 1,
 301                         .brty = 8,
 302                         .initiator_data.type_b = {
 303                                 .afi = PN533_TYPE_B_AFI_ALL_FAMILIES,
 304                                 .polling_method =
 305                                         PN533_TYPE_B_POLL_METHOD_TIMESLOT,
 306                         },
 307                 },
 308                 .len = 3,
 309         },
 310         [PN533_LISTEN_MOD] = {
 311                 .len = 0,
 312         },
 313 };
 314
 315 /* PN533_CMD_IN_ATR */
 316
 317 struct pn533_cmd_activate_response {
 318         u8 status;
 319         u8 nfcid3t[10];
 320         u8 didt;
 321         u8 bst;
 322         u8 brt;
 323         u8 to;
 324         u8 ppt;
 325         /* optional */
 326         u8 gt[];
 327 } __packed;
 328
 329 struct pn533_cmd_jump_dep_response {
 330         u8 status;
 331         u8 tg;
 332         u8 nfcid3t[10];
 333         u8 didt;
 334         u8 bst;
 335         u8 brt;
 336         u8 to;
 337         u8 ppt;
 338         /* optional */
 339         u8 gt[];
 340 } __packed;
 341
 342
 343 /* PN533_TG_INIT_AS_TARGET */
 344 #define PN533_INIT_TARGET_PASSIVE 0x1
 345 #define PN533_INIT_TARGET_DEP 0x2
 346
 347 #define PN533_INIT_TARGET_RESP_FRAME_MASK 0x3
 348 #define PN533_INIT_TARGET_RESP_ACTIVE     0x1
 349 #define PN533_INIT_TARGET_RESP_DEP        0x4
 350
 351 enum  pn533_protocol_type {
 352         PN533_PROTO_REQ_ACK_RESP = 0,
 353         PN533_PROTO_REQ_RESP
 354 };
 355
 356 struct pn533 {
 357         struct usb_device *udev;
 358         struct usb_interface *interface;
 359         struct nfc_dev *nfc_dev;
 360         u32 device_type;
 361         enum pn533_protocol_type protocol_type;
 362
 363         struct urb *out_urb;
 364         struct urb *in_urb;
 365
 366         struct sk_buff_head resp_q;
 367         struct sk_buff_head fragment_skb;
 368
 369         struct workqueue_struct *wq;
 370         struct work_struct cmd_work;
 371         struct work_struct cmd_complete_work;
 372         struct delayed_work poll_work;
 373         struct work_struct mi_rx_work;
 374         struct work_struct mi_tx_work;
 375         struct work_struct mi_tm_rx_work;
 376         struct work_struct mi_tm_tx_work;
 377         struct work_struct tg_work;
 378         struct work_struct rf_work;
 379
 380         struct list_head cmd_queue;
 381         struct pn533_cmd *cmd;
 382         u8 cmd_pending;
 383         struct mutex cmd_lock;  /* protects cmd queue */
 384
 385         void *cmd_complete_mi_arg;
 386         void *cmd_complete_dep_arg;
 387
 388         struct pn533_poll_modulations *poll_mod_active[PN533_POLL_MOD_MAX + 1];
 389         u8 poll_mod_count;
 390         u8 poll_mod_curr;
 391         u8 poll_dep;
 392         u32 poll_protocols;
 393         u32 listen_protocols;
 394         struct timer_list listen_timer;
 395         int cancel_listen;
 396
 397         u8 *gb;
 398         size_t gb_len;
 399
 400         u8 tgt_available_prots;
 401         u8 tgt_active_prot;
 402         u8 tgt_mode;
 403
 404         struct pn533_frame_ops *ops;
 405 };
 406
 407 struct pn533_cmd {
 408         struct list_head queue;
 409         u8 code;
 410         int status;
 411         struct sk_buff *req;
 412         struct sk_buff *resp;
 413         int resp_len;
 414         pn533_send_async_complete_t  complete_cb;
 415         void *complete_cb_context;
 416 };
 417
 418 struct pn533_std_frame {
 419         u8 preamble;
 420         __be16 start_frame;
 421         u8 datalen;
 422         u8 datalen_checksum;
 423         u8 data[];
 424 } __packed;
 425
 426 struct pn533_ext_frame {        /* Extended Information frame */
 427         u8 preamble;
 428         __be16 start_frame;
 429         __be16 eif_flag;        /* fixed to 0xFFFF */
 430         __be16 datalen;
 431         u8 datalen_checksum;
 432         u8 data[];
 433 } __packed;
 434
 435 struct pn533_frame_ops {
 436         void (*tx_frame_init)(void *frame, u8 cmd_code);
 437         void (*tx_frame_finish)(void *frame);
 438         void (*tx_update_payload_len)(void *frame, int len);
 439         int tx_header_len;
 440         int tx_tail_len;
 441
 442         bool (*rx_is_frame_valid)(void *frame, struct pn533 *dev);
 443         int (*rx_frame_size)(void *frame);
 444         int rx_header_len;
 445         int rx_tail_len;
 446
 447         int max_payload_len;
 448         u8 (*get_cmd_code)(void *frame);
 449 };
 450
 451 struct pn533_acr122_ccid_hdr {
 452         u8 type;
 453         u32 datalen;
 454         u8 slot;
 455         u8 seq;
 456         u8 params[3]; /* 3 msg specific bytes or status, error and 1 specific
 457                          byte for reposnse msg */
 458         u8 data[]; /* payload */
 459 } __packed;
 460
 461 struct pn533_acr122_apdu_hdr {
 462         u8 class;
 463         u8 ins;
 464         u8 p1;
 465         u8 p2;
 466 } __packed;
 467
 468 struct pn533_acr122_tx_frame {
 469         struct pn533_acr122_ccid_hdr ccid;
 470         struct pn533_acr122_apdu_hdr apdu;
 471         u8 datalen;
 472         u8 data[]; /* pn533 frame: TFI ... */
 473 } __packed;
 474
 475 struct pn533_acr122_rx_frame {
 476         struct pn533_acr122_ccid_hdr ccid;
 477         u8 data[]; /* pn533 frame : TFI ... */
 478 } __packed;
 479
 480 static void pn533_acr122_tx_frame_init(void *_frame, u8 cmd_code)
 481 {
 482         struct pn533_acr122_tx_frame *frame = _frame;
 483
 484         frame->ccid.type = PN533_ACR122_PC_TO_RDR_ESCAPE;
 485         frame->ccid.datalen = sizeof(frame->apdu) + 1; /* sizeof(apdu_hdr) +
 486                                                           sizeof(datalen) */
 487         frame->ccid.slot = 0;
 488         frame->ccid.seq = 0;
 489         frame->ccid.params[0] = 0;
 490         frame->ccid.params[1] = 0;
 491         frame->ccid.params[2] = 0;
 492
 493         frame->data[0] = PN533_STD_FRAME_DIR_OUT;
 494         frame->data[1] = cmd_code;
 495         frame->datalen = 2;  /* data[0] + data[1] */
 496
 497         frame->apdu.class = 0xFF;
 498         frame->apdu.ins = 0;
 499         frame->apdu.p1 = 0;
 500         frame->apdu.p2 = 0;
 501 }
 502
 503 static void pn533_acr122_tx_frame_finish(void *_frame)
 504 {
 505         struct pn533_acr122_tx_frame *frame = _frame;
 506
 507         frame->ccid.datalen += frame->datalen;
 508 }
 509
 510 static void pn533_acr122_tx_update_payload_len(void *_frame, int len)
 511 {
 512         struct pn533_acr122_tx_frame *frame = _frame;
 513
 514         frame->datalen += len;
 515 }
 516
 517 static bool pn533_acr122_is_rx_frame_valid(void *_frame, struct pn533 *dev)
 518 {
 519         struct pn533_acr122_rx_frame *frame = _frame;
 520
 521         if (frame->ccid.type != 0x83)
 522                 return false;
 523
 524         if (frame->data[frame->ccid.datalen - 2] == 0x63)
 525                 return false;
 526
 527         return true;
 528 }
 529
 530 static int pn533_acr122_rx_frame_size(void *frame)
 531 {
 532         struct pn533_acr122_rx_frame *f = frame;
 533
 534         /* f->ccid.datalen already includes tail length */
 535         return sizeof(struct pn533_acr122_rx_frame) + f->ccid.datalen;
 536 }
 537
 538 static u8 pn533_acr122_get_cmd_code(void *frame)
 539 {
 540         struct pn533_acr122_rx_frame *f = frame;
 541
 542         return PN533_FRAME_CMD(f);
 543 }
 544
 545 static struct pn533_frame_ops pn533_acr122_frame_ops = {
 546         .tx_frame_init = pn533_acr122_tx_frame_init,
 547         .tx_frame_finish = pn533_acr122_tx_frame_finish,
 548         .tx_update_payload_len = pn533_acr122_tx_update_payload_len,
 549         .tx_header_len = PN533_ACR122_TX_FRAME_HEADER_LEN,
 550         .tx_tail_len = PN533_ACR122_TX_FRAME_TAIL_LEN,
 551
 552         .rx_is_frame_valid = pn533_acr122_is_rx_frame_valid,
 553         .rx_header_len = PN533_ACR122_RX_FRAME_HEADER_LEN,
 554         .rx_tail_len = PN533_ACR122_RX_FRAME_TAIL_LEN,
 555         .rx_frame_size = pn533_acr122_rx_frame_size,
 556
 557         .max_payload_len = PN533_ACR122_FRAME_MAX_PAYLOAD_LEN,
 558         .get_cmd_code = pn533_acr122_get_cmd_code,
 559 };
 560
 561 /* The rule: value(high byte) + value(low byte) + checksum = 0 */
 562 static inline u8 pn533_ext_checksum(u16 value)
 563 {
 564         return ~(u8)(((value & 0xFF00) >> 8) + (u8)(value & 0xFF)) + 1;
 565 }
 566
 567 /* The rule: value + checksum = 0 */
 568 static inline u8 pn533_std_checksum(u8 value)
 569 {
 570         return ~value + 1;
 571 }
 572
 573 /* The rule: sum(data elements) + checksum = 0 */
 574 static u8 pn533_std_data_checksum(u8 *data, int datalen)
 575 {
 576         u8 sum = 0;
 577         int i;
 578
 579         for (i = 0; i < datalen; i++)
 580                 sum += data[i];
 581
 582         return pn533_std_checksum(sum);
 583 }
 584
 585 static void pn533_std_tx_frame_init(void *_frame, u8 cmd_code)
 586 {
 587         struct pn533_std_frame *frame = _frame;
 588
 589         frame->preamble = 0;
 590         frame->start_frame = cpu_to_be16(PN533_STD_FRAME_SOF);
 591         PN533_STD_FRAME_IDENTIFIER(frame) = PN533_STD_FRAME_DIR_OUT;
 592         PN533_FRAME_CMD(frame) = cmd_code;
 593         frame->datalen = 2;
 594 }
 595
 596 static void pn533_std_tx_frame_finish(void *_frame)
 597 {
 598         struct pn533_std_frame *frame = _frame;
 599
 600         frame->datalen_checksum = pn533_std_checksum(frame->datalen);
 601
 602         PN533_STD_FRAME_CHECKSUM(frame) =
 603                 pn533_std_data_checksum(frame->data, frame->datalen);
 604
 605         PN533_STD_FRAME_POSTAMBLE(frame) = 0;
 606 }
 607
 608 static void pn533_std_tx_update_payload_len(void *_frame, int len)
 609 {
 610         struct pn533_std_frame *frame = _frame;
 611
 612         frame->datalen += len;
 613 }
 614
 615 static bool pn533_std_rx_frame_is_valid(void *_frame, struct pn533 *dev)
 616 {
 617         u8 checksum;
 618         struct pn533_std_frame *stdf = _frame;
 619
 620         if (stdf->start_frame != cpu_to_be16(PN533_STD_FRAME_SOF))
 621                 return false;
 622
 623         if (likely(!PN533_STD_IS_EXTENDED(stdf))) {
 624                 /* Standard frame code */
 625                 dev->ops->rx_header_len = PN533_STD_FRAME_HEADER_LEN;
 626
 627                 checksum = pn533_std_checksum(stdf->datalen);
 628                 if (checksum != stdf->datalen_checksum)
 629                         return false;
 630
 631                 checksum = pn533_std_data_checksum(stdf->data, stdf->datalen);
 632                 if (checksum != PN533_STD_FRAME_CHECKSUM(stdf))
 633                         return false;
 634         } else {
 635                 /* Extended */
 636                 struct pn533_ext_frame *eif = _frame;
 637
 638                 dev->ops->rx_header_len = PN533_EXT_FRAME_HEADER_LEN;
 639
 640                 checksum = pn533_ext_checksum(be16_to_cpu(eif->datalen));
 641                 if (checksum != eif->datalen_checksum)
 642                         return false;
 643
 644                 /* check data checksum */
 645                 checksum = pn533_std_data_checksum(eif->data,
 646                                                    be16_to_cpu(eif->datalen));
 647                 if (checksum != PN533_EXT_FRAME_CHECKSUM(eif))
 648                         return false;
 649         }
 650
 651         return true;
 652 }
 653
 654 static bool pn533_std_rx_frame_is_ack(struct pn533_std_frame *frame)
 655 {
 656         if (frame->start_frame != cpu_to_be16(PN533_STD_FRAME_SOF))
 657                 return false;
 658
 659         if (frame->datalen != 0 || frame->datalen_checksum != 0xFF)
 660                 return false;
 661
 662         return true;
 663 }
 664
 665 static inline int pn533_std_rx_frame_size(void *frame)
 666 {
 667         struct pn533_std_frame *f = frame;
 668
 669         /* check for Extended Information frame */
 670         if (PN533_STD_IS_EXTENDED(f)) {
 671                 struct pn533_ext_frame *eif = frame;
 672
 673                 return sizeof(struct pn533_ext_frame)
 674                         + be16_to_cpu(eif->datalen) + PN533_STD_FRAME_TAIL_LEN;
 675         }
 676
 677         return sizeof(struct pn533_std_frame) + f->datalen +
 678                PN533_STD_FRAME_TAIL_LEN;
 679 }
 680
 681 static u8 pn533_std_get_cmd_code(void *frame)
 682 {
 683         struct pn533_std_frame *f = frame;
 684         struct pn533_ext_frame *eif = frame;
 685
 686         if (PN533_STD_IS_EXTENDED(f))
 687                 return PN533_FRAME_CMD(eif);
 688         else
 689                 return PN533_FRAME_CMD(f);
 690 }
 691
 692 static struct pn533_frame_ops pn533_std_frame_ops = {
 693         .tx_frame_init = pn533_std_tx_frame_init,
 694         .tx_frame_finish = pn533_std_tx_frame_finish,
 695         .tx_update_payload_len = pn533_std_tx_update_payload_len,
 696         .tx_header_len = PN533_STD_FRAME_HEADER_LEN,
 697         .tx_tail_len = PN533_STD_FRAME_TAIL_LEN,
 698
 699         .rx_is_frame_valid = pn533_std_rx_frame_is_valid,
 700         .rx_frame_size = pn533_std_rx_frame_size,
 701         .rx_header_len = PN533_STD_FRAME_HEADER_LEN,
 702         .rx_tail_len = PN533_STD_FRAME_TAIL_LEN,
 703
 704         .max_payload_len =  PN533_STD_FRAME_MAX_PAYLOAD_LEN,
 705         .get_cmd_code = pn533_std_get_cmd_code,
 706 };
 707
 708 static bool pn533_rx_frame_is_cmd_response(struct pn533 *dev, void *frame)
 709 {
 710         return (dev->ops->get_cmd_code(frame) ==
 711                                 PN533_CMD_RESPONSE(dev->cmd->code));
 712 }
 713
 714 static void pn533_recv_response(struct urb *urb)
 715 {
 716         struct pn533 *dev = urb->context;
 717         struct pn533_cmd *cmd = dev->cmd;
 718         u8 *in_frame;
 719
 720         cmd->status = urb->status;
 721
 722         switch (urb->status) {
 723         case 0:
 724                 break; /* success */
 725         case -ECONNRESET:
 726         case -ENOENT:
 727                 dev_dbg(&dev->interface->dev,
 728                         "The urb has been canceled (status %d)\n",
 729                         urb->status);
 730                 goto sched_wq;
 731         case -ESHUTDOWN:
 732         default:
 733                 nfc_err(&dev->interface->dev,
 734                         "Urb failure (status %d)\n", urb->status);
 735                 goto sched_wq;
 736         }
 737
 738         in_frame = dev->in_urb->transfer_buffer;
 739
 740         dev_dbg(&dev->interface->dev, "Received a frame\n");
 741         print_hex_dump_debug("PN533 RX: ", DUMP_PREFIX_NONE, 16, 1, in_frame,
 742                              dev->ops->rx_frame_size(in_frame), false);
 743
 744         if (!dev->ops->rx_is_frame_valid(in_frame, dev)) {
 745                 nfc_err(&dev->interface->dev, "Received an invalid frame\n");
 746                 cmd->status = -EIO;
 747                 goto sched_wq;
 748         }
 749
 750         if (!pn533_rx_frame_is_cmd_response(dev, in_frame)) {
 751                 nfc_err(&dev->interface->dev,
 752                         "It it not the response to the last command\n");
 753                 cmd->status = -EIO;
 754                 goto sched_wq;
 755         }
 756
 757 sched_wq:
 758         queue_work(dev->wq, &dev->cmd_complete_work);
 759 }
 760
 761 static int pn533_submit_urb_for_response(struct pn533 *dev, gfp_t flags)
 762 {
 763         dev->in_urb->complete = pn533_recv_response;
 764
 765         return usb_submit_urb(dev->in_urb, flags);
 766 }
 767
 768 static void pn533_recv_ack(struct urb *urb)
 769 {
 770         struct pn533 *dev = urb->context;
 771         struct pn533_cmd *cmd = dev->cmd;
 772         struct pn533_std_frame *in_frame;
 773         int rc;
 774
 775         cmd->status = urb->status;
 776
 777         switch (urb->status) {
 778         case 0:
 779                 break; /* success */
 780         case -ECONNRESET:
 781         case -ENOENT:
 782                 dev_dbg(&dev->interface->dev,
 783                         "The urb has been stopped (status %d)\n",
 784                         urb->status);
 785                 goto sched_wq;
 786         case -ESHUTDOWN:
 787         default:
 788                 nfc_err(&dev->interface->dev,
 789                         "Urb failure (status %d)\n", urb->status);
 790                 goto sched_wq;
 791         }
 792
 793         in_frame = dev->in_urb->transfer_buffer;
 794
 795         if (!pn533_std_rx_frame_is_ack(in_frame)) {
 796                 nfc_err(&dev->interface->dev, "Received an invalid ack\n");
 797                 cmd->status = -EIO;
 798                 goto sched_wq;
 799         }
 800
 801         rc = pn533_submit_urb_for_response(dev, GFP_ATOMIC);
 802         if (rc) {
 803                 nfc_err(&dev->interface->dev,
 804                         "usb_submit_urb failed with result %d\n", rc);
 805                 cmd->status = rc;
 806                 goto sched_wq;
 807         }
 808
 809         return;
 810
 811 sched_wq:
 812         queue_work(dev->wq, &dev->cmd_complete_work);
 813 }
 814
 815 static int pn533_submit_urb_for_ack(struct pn533 *dev, gfp_t flags)
 816 {
 817         dev->in_urb->complete = pn533_recv_ack;
 818
 819         return usb_submit_urb(dev->in_urb, flags);
 820 }
 821
 822 static int pn533_send_ack(struct pn533 *dev, gfp_t flags)
 823 {
 824         u8 ack[PN533_STD_FRAME_ACK_SIZE] = {0x00, 0x00, 0xff, 0x00, 0xff, 0x00};
 825         /* spec 7.1.1.3:  Preamble, SoPC (2), ACK Code (2), Postamble */
 826         int rc;
 827
 828         dev->out_urb->transfer_buffer = ack;
 829         dev->out_urb->transfer_buffer_length = sizeof(ack);
 830         rc = usb_submit_urb(dev->out_urb, flags);
 831
 832         return rc;
 833 }
 834
 835 static int __pn533_send_frame_async(struct pn533 *dev,
 836                                         struct sk_buff *out,
 837                                         struct sk_buff *in,
 838                                         int in_len)
 839 {
 840         int rc;
 841
 842         dev->out_urb->transfer_buffer = out->data;
 843         dev->out_urb->transfer_buffer_length = out->len;
 844
 845         dev->in_urb->transfer_buffer = in->data;
 846         dev->in_urb->transfer_buffer_length = in_len;
 847
 848         print_hex_dump_debug("PN533 TX: ", DUMP_PREFIX_NONE, 16, 1,
 849                              out->data, out->len, false);
 850
 851         rc = usb_submit_urb(dev->out_urb, GFP_KERNEL);
 852         if (rc)
 853                 return rc;
 854
 855         if (dev->protocol_type == PN533_PROTO_REQ_RESP) {
 856                 /* request for response for sent packet directly */
 857                 rc = pn533_submit_urb_for_response(dev, GFP_ATOMIC);
 858                 if (rc)
 859                         goto error;
 860         } else if (dev->protocol_type == PN533_PROTO_REQ_ACK_RESP) {
 861                 /* request for ACK if that's the case */
 862                 rc = pn533_submit_urb_for_ack(dev, GFP_KERNEL);
 863                 if (rc)
 864                         goto error;
 865         }
 866
 867         return 0;
 868
 869 error:
 870         usb_unlink_urb(dev->out_urb);
 871         return rc;
 872 }
 873
 874 static void pn533_build_cmd_frame(struct pn533 *dev, u8 cmd_code,
 875                                   struct sk_buff *skb)
 876 {
 877         /* payload is already there, just update datalen */
 878         int payload_len = skb->len;
 879         struct pn533_frame_ops *ops = dev->ops;
 880
 881
 882         skb_push(skb, ops->tx_header_len);
 883         skb_put(skb, ops->tx_tail_len);
 884
 885         ops->tx_frame_init(skb->data, cmd_code);
 886         ops->tx_update_payload_len(skb->data, payload_len);
 887         ops->tx_frame_finish(skb->data);
 888 }
 889
 890 static int pn533_send_async_complete(struct pn533 *dev)
 891 {
 892         struct pn533_cmd *cmd = dev->cmd;
 893         int status = cmd->status;
 894
 895         struct sk_buff *req = cmd->req;
 896         struct sk_buff *resp = cmd->resp;
 897
 898         int rc;
 899
 900         dev_kfree_skb(req);
 901
 902         if (status < 0) {
 903                 rc = cmd->complete_cb(dev, cmd->complete_cb_context,
 904                                       ERR_PTR(status));
 905                 dev_kfree_skb(resp);
 906                 goto done;
 907         }
 908
 909         skb_put(resp, dev->ops->rx_frame_size(resp->data));
 910         skb_pull(resp, dev->ops->rx_header_len);
 911         skb_trim(resp, resp->len - dev->ops->rx_tail_len);
 912
 913         rc = cmd->complete_cb(dev, cmd->complete_cb_context, resp);
 914
 915 done:
 916         kfree(cmd);
 917         dev->cmd = NULL;
 918         return rc;
 919 }
 920
 921 static int __pn533_send_async(struct pn533 *dev, u8 cmd_code,
 922                               struct sk_buff *req, struct sk_buff *resp,
 923                               int resp_len,
 924                               pn533_send_async_complete_t complete_cb,
 925                               void *complete_cb_context)
 926 {
 927         struct pn533_cmd *cmd;
 928         int rc = 0;
 929
 930         dev_dbg(&dev->interface->dev, "Sending command 0x%x\n", cmd_code);
 931
 932         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
 933         if (!cmd)
 934                 return -ENOMEM;
 935
 936         cmd->code = cmd_code;
 937         cmd->req = req;
 938         cmd->resp = resp;
 939         cmd->resp_len = resp_len;
 940         cmd->complete_cb = complete_cb;
 941         cmd->complete_cb_context = complete_cb_context;
 942
 943         pn533_build_cmd_frame(dev, cmd_code, req);
 944
 945         mutex_lock(&dev->cmd_lock);
 946
 947         if (!dev->cmd_pending) {
 948                 rc = __pn533_send_frame_async(dev, req, resp, resp_len);
 949                 if (rc)
 950                         goto error;
 951
 952                 dev->cmd_pending = 1;
 953                 dev->cmd = cmd;
 954                 goto unlock;
 955         }
 956
 957         dev_dbg(&dev->interface->dev, "%s Queueing command 0x%x\n",
 958                 __func__, cmd_code);
 959
 960         INIT_LIST_HEAD(&cmd->queue);
 961         list_add_tail(&cmd->queue, &dev->cmd_queue);
 962
 963         goto unlock;
 964
 965 error:
 966         kfree(cmd);
 967 unlock:
 968         mutex_unlock(&dev->cmd_lock);
 969         return rc;
 970 }
 971
 972 static int pn533_send_data_async(struct pn533 *dev, u8 cmd_code,
 973                                  struct sk_buff *req,
 974                                  pn533_send_async_complete_t complete_cb,
 975                                  void *complete_cb_context)
 976 {
 977         struct sk_buff *resp;
 978         int rc;
 979         int  resp_len = dev->ops->rx_header_len +
 980                         dev->ops->max_payload_len +
 981                         dev->ops->rx_tail_len;
 982
 983         resp = nfc_alloc_recv_skb(resp_len, GFP_KERNEL);
 984         if (!resp)
 985                 return -ENOMEM;
 986
 987         rc = __pn533_send_async(dev, cmd_code, req, resp, resp_len, complete_cb,
 988                                 complete_cb_context);
 989         if (rc)
 990                 dev_kfree_skb(resp);
 991
 992         return rc;
 993 }
 994
 995 static int pn533_send_cmd_async(struct pn533 *dev, u8 cmd_code,
 996                                 struct sk_buff *req,
 997                                 pn533_send_async_complete_t complete_cb,
 998                                 void *complete_cb_context)
 999 {
1000         struct sk_buff *resp;
1001         int rc;
1002         int  resp_len = dev->ops->rx_header_len +
1003                         dev->ops->max_payload_len +
1004                         dev->ops->rx_tail_len;
1005
1006         resp = alloc_skb(resp_len, GFP_KERNEL);
1007         if (!resp)
1008                 return -ENOMEM;
1009
1010         rc = __pn533_send_async(dev, cmd_code, req, resp, resp_len, complete_cb,
1011                                 complete_cb_context);
1012         if (rc)
1013                 dev_kfree_skb(resp);
1014
1015         return rc;
1016 }
1017
1018 /*
1019  * pn533_send_cmd_direct_async
1020  *
1021  * The function sends a piority cmd directly to the chip omiting the cmd
1022  * queue. It's intended to be used by chaining mechanism of received responses
1023  * where the host has to request every single chunk of data before scheduling
1024  * next cmd from the queue.
1025  */
1026 static int pn533_send_cmd_direct_async(struct pn533 *dev, u8 cmd_code,
1027                                        struct sk_buff *req,
1028                                        pn533_send_async_complete_t complete_cb,
1029                                        void *complete_cb_context)
1030 {
1031         struct sk_buff *resp;
1032         struct pn533_cmd *cmd;
1033         int rc;
1034         int resp_len = dev->ops->rx_header_len +
1035                        dev->ops->max_payload_len +
1036                        dev->ops->rx_tail_len;
1037
1038         resp = alloc_skb(resp_len, GFP_KERNEL);
1039         if (!resp)
1040                 return -ENOMEM;
1041
1042         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
1043         if (!cmd) {
1044                 dev_kfree_skb(resp);
1045                 return -ENOMEM;
1046         }
1047
1048         cmd->code = cmd_code;
1049         cmd->req = req;
1050         cmd->resp = resp;
1051         cmd->resp_len = resp_len;
1052         cmd->complete_cb = complete_cb;
1053         cmd->complete_cb_context = complete_cb_context;
1054
1055         pn533_build_cmd_frame(dev, cmd_code, req);
1056
1057         rc = __pn533_send_frame_async(dev, req, resp, resp_len);
1058         if (rc < 0) {
1059                 dev_kfree_skb(resp);
1060                 kfree(cmd);
1061         } else {
1062                 dev->cmd = cmd;
1063         }
1064
1065         return rc;
1066 }
1067
1068 static void pn533_wq_cmd_complete(struct work_struct *work)
1069 {
1070         struct pn533 *dev = container_of(work, struct pn533, cmd_complete_work);
1071         int rc;
1072
1073         rc = pn533_send_async_complete(dev);
1074         if (rc != -EINPROGRESS)
1075                 queue_work(dev->wq, &dev->cmd_work);
1076 }
1077
1078 static void pn533_wq_cmd(struct work_struct *work)
1079 {
1080         struct pn533 *dev = container_of(work, struct pn533, cmd_work);
1081         struct pn533_cmd *cmd;
1082         int rc;
1083
1084         mutex_lock(&dev->cmd_lock);
1085
1086         if (list_empty(&dev->cmd_queue)) {
1087                 dev->cmd_pending = 0;
1088                 mutex_unlock(&dev->cmd_lock);
1089                 return;
1090         }
1091
1092         cmd = list_first_entry(&dev->cmd_queue, struct pn533_cmd, queue);
1093
1094         list_del(&cmd->queue);
1095
1096         mutex_unlock(&dev->cmd_lock);
1097
1098         rc = __pn533_send_frame_async(dev, cmd->req, cmd->resp, cmd->resp_len);
1099         if (rc < 0) {
1100                 dev_kfree_skb(cmd->req);
1101                 dev_kfree_skb(cmd->resp);
1102                 kfree(cmd);
1103                 return;
1104         }
1105
1106         dev->cmd = cmd;
1107 }
1108
1109 struct pn533_sync_cmd_response {
1110         struct sk_buff *resp;
1111         struct completion done;
1112 };
1113
1114 static int pn533_send_sync_complete(struct pn533 *dev, void *_arg,
1115                                     struct sk_buff *resp)
1116 {
1117         struct pn533_sync_cmd_response *arg = _arg;
1118
1119         arg->resp = resp;
1120         complete(&arg->done);
1121
1122         return 0;
1123 }
1124
1125 /*  pn533_send_cmd_sync
1126  *
1127  *  Please note the req parameter is freed inside the function to
1128  *  limit a number of return value interpretations by the caller.
1129  *
1130  *  1. negative in case of error during TX path -> req should be freed
1131  *
1132  *  2. negative in case of error during RX path -> req should not be freed
1133  *     as it's been already freed at the begining of RX path by
1134  *     async_complete_cb.
1135  *
1136  *  3. valid pointer in case of succesfult RX path
1137  *
1138  *  A caller has to check a return value with IS_ERR macro. If the test pass,
1139  *  the returned pointer is valid.
1140  *
1141  * */
1142 static struct sk_buff *pn533_send_cmd_sync(struct pn533 *dev, u8 cmd_code,
1143                                                struct sk_buff *req)
1144 {
1145         int rc;
1146         struct pn533_sync_cmd_response arg;
1147
1148         init_completion(&arg.done);
1149
1150         rc = pn533_send_cmd_async(dev, cmd_code, req,
1151                                   pn533_send_sync_complete, &arg);
1152         if (rc) {
1153                 dev_kfree_skb(req);
1154                 return ERR_PTR(rc);
1155         }
1156
1157         wait_for_completion(&arg.done);
1158
1159         return arg.resp;
1160 }
1161
1162 static void pn533_send_complete(struct urb *urb)
1163 {
1164         struct pn533 *dev = urb->context;
1165
1166         switch (urb->status) {
1167         case 0:
1168                 break; /* success */
1169         case -ECONNRESET:
1170         case -ENOENT:
1171                 dev_dbg(&dev->interface->dev,
1172                         "The urb has been stopped (status %d)\n",
1173                         urb->status);
1174                 break;
1175         case -ESHUTDOWN:
1176         default:
1177                 nfc_err(&dev->interface->dev, "Urb failure (status %d)\n",
1178                         urb->status);
1179         }
1180 }
1181
1182 static void pn533_abort_cmd(struct pn533 *dev, gfp_t flags)
1183 {
1184         /* ACR122U does not support any command which aborts last
1185          * issued command i.e. as ACK for standard PN533. Additionally,
1186          * it behaves stange, sending broken or incorrect responses,
1187          * when we cancel urb before the chip will send response.
1188          */
1189         if (dev->device_type == PN533_DEVICE_ACR122U)
1190                 return;
1191
1192         /* An ack will cancel the last issued command */
1193         pn533_send_ack(dev, flags);
1194
1195         /* cancel the urb request */
1196         usb_kill_urb(dev->in_urb);
1197 }
1198
1199 static struct sk_buff *pn533_alloc_skb(struct pn533 *dev, unsigned int size)
1200 {
1201         struct sk_buff *skb;
1202
1203         skb = alloc_skb(dev->ops->tx_header_len +
1204                         size +
1205                         dev->ops->tx_tail_len, GFP_KERNEL);
1206
1207         if (skb)
1208                 skb_reserve(skb, dev->ops->tx_header_len);
1209
1210         return skb;
1211 }
1212
1213 struct pn533_target_type_a {
1214         __be16 sens_res;
1215         u8 sel_res;
1216         u8 nfcid_len;
1217         u8 nfcid_data[];
1218 } __packed;
1219
1220
1221 #define PN533_TYPE_A_SENS_RES_NFCID1(x) ((u8)((be16_to_cpu(x) & 0x00C0) >> 6))
1222 #define PN533_TYPE_A_SENS_RES_SSD(x) ((u8)((be16_to_cpu(x) & 0x001F) >> 0))
1223 #define PN533_TYPE_A_SENS_RES_PLATCONF(x) ((u8)((be16_to_cpu(x) & 0x0F00) >> 8))
1224
1225 #define PN533_TYPE_A_SENS_RES_SSD_JEWEL 0x00
1226 #define PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL 0x0C
1227
1228 #define PN533_TYPE_A_SEL_PROT(x) (((x) & 0x60) >> 5)
1229 #define PN533_TYPE_A_SEL_CASCADE(x) (((x) & 0x04) >> 2)
1230
1231 #define PN533_TYPE_A_SEL_PROT_MIFARE 0
1232 #define PN533_TYPE_A_SEL_PROT_ISO14443 1
1233 #define PN533_TYPE_A_SEL_PROT_DEP 2
1234 #define PN533_TYPE_A_SEL_PROT_ISO14443_DEP 3
1235
1236 static bool pn533_target_type_a_is_valid(struct pn533_target_type_a *type_a,
1237                                                         int target_data_len)
1238 {
1239         u8 ssd;
1240         u8 platconf;
1241
1242         if (target_data_len < sizeof(struct pn533_target_type_a))
1243                 return false;
1244
1245         /* The lenght check of nfcid[] and ats[] are not being performed because
1246            the values are not being used */
1247
1248         /* Requirement 4.6.3.3 from NFC Forum Digital Spec */
1249         ssd = PN533_TYPE_A_SENS_RES_SSD(type_a->sens_res);
1250         platconf = PN533_TYPE_A_SENS_RES_PLATCONF(type_a->sens_res);
1251
1252         if ((ssd == PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
1253              platconf != PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL) ||
1254             (ssd != PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
1255              platconf == PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL))
1256                 return false;
1257
1258         /* Requirements 4.8.2.1, 4.8.2.3, 4.8.2.5 and 4.8.2.7 from NFC Forum */
1259         if (PN533_TYPE_A_SEL_CASCADE(type_a->sel_res) != 0)
1260                 return false;
1261
1262         return true;
1263 }
1264
1265 static int pn533_target_found_type_a(struct nfc_target *nfc_tgt, u8 *tgt_data,
1266                                                         int tgt_data_len)
1267 {
1268         struct pn533_target_type_a *tgt_type_a;
1269
1270         tgt_type_a = (struct pn533_target_type_a *)tgt_data;
1271
1272         if (!pn533_target_type_a_is_valid(tgt_type_a, tgt_data_len))
1273                 return -EPROTO;
1274
1275         switch (PN533_TYPE_A_SEL_PROT(tgt_type_a->sel_res)) {
1276         case PN533_TYPE_A_SEL_PROT_MIFARE:
1277                 nfc_tgt->supported_protocols = NFC_PROTO_MIFARE_MASK;
1278                 break;
1279         case PN533_TYPE_A_SEL_PROT_ISO14443:
1280                 nfc_tgt->supported_protocols = NFC_PROTO_ISO14443_MASK;
1281                 break;
1282         case PN533_TYPE_A_SEL_PROT_DEP:
1283                 nfc_tgt->supported_protocols = NFC_PROTO_NFC_DEP_MASK;
1284                 break;
1285         case PN533_TYPE_A_SEL_PROT_ISO14443_DEP:
1286                 nfc_tgt->supported_protocols = NFC_PROTO_ISO14443_MASK |
1287                                                         NFC_PROTO_NFC_DEP_MASK;
1288                 break;
1289         }
1290
1291         nfc_tgt->sens_res = be16_to_cpu(tgt_type_a->sens_res);
1292         nfc_tgt->sel_res = tgt_type_a->sel_res;
1293         nfc_tgt->nfcid1_len = tgt_type_a->nfcid_len;
1294         memcpy(nfc_tgt->nfcid1, tgt_type_a->nfcid_data, nfc_tgt->nfcid1_len);
1295
1296         return 0;
1297 }
1298
1299 struct pn533_target_felica {
1300         u8 pol_res;
1301         u8 opcode;
1302         u8 nfcid2[NFC_NFCID2_MAXSIZE];
1303         u8 pad[8];
1304         /* optional */
1305         u8 syst_code[];
1306 } __packed;
1307
1308 #define PN533_FELICA_SENSF_NFCID2_DEP_B1 0x01
1309 #define PN533_FELICA_SENSF_NFCID2_DEP_B2 0xFE
1310
1311 static bool pn533_target_felica_is_valid(struct pn533_target_felica *felica,
1312                                                         int target_data_len)
1313 {
1314         if (target_data_len < sizeof(struct pn533_target_felica))
1315                 return false;
1316
1317         if (felica->opcode != PN533_FELICA_OPC_SENSF_RES)
1318                 return false;
1319
1320         return true;
1321 }
1322
1323 static int pn533_target_found_felica(struct nfc_target *nfc_tgt, u8 *tgt_data,
1324                                                         int tgt_data_len)
1325 {
1326         struct pn533_target_felica *tgt_felica;
1327
1328         tgt_felica = (struct pn533_target_felica *)tgt_data;
1329
1330         if (!pn533_target_felica_is_valid(tgt_felica, tgt_data_len))
1331                 return -EPROTO;
1332
1333         if ((tgt_felica->nfcid2[0] == PN533_FELICA_SENSF_NFCID2_DEP_B1) &&
1334             (tgt_felica->nfcid2[1] == PN533_FELICA_SENSF_NFCID2_DEP_B2))
1335                 nfc_tgt->supported_protocols = NFC_PROTO_NFC_DEP_MASK;
1336         else
1337                 nfc_tgt->supported_protocols = NFC_PROTO_FELICA_MASK;
1338
1339         memcpy(nfc_tgt->sensf_res, &tgt_felica->opcode, 9);
1340         nfc_tgt->sensf_res_len = 9;
1341
1342         memcpy(nfc_tgt->nfcid2, tgt_felica->nfcid2, NFC_NFCID2_MAXSIZE);
1343         nfc_tgt->nfcid2_len = NFC_NFCID2_MAXSIZE;
1344
1345         return 0;
1346 }
1347
1348 struct pn533_target_jewel {
1349         __be16 sens_res;
1350         u8 jewelid[4];
1351 } __packed;
1352
1353 static bool pn533_target_jewel_is_valid(struct pn533_target_jewel *jewel,
1354                                                         int target_data_len)
1355 {
1356         u8 ssd;
1357         u8 platconf;
1358
1359         if (target_data_len < sizeof(struct pn533_target_jewel))
1360                 return false;
1361
1362         /* Requirement 4.6.3.3 from NFC Forum Digital Spec */
1363         ssd = PN533_TYPE_A_SENS_RES_SSD(jewel->sens_res);
1364         platconf = PN533_TYPE_A_SENS_RES_PLATCONF(jewel->sens_res);
1365
1366         if ((ssd == PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
1367              platconf != PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL) ||
1368             (ssd != PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
1369              platconf == PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL))
1370                 return false;
1371
1372         return true;
1373 }
1374
1375 static int pn533_target_found_jewel(struct nfc_target *nfc_tgt, u8 *tgt_data,
1376                                                         int tgt_data_len)
1377 {
1378         struct pn533_target_jewel *tgt_jewel;
1379
1380         tgt_jewel = (struct pn533_target_jewel *)tgt_data;
1381
1382         if (!pn533_target_jewel_is_valid(tgt_jewel, tgt_data_len))
1383                 return -EPROTO;
1384
1385         nfc_tgt->supported_protocols = NFC_PROTO_JEWEL_MASK;
1386         nfc_tgt->sens_res = be16_to_cpu(tgt_jewel->sens_res);
1387         nfc_tgt->nfcid1_len = 4;
1388         memcpy(nfc_tgt->nfcid1, tgt_jewel->jewelid, nfc_tgt->nfcid1_len);
1389
1390         return 0;
1391 }
1392
1393 struct pn533_type_b_prot_info {
1394         u8 bitrate;
1395         u8 fsci_type;
1396         u8 fwi_adc_fo;
1397 } __packed;
1398
1399 #define PN533_TYPE_B_PROT_FCSI(x) (((x) & 0xF0) >> 4)
1400 #define PN533_TYPE_B_PROT_TYPE(x) (((x) & 0x0F) >> 0)
1401 #define PN533_TYPE_B_PROT_TYPE_RFU_MASK 0x8
1402
1403 struct pn533_type_b_sens_res {
1404         u8 opcode;
1405         u8 nfcid[4];
1406         u8 appdata[4];
1407         struct pn533_type_b_prot_info prot_info;
1408 } __packed;
1409
1410 #define PN533_TYPE_B_OPC_SENSB_RES 0x50
1411
1412 struct pn533_target_type_b {
1413         struct pn533_type_b_sens_res sensb_res;
1414         u8 attrib_res_len;
1415         u8 attrib_res[];
1416 } __packed;
1417
1418 static bool pn533_target_type_b_is_valid(struct pn533_target_type_b *type_b,
1419                                                         int target_data_len)
1420 {
1421         if (target_data_len < sizeof(struct pn533_target_type_b))
1422                 return false;
1423
1424         if (type_b->sensb_res.opcode != PN533_TYPE_B_OPC_SENSB_RES)
1425                 return false;
1426
1427         if (PN533_TYPE_B_PROT_TYPE(type_b->sensb_res.prot_info.fsci_type) &
1428                                                 PN533_TYPE_B_PROT_TYPE_RFU_MASK)
1429                 return false;
1430
1431         return true;
1432 }
1433
1434 static int pn533_target_found_type_b(struct nfc_target *nfc_tgt, u8 *tgt_data,
1435                                                         int tgt_data_len)
1436 {
1437         struct pn533_target_type_b *tgt_type_b;
1438
1439         tgt_type_b = (struct pn533_target_type_b *)tgt_data;
1440
1441         if (!pn533_target_type_b_is_valid(tgt_type_b, tgt_data_len))
1442                 return -EPROTO;
1443
1444         nfc_tgt->supported_protocols = NFC_PROTO_ISO14443_B_MASK;
1445
1446         return 0;
1447 }
1448
1449 static int pn533_target_found(struct pn533 *dev, u8 tg, u8 *tgdata,
1450                               int tgdata_len)
1451 {
1452         struct nfc_target nfc_tgt;
1453         int rc;
1454
1455         dev_dbg(&dev->interface->dev, "%s: modulation=%d\n",
1456                 __func__, dev->poll_mod_curr);
1457
1458         if (tg != 1)
1459                 return -EPROTO;
1460
1461         memset(&nfc_tgt, 0, sizeof(struct nfc_target));
1462
1463         switch (dev->poll_mod_curr) {
1464         case PN533_POLL_MOD_106KBPS_A:
1465                 rc = pn533_target_found_type_a(&nfc_tgt, tgdata, tgdata_len);
1466                 break;
1467         case PN533_POLL_MOD_212KBPS_FELICA:
1468         case PN533_POLL_MOD_424KBPS_FELICA:
1469                 rc = pn533_target_found_felica(&nfc_tgt, tgdata, tgdata_len);
1470                 break;
1471         case PN533_POLL_MOD_106KBPS_JEWEL:
1472                 rc = pn533_target_found_jewel(&nfc_tgt, tgdata, tgdata_len);
1473                 break;
1474         case PN533_POLL_MOD_847KBPS_B:
1475                 rc = pn533_target_found_type_b(&nfc_tgt, tgdata, tgdata_len);
1476                 break;
1477         default:
1478                 nfc_err(&dev->interface->dev,
1479                         "Unknown current poll modulation\n");
1480                 return -EPROTO;
1481         }
1482
1483         if (rc)
1484                 return rc;
1485
1486         if (!(nfc_tgt.supported_protocols & dev->poll_protocols)) {
1487                 dev_dbg(&dev->interface->dev,
1488                         "The Tg found doesn't have the desired protocol\n");
1489                 return -EAGAIN;
1490         }
1491
1492         dev_dbg(&dev->interface->dev,
1493                 "Target found - supported protocols: 0x%x\n",
1494                 nfc_tgt.supported_protocols);
1495
1496         dev->tgt_available_prots = nfc_tgt.supported_protocols;
1497
1498         nfc_targets_found(dev->nfc_dev, &nfc_tgt, 1);
1499
1500         return 0;
1501 }
1502
1503 static inline void pn533_poll_next_mod(struct pn533 *dev)
1504 {
1505         dev->poll_mod_curr = (dev->poll_mod_curr + 1) % dev->poll_mod_count;
1506 }
1507
1508 static void pn533_poll_reset_mod_list(struct pn533 *dev)
1509 {
1510         dev->poll_mod_count = 0;
1511 }
1512
1513 static void pn533_poll_add_mod(struct pn533 *dev, u8 mod_index)
1514 {
1515         dev->poll_mod_active[dev->poll_mod_count] =
1516                 (struct pn533_poll_modulations *)&poll_mod[mod_index];
1517         dev->poll_mod_count++;
1518 }
1519
1520 static void pn533_poll_create_mod_list(struct pn533 *dev,
1521                                        u32 im_protocols, u32 tm_protocols)
1522 {
1523         pn533_poll_reset_mod_list(dev);
1524
1525         if ((im_protocols & NFC_PROTO_MIFARE_MASK) ||
1526             (im_protocols & NFC_PROTO_ISO14443_MASK) ||
1527             (im_protocols & NFC_PROTO_NFC_DEP_MASK))
1528                 pn533_poll_add_mod(dev, PN533_POLL_MOD_106KBPS_A);
1529
1530         if (im_protocols & NFC_PROTO_FELICA_MASK ||
1531             im_protocols & NFC_PROTO_NFC_DEP_MASK) {
1532                 pn533_poll_add_mod(dev, PN533_POLL_MOD_212KBPS_FELICA);
1533                 pn533_poll_add_mod(dev, PN533_POLL_MOD_424KBPS_FELICA);
1534         }
1535
1536         if (im_protocols & NFC_PROTO_JEWEL_MASK)
1537                 pn533_poll_add_mod(dev, PN533_POLL_MOD_106KBPS_JEWEL);
1538
1539         if (im_protocols & NFC_PROTO_ISO14443_B_MASK)
1540                 pn533_poll_add_mod(dev, PN533_POLL_MOD_847KBPS_B);
1541
1542         if (tm_protocols)
1543                 pn533_poll_add_mod(dev, PN533_LISTEN_MOD);
1544 }
1545
1546 static int pn533_start_poll_complete(struct pn533 *dev, struct sk_buff *resp)
1547 {
1548         u8 nbtg, tg, *tgdata;
1549         int rc, tgdata_len;
1550
1551         /* Toggle the DEP polling */
1552         dev->poll_dep = 1;
1553
1554         nbtg = resp->data[0];
1555         tg = resp->data[1];
1556         tgdata = &resp->data[2];
1557         tgdata_len = resp->len - 2;  /* nbtg + tg */
1558
1559         if (nbtg) {
1560                 rc = pn533_target_found(dev, tg, tgdata, tgdata_len);
1561
1562                 /* We must stop the poll after a valid target found */
1563                 if (rc == 0) {
1564                         pn533_poll_reset_mod_list(dev);
1565                         return 0;
1566                 }
1567         }
1568
1569         return -EAGAIN;
1570 }
1571
1572 static struct sk_buff *pn533_alloc_poll_tg_frame(struct pn533 *dev)
1573 {
1574         struct sk_buff *skb;
1575         u8 *felica, *nfcid3, *gb;
1576
1577         u8 *gbytes = dev->gb;
1578         size_t gbytes_len = dev->gb_len;
1579
1580         u8 felica_params[18] = {0x1, 0xfe, /* DEP */
1581                                 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, /* random */
1582                                 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
1583                                 0xff, 0xff}; /* System code */
1584
1585         u8 mifare_params[6] = {0x1, 0x1, /* SENS_RES */
1586                                0x0, 0x0, 0x0,
1587                                0x40}; /* SEL_RES for DEP */
1588
1589         unsigned int skb_len = 36 + /* mode (1), mifare (6),
1590                                        felica (18), nfcid3 (10), gb_len (1) */
1591                                gbytes_len +
1592                                1;  /* len Tk*/
1593
1594         skb = pn533_alloc_skb(dev, skb_len);
1595         if (!skb)
1596                 return NULL;
1597
1598         /* DEP support only */
1599         *skb_put(skb, 1) = PN533_INIT_TARGET_DEP;
1600
1601         /* MIFARE params */
1602         memcpy(skb_put(skb, 6), mifare_params, 6);
1603
1604         /* Felica params */
1605         felica = skb_put(skb, 18);
1606         memcpy(felica, felica_params, 18);
1607         get_random_bytes(felica + 2, 6);
1608
1609         /* NFCID3 */
1610         nfcid3 = skb_put(skb, 10);
1611         memset(nfcid3, 0, 10);
1612         memcpy(nfcid3, felica, 8);
1613
1614         /* General bytes */
1615         *skb_put(skb, 1) = gbytes_len;
1616
1617         gb = skb_put(skb, gbytes_len);
1618         memcpy(gb, gbytes, gbytes_len);
1619
1620         /* Len Tk */
1621         *skb_put(skb, 1) = 0;
1622
1623         return skb;
1624 }
1625
1626 #define PN533_CMD_DATAEXCH_HEAD_LEN 1
1627 #define PN533_CMD_DATAEXCH_DATA_MAXLEN 262
1628 static void pn533_wq_tm_mi_recv(struct work_struct *work);
1629 static struct sk_buff *pn533_build_response(struct pn533 *dev);
1630
1631 static int pn533_tm_get_data_complete(struct pn533 *dev, void *arg,
1632                                       struct sk_buff *resp)
1633 {
1634         struct sk_buff *skb;
1635         u8 status, ret, mi;
1636         int rc;
1637
1638         dev_dbg(&dev->interface->dev, "%s\n", __func__);
1639
1640         if (IS_ERR(resp)) {
1641                 skb_queue_purge(&dev->resp_q);
1642                 return PTR_ERR(resp);
1643         }
1644
1645         status = resp->data[0];
1646
1647         ret = status & PN533_CMD_RET_MASK;
1648         mi = status & PN533_CMD_MI_MASK;
1649
1650         skb_pull(resp, sizeof(status));
1651
1652         if (ret != PN533_CMD_RET_SUCCESS) {
1653                 rc = -EIO;
1654                 goto error;
1655         }
1656
1657         skb_queue_tail(&dev->resp_q, resp);
1658
1659         if (mi) {
1660                 queue_work(dev->wq, &dev->mi_tm_rx_work);
1661                 return -EINPROGRESS;
1662         }
1663
1664         skb = pn533_build_response(dev);
1665         if (!skb) {
1666                 rc = -EIO;
1667                 goto error;
1668         }
1669
1670         return nfc_tm_data_received(dev->nfc_dev, skb);
1671
1672 error:
1673         nfc_tm_deactivated(dev->nfc_dev);
1674         dev->tgt_mode = 0;
1675         skb_queue_purge(&dev->resp_q);
1676         dev_kfree_skb(resp);
1677
1678         return rc;
1679 }
1680
1681 static void pn533_wq_tm_mi_recv(struct work_struct *work)
1682 {
1683         struct pn533 *dev = container_of(work, struct pn533, mi_tm_rx_work);
1684         struct sk_buff *skb;
1685         int rc;
1686
1687         dev_dbg(&dev->interface->dev, "%s\n", __func__);
1688
1689         skb = pn533_alloc_skb(dev, 0);
1690         if (!skb)
1691                 return;
1692
1693         rc = pn533_send_cmd_direct_async(dev,
1694                                         PN533_CMD_TG_GET_DATA,
1695                                         skb,
1696                                         pn533_tm_get_data_complete,
1697                                         NULL);
1698
1699         if (rc < 0)
1700                 dev_kfree_skb(skb);
1701
1702         return;
1703 }
1704
1705 static int pn533_tm_send_complete(struct pn533 *dev, void *arg,
1706                                   struct sk_buff *resp);
1707 static void pn533_wq_tm_mi_send(struct work_struct *work)
1708 {
1709         struct pn533 *dev = container_of(work, struct pn533, mi_tm_tx_work);
1710         struct sk_buff *skb;
1711         int rc;
1712
1713         dev_dbg(&dev->interface->dev, "%s\n", __func__);
1714
1715         /* Grab the first skb in the queue */
1716         skb = skb_dequeue(&dev->fragment_skb);
1717         if (skb == NULL) {      /* No more data */
1718                 /* Reset the queue for future use */
1719                 skb_queue_head_init(&dev->fragment_skb);
1720                 goto error;
1721         }
1722
1723         /* last entry - remove MI bit */
1724         if (skb_queue_len(&dev->fragment_skb) == 0) {
1725                 rc = pn533_send_cmd_direct_async(dev, PN533_CMD_TG_SET_DATA,
1726                                         skb, pn533_tm_send_complete, NULL);
1727         } else
1728                 rc = pn533_send_cmd_direct_async(dev,
1729                                         PN533_CMD_TG_SET_META_DATA,
1730                                         skb, pn533_tm_send_complete, NULL);
1731
1732         if (rc == 0) /* success */
1733                 return;
1734
1735         dev_err(&dev->interface->dev,
1736                 "Error %d when trying to perform set meta data_exchange", rc);
1737
1738         dev_kfree_skb(skb);
1739
1740 error:
1741         pn533_send_ack(dev, GFP_KERNEL);
1742         queue_work(dev->wq, &dev->cmd_work);
1743 }
1744
1745 static void pn533_wq_tg_get_data(struct work_struct *work)
1746 {
1747         struct pn533 *dev = container_of(work, struct pn533, tg_work);
1748         struct sk_buff *skb;
1749         int rc;
1750
1751         dev_dbg(&dev->interface->dev, "%s\n", __func__);
1752
1753         skb = pn533_alloc_skb(dev, 0);
1754         if (!skb)
1755                 return;
1756
1757         rc = pn533_send_data_async(dev, PN533_CMD_TG_GET_DATA, skb,
1758                                    pn533_tm_get_data_complete, NULL);
1759
1760         if (rc < 0)
1761                 dev_kfree_skb(skb);
1762
1763         return;
1764 }
1765
1766 #define ATR_REQ_GB_OFFSET 17
1767 static int pn533_init_target_complete(struct pn533 *dev, struct sk_buff *resp)
1768 {
1769         u8 mode, *cmd, comm_mode = NFC_COMM_PASSIVE, *gb;
1770         size_t gb_len;
1771         int rc;
1772
1773         dev_dbg(&dev->interface->dev, "%s\n", __func__);
1774
1775         if (resp->len < ATR_REQ_GB_OFFSET + 1)
1776                 return -EINVAL;
1777
1778         mode = resp->data[0];
1779         cmd = &resp->data[1];
1780
1781         dev_dbg(&dev->interface->dev, "Target mode 0x%x len %d\n",
1782                 mode, resp->len);
1783
1784         if ((mode & PN533_INIT_TARGET_RESP_FRAME_MASK) ==
1785             PN533_INIT_TARGET_RESP_ACTIVE)
1786                 comm_mode = NFC_COMM_ACTIVE;
1787
1788         if ((mode & PN533_INIT_TARGET_RESP_DEP) == 0)  /* Only DEP supported */
1789                 return -EOPNOTSUPP;
1790
1791         gb = cmd + ATR_REQ_GB_OFFSET;
1792         gb_len = resp->len - (ATR_REQ_GB_OFFSET + 1);
1793
1794         rc = nfc_tm_activated(dev->nfc_dev, NFC_PROTO_NFC_DEP_MASK,
1795                               comm_mode, gb, gb_len);
1796         if (rc < 0) {
1797                 nfc_err(&dev->interface->dev,
1798                         "Error when signaling target activation\n");
1799                 return rc;
1800         }
1801
1802         dev->tgt_mode = 1;
1803         queue_work(dev->wq, &dev->tg_work);
1804
1805         return 0;
1806 }
1807
1808 static void pn533_listen_mode_timer(unsigned long data)
1809 {
1810         struct pn533 *dev = (struct pn533 *)data;
1811
1812         dev_dbg(&dev->interface->dev, "Listen mode timeout\n");
1813
1814         dev->cancel_listen = 1;
1815
1816         pn533_poll_next_mod(dev);
1817
1818         queue_delayed_work(dev->wq, &dev->poll_work,
1819                            msecs_to_jiffies(PN533_POLL_INTERVAL));
1820 }
1821
1822 static int pn533_rf_complete(struct pn533 *dev, void *arg,
1823                              struct sk_buff *resp)
1824 {
1825         int rc = 0;
1826
1827         dev_dbg(&dev->interface->dev, "%s\n", __func__);
1828
1829         if (IS_ERR(resp)) {
1830                 rc = PTR_ERR(resp);
1831
1832                 nfc_err(&dev->interface->dev, "RF setting error %d", rc);
1833
1834                 return rc;
1835         }
1836
1837         queue_delayed_work(dev->wq, &dev->poll_work,
1838                            msecs_to_jiffies(PN533_POLL_INTERVAL));
1839
1840         dev_kfree_skb(resp);
1841         return rc;
1842 }
1843
1844 static void pn533_wq_rf(struct work_struct *work)
1845 {
1846         struct pn533 *dev = container_of(work, struct pn533, rf_work);
1847         struct sk_buff *skb;
1848         int rc;
1849
1850         dev_dbg(&dev->interface->dev, "%s\n", __func__);
1851
1852         skb = pn533_alloc_skb(dev, 2);
1853         if (!skb)
1854                 return;
1855
1856         *skb_put(skb, 1) = PN533_CFGITEM_RF_FIELD;
1857         *skb_put(skb, 1) = PN533_CFGITEM_RF_FIELD_AUTO_RFCA;
1858
1859         rc = pn533_send_cmd_async(dev, PN533_CMD_RF_CONFIGURATION, skb,
1860                                   pn533_rf_complete, NULL);
1861         if (rc < 0) {
1862                 dev_kfree_skb(skb);
1863                 nfc_err(&dev->interface->dev, "RF setting error %d\n", rc);
1864         }
1865
1866         return;
1867 }
1868
1869 static int pn533_poll_dep_complete(struct pn533 *dev, void *arg,
1870                                    struct sk_buff *resp)
1871 {
1872         struct pn533_cmd_jump_dep_response *rsp;
1873         struct nfc_target nfc_target;
1874         u8 target_gt_len;
1875         int rc;
1876
1877         if (IS_ERR(resp))
1878                 return PTR_ERR(resp);
1879
1880         rsp = (struct pn533_cmd_jump_dep_response *)resp->data;
1881
1882         rc = rsp->status & PN533_CMD_RET_MASK;
1883         if (rc != PN533_CMD_RET_SUCCESS) {
1884                 /* Not target found, turn radio off */
1885                 queue_work(dev->wq, &dev->rf_work);
1886
1887                 dev_kfree_skb(resp);
1888                 return 0;
1889         }
1890
1891         dev_dbg(&dev->interface->dev, "Creating new target");
1892
1893         nfc_target.supported_protocols = NFC_PROTO_NFC_DEP_MASK;
1894         nfc_target.nfcid1_len = 10;
1895         memcpy(nfc_target.nfcid1, rsp->nfcid3t, nfc_target.nfcid1_len);
1896         rc = nfc_targets_found(dev->nfc_dev, &nfc_target, 1);
1897         if (rc)
1898                 goto error;
1899
1900         dev->tgt_available_prots = 0;
1901         dev->tgt_active_prot = NFC_PROTO_NFC_DEP;
1902
1903         /* ATR_RES general bytes are located at offset 17 */
1904         target_gt_len = resp->len - 17;
1905         rc = nfc_set_remote_general_bytes(dev->nfc_dev,
1906                                           rsp->gt, target_gt_len);
1907         if (!rc) {
1908                 rc = nfc_dep_link_is_up(dev->nfc_dev,
1909                                         dev->nfc_dev->targets[0].idx,
1910                                         0, NFC_RF_INITIATOR);
1911
1912                 if (!rc)
1913                         pn533_poll_reset_mod_list(dev);
1914         }
1915 error:
1916         dev_kfree_skb(resp);
1917         return rc;
1918 }
1919
1920 #define PASSIVE_DATA_LEN 5
1921 static int pn533_poll_dep(struct nfc_dev *nfc_dev)
1922 {
1923         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
1924         struct sk_buff *skb;
1925         int rc, skb_len;
1926         u8 *next, nfcid3[NFC_NFCID3_MAXSIZE];
1927         u8 passive_data[PASSIVE_DATA_LEN] = {0x00, 0xff, 0xff, 0x00, 0x3};
1928
1929         dev_dbg(&dev->interface->dev, "%s", __func__);
1930
1931         if (!dev->gb) {
1932                 dev->gb = nfc_get_local_general_bytes(nfc_dev, &dev->gb_len);
1933
1934                 if (!dev->gb || !dev->gb_len) {
1935                         dev->poll_dep = 0;
1936                         queue_work(dev->wq, &dev->rf_work);
1937                 }
1938         }
1939
1940         skb_len = 3 + dev->gb_len; /* ActPass + BR + Next */
1941         skb_len += PASSIVE_DATA_LEN;
1942
1943         /* NFCID3 */
1944         skb_len += NFC_NFCID3_MAXSIZE;
1945         nfcid3[0] = 0x1;
1946         nfcid3[1] = 0xfe;
1947         get_random_bytes(nfcid3 + 2, 6);
1948
1949         skb = pn533_alloc_skb(dev, skb_len);
1950         if (!skb)
1951                 return -ENOMEM;
1952
1953         *skb_put(skb, 1) = 0x01;  /* Active */
1954         *skb_put(skb, 1) = 0x02;  /* 424 kbps */
1955
1956         next = skb_put(skb, 1);  /* Next */
1957         *next = 0;
1958
1959         /* Copy passive data */
1960         memcpy(skb_put(skb, PASSIVE_DATA_LEN), passive_data, PASSIVE_DATA_LEN);
1961         *next |= 1;
1962
1963         /* Copy NFCID3 (which is NFCID2 from SENSF_RES) */
1964         memcpy(skb_put(skb, NFC_NFCID3_MAXSIZE), nfcid3,
1965                NFC_NFCID3_MAXSIZE);
1966         *next |= 2;
1967
1968         memcpy(skb_put(skb, dev->gb_len), dev->gb, dev->gb_len);
1969         *next |= 4; /* We have some Gi */
1970
1971         rc = pn533_send_cmd_async(dev, PN533_CMD_IN_JUMP_FOR_DEP, skb,
1972                                   pn533_poll_dep_complete, NULL);
1973
1974         if (rc < 0)
1975                 dev_kfree_skb(skb);
1976
1977         return rc;
1978 }
1979
1980 static int pn533_poll_complete(struct pn533 *dev, void *arg,
1981                                struct sk_buff *resp)
1982 {
1983         struct pn533_poll_modulations *cur_mod;
1984         int rc;
1985
1986         dev_dbg(&dev->interface->dev, "%s\n", __func__);
1987
1988         if (IS_ERR(resp)) {
1989                 rc = PTR_ERR(resp);
1990
1991                 nfc_err(&dev->interface->dev, "%s  Poll complete error %d\n",
1992                         __func__, rc);
1993
1994                 if (rc == -ENOENT) {
1995                         if (dev->poll_mod_count != 0)
1996                                 return rc;
1997                         else
1998                                 goto stop_poll;
1999                 } else if (rc < 0) {
2000                         nfc_err(&dev->interface->dev,
2001                                 "Error %d when running poll\n", rc);
2002                         goto stop_poll;
2003                 }
2004         }
2005
2006         cur_mod = dev->poll_mod_active[dev->poll_mod_curr];
2007
2008         if (cur_mod->len == 0) { /* Target mode */
2009                 del_timer(&dev->listen_timer);
2010                 rc = pn533_init_target_complete(dev, resp);
2011                 goto done;
2012         }
2013
2014         /* Initiator mode */
2015         rc = pn533_start_poll_complete(dev, resp);
2016         if (!rc)
2017                 goto done;
2018
2019         if (!dev->poll_mod_count) {
2020                 dev_dbg(&dev->interface->dev, "Polling has been stopped\n");
2021                 goto done;
2022         }
2023
2024         pn533_poll_next_mod(dev);
2025         /* Not target found, turn radio off */
2026         queue_work(dev->wq, &dev->rf_work);
2027
2028 done:
2029         dev_kfree_skb(resp);
2030         return rc;
2031
2032 stop_poll:
2033         nfc_err(&dev->interface->dev, "Polling operation has been stopped\n");
2034
2035         pn533_poll_reset_mod_list(dev);
2036         dev->poll_protocols = 0;
2037         return rc;
2038 }
2039
2040 static struct sk_buff *pn533_alloc_poll_in_frame(struct pn533 *dev,
2041                                         struct pn533_poll_modulations *mod)
2042 {
2043         struct sk_buff *skb;
2044
2045         skb = pn533_alloc_skb(dev, mod->len);
2046         if (!skb)
2047                 return NULL;
2048
2049         memcpy(skb_put(skb, mod->len), &mod->data, mod->len);
2050
2051         return skb;
2052 }
2053
2054 static int pn533_send_poll_frame(struct pn533 *dev)
2055 {
2056         struct pn533_poll_modulations *mod;
2057         struct sk_buff *skb;
2058         int rc;
2059         u8 cmd_code;
2060
2061         mod = dev->poll_mod_active[dev->poll_mod_curr];
2062
2063         dev_dbg(&dev->interface->dev, "%s mod len %d\n",
2064                 __func__, mod->len);
2065
2066         if (dev->poll_dep)  {
2067                 dev->poll_dep = 0;
2068                 return pn533_poll_dep(dev->nfc_dev);
2069         }
2070
2071         if (mod->len == 0) {  /* Listen mode */
2072                 cmd_code = PN533_CMD_TG_INIT_AS_TARGET;
2073                 skb = pn533_alloc_poll_tg_frame(dev);
2074         } else {  /* Polling mode */
2075                 cmd_code =  PN533_CMD_IN_LIST_PASSIVE_TARGET;
2076                 skb = pn533_alloc_poll_in_frame(dev, mod);
2077         }
2078
2079         if (!skb) {
2080                 nfc_err(&dev->interface->dev, "Failed to allocate skb\n");
2081                 return -ENOMEM;
2082         }
2083
2084         rc = pn533_send_cmd_async(dev, cmd_code, skb, pn533_poll_complete,
2085                                   NULL);
2086         if (rc < 0) {
2087                 dev_kfree_skb(skb);
2088                 nfc_err(&dev->interface->dev, "Polling loop error %d\n", rc);
2089         }
2090
2091         return rc;
2092 }
2093
2094 static void pn533_wq_poll(struct work_struct *work)
2095 {
2096         struct pn533 *dev = container_of(work, struct pn533, poll_work.work);
2097         struct pn533_poll_modulations *cur_mod;
2098         int rc;
2099
2100         cur_mod = dev->poll_mod_active[dev->poll_mod_curr];
2101
2102         dev_dbg(&dev->interface->dev,
2103                 "%s cancel_listen %d modulation len %d\n",
2104                 __func__, dev->cancel_listen, cur_mod->len);
2105
2106         if (dev->cancel_listen == 1) {
2107                 dev->cancel_listen = 0;
2108                 pn533_abort_cmd(dev, GFP_ATOMIC);
2109         }
2110
2111         rc = pn533_send_poll_frame(dev);
2112         if (rc)
2113                 return;
2114
2115         if (cur_mod->len == 0 && dev->poll_mod_count > 1)
2116                 mod_timer(&dev->listen_timer, jiffies + PN533_LISTEN_TIME * HZ);
2117
2118         return;
2119 }
2120
2121 static int pn533_start_poll(struct nfc_dev *nfc_dev,
2122                             u32 im_protocols, u32 tm_protocols)
2123 {
2124         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2125         struct pn533_poll_modulations *cur_mod;
2126         u8 rand_mod;
2127         int rc;
2128
2129         dev_dbg(&dev->interface->dev,
2130                 "%s: im protocols 0x%x tm protocols 0x%x\n",
2131                 __func__, im_protocols, tm_protocols);
2132
2133         if (dev->tgt_active_prot) {
2134                 nfc_err(&dev->interface->dev,
2135                         "Cannot poll with a target already activated\n");
2136                 return -EBUSY;
2137         }
2138
2139         if (dev->tgt_mode) {
2140                 nfc_err(&dev->interface->dev,
2141                         "Cannot poll while already being activated\n");
2142                 return -EBUSY;
2143         }
2144
2145         if (tm_protocols) {
2146                 dev->gb = nfc_get_local_general_bytes(nfc_dev, &dev->gb_len);
2147                 if (dev->gb == NULL)
2148                         tm_protocols = 0;
2149         }
2150
2151         pn533_poll_create_mod_list(dev, im_protocols, tm_protocols);
2152         dev->poll_protocols = im_protocols;
2153         dev->listen_protocols = tm_protocols;
2154
2155         /* Do not always start polling from the same modulation */
2156         get_random_bytes(&rand_mod, sizeof(rand_mod));
2157         rand_mod %= dev->poll_mod_count;
2158         dev->poll_mod_curr = rand_mod;
2159
2160         cur_mod = dev->poll_mod_active[dev->poll_mod_curr];
2161
2162         rc = pn533_send_poll_frame(dev);
2163
2164         /* Start listen timer */
2165         if (!rc && cur_mod->len == 0 && dev->poll_mod_count > 1)
2166                 mod_timer(&dev->listen_timer, jiffies + PN533_LISTEN_TIME * HZ);
2167
2168         return rc;
2169 }
2170
2171 static void pn533_stop_poll(struct nfc_dev *nfc_dev)
2172 {
2173         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2174
2175         del_timer(&dev->listen_timer);
2176
2177         if (!dev->poll_mod_count) {
2178                 dev_dbg(&dev->interface->dev,
2179                         "Polling operation was not running\n");
2180                 return;
2181         }
2182
2183         pn533_abort_cmd(dev, GFP_KERNEL);
2184         flush_delayed_work(&dev->poll_work);
2185         pn533_poll_reset_mod_list(dev);
2186 }
2187
2188 static int pn533_activate_target_nfcdep(struct pn533 *dev)
2189 {
2190         struct pn533_cmd_activate_response *rsp;
2191         u16 gt_len;
2192         int rc;
2193         struct sk_buff *skb;
2194         struct sk_buff *resp;
2195
2196         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2197
2198         skb = pn533_alloc_skb(dev, sizeof(u8) * 2); /*TG + Next*/
2199         if (!skb)
2200                 return -ENOMEM;
2201
2202         *skb_put(skb, sizeof(u8)) = 1; /* TG */
2203         *skb_put(skb, sizeof(u8)) = 0; /* Next */
2204
2205         resp = pn533_send_cmd_sync(dev, PN533_CMD_IN_ATR, skb);
2206         if (IS_ERR(resp))
2207                 return PTR_ERR(resp);
2208
2209         rsp = (struct pn533_cmd_activate_response *)resp->data;
2210         rc = rsp->status & PN533_CMD_RET_MASK;
2211         if (rc != PN533_CMD_RET_SUCCESS) {
2212                 nfc_err(&dev->interface->dev,
2213                         "Target activation failed (error 0x%x)\n", rc);
2214                 dev_kfree_skb(resp);
2215                 return -EIO;
2216         }
2217
2218         /* ATR_RES general bytes are located at offset 16 */
2219         gt_len = resp->len - 16;
2220         rc = nfc_set_remote_general_bytes(dev->nfc_dev, rsp->gt, gt_len);
2221
2222         dev_kfree_skb(resp);
2223         return rc;
2224 }
2225
2226 static int pn533_activate_target(struct nfc_dev *nfc_dev,
2227                                  struct nfc_target *target, u32 protocol)
2228 {
2229         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2230         int rc;
2231
2232         dev_dbg(&dev->interface->dev, "%s: protocol=%u\n", __func__, protocol);
2233
2234         if (dev->poll_mod_count) {
2235                 nfc_err(&dev->interface->dev,
2236                         "Cannot activate while polling\n");
2237                 return -EBUSY;
2238         }
2239
2240         if (dev->tgt_active_prot) {
2241                 nfc_err(&dev->interface->dev,
2242                         "There is already an active target\n");
2243                 return -EBUSY;
2244         }
2245
2246         if (!dev->tgt_available_prots) {
2247                 nfc_err(&dev->interface->dev,
2248                         "There is no available target to activate\n");
2249                 return -EINVAL;
2250         }
2251
2252         if (!(dev->tgt_available_prots & (1 << protocol))) {
2253                 nfc_err(&dev->interface->dev,
2254                         "Target doesn't support requested proto %u\n",
2255                         protocol);
2256                 return -EINVAL;
2257         }
2258
2259         if (protocol == NFC_PROTO_NFC_DEP) {
2260                 rc = pn533_activate_target_nfcdep(dev);
2261                 if (rc) {
2262                         nfc_err(&dev->interface->dev,
2263                                 "Activating target with DEP failed %d\n", rc);
2264                         return rc;
2265                 }
2266         }
2267
2268         dev->tgt_active_prot = protocol;
2269         dev->tgt_available_prots = 0;
2270
2271         return 0;
2272 }
2273
2274 static void pn533_deactivate_target(struct nfc_dev *nfc_dev,
2275                                     struct nfc_target *target)
2276 {
2277         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2278         struct sk_buff *skb;
2279         struct sk_buff *resp;
2280         int rc;
2281
2282         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2283
2284         if (!dev->tgt_active_prot) {
2285                 nfc_err(&dev->interface->dev, "There is no active target\n");
2286                 return;
2287         }
2288
2289         dev->tgt_active_prot = 0;
2290         skb_queue_purge(&dev->resp_q);
2291
2292         skb = pn533_alloc_skb(dev, sizeof(u8));
2293         if (!skb)
2294                 return;
2295
2296         *skb_put(skb, 1) = 1; /* TG*/
2297
2298         resp = pn533_send_cmd_sync(dev, PN533_CMD_IN_RELEASE, skb);
2299         if (IS_ERR(resp))
2300                 return;
2301
2302         rc = resp->data[0] & PN533_CMD_RET_MASK;
2303         if (rc != PN533_CMD_RET_SUCCESS)
2304                 nfc_err(&dev->interface->dev,
2305                         "Error 0x%x when releasing the target\n", rc);
2306
2307         dev_kfree_skb(resp);
2308         return;
2309 }
2310
2311
2312 static int pn533_in_dep_link_up_complete(struct pn533 *dev, void *arg,
2313                                          struct sk_buff *resp)
2314 {
2315         struct pn533_cmd_jump_dep_response *rsp;
2316         u8 target_gt_len;
2317         int rc;
2318         u8 active = *(u8 *)arg;
2319
2320         kfree(arg);
2321
2322         if (IS_ERR(resp))
2323                 return PTR_ERR(resp);
2324
2325         if (dev->tgt_available_prots &&
2326             !(dev->tgt_available_prots & (1 << NFC_PROTO_NFC_DEP))) {
2327                 nfc_err(&dev->interface->dev,
2328                         "The target does not support DEP\n");
2329                 rc =  -EINVAL;
2330                 goto error;
2331         }
2332
2333         rsp = (struct pn533_cmd_jump_dep_response *)resp->data;
2334
2335         rc = rsp->status & PN533_CMD_RET_MASK;
2336         if (rc != PN533_CMD_RET_SUCCESS) {
2337                 nfc_err(&dev->interface->dev,
2338                         "Bringing DEP link up failed (error 0x%x)\n", rc);
2339                 goto error;
2340         }
2341
2342         if (!dev->tgt_available_prots) {
2343                 struct nfc_target nfc_target;
2344
2345                 dev_dbg(&dev->interface->dev, "Creating new target\n");
2346
2347                 nfc_target.supported_protocols = NFC_PROTO_NFC_DEP_MASK;
2348                 nfc_target.nfcid1_len = 10;
2349                 memcpy(nfc_target.nfcid1, rsp->nfcid3t, nfc_target.nfcid1_len);
2350                 rc = nfc_targets_found(dev->nfc_dev, &nfc_target, 1);
2351                 if (rc)
2352                         goto error;
2353
2354                 dev->tgt_available_prots = 0;
2355         }
2356
2357         dev->tgt_active_prot = NFC_PROTO_NFC_DEP;
2358
2359         /* ATR_RES general bytes are located at offset 17 */
2360         target_gt_len = resp->len - 17;
2361         rc = nfc_set_remote_general_bytes(dev->nfc_dev,
2362                                           rsp->gt, target_gt_len);
2363         if (rc == 0)
2364                 rc = nfc_dep_link_is_up(dev->nfc_dev,
2365                                         dev->nfc_dev->targets[0].idx,
2366                                         !active, NFC_RF_INITIATOR);
2367
2368 error:
2369         dev_kfree_skb(resp);
2370         return rc;
2371 }
2372
2373 static int pn533_rf_field(struct nfc_dev *nfc_dev, u8 rf);
2374 static int pn533_dep_link_up(struct nfc_dev *nfc_dev, struct nfc_target *target,
2375                              u8 comm_mode, u8 *gb, size_t gb_len)
2376 {
2377         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2378         struct sk_buff *skb;
2379         int rc, skb_len;
2380         u8 *next, *arg, nfcid3[NFC_NFCID3_MAXSIZE];
2381         u8 passive_data[PASSIVE_DATA_LEN] = {0x00, 0xff, 0xff, 0x00, 0x3};
2382
2383         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2384
2385         if (dev->poll_mod_count) {
2386                 nfc_err(&dev->interface->dev,
2387                         "Cannot bring the DEP link up while polling\n");
2388                 return -EBUSY;
2389         }
2390
2391         if (dev->tgt_active_prot) {
2392                 nfc_err(&dev->interface->dev,
2393                         "There is already an active target\n");
2394                 return -EBUSY;
2395         }
2396
2397         skb_len = 3 + gb_len; /* ActPass + BR + Next */
2398         skb_len += PASSIVE_DATA_LEN;
2399
2400         /* NFCID3 */
2401         skb_len += NFC_NFCID3_MAXSIZE;
2402         if (target && !target->nfcid2_len) {
2403                 nfcid3[0] = 0x1;
2404                 nfcid3[1] = 0xfe;
2405                 get_random_bytes(nfcid3 + 2, 6);
2406         }
2407
2408         skb = pn533_alloc_skb(dev, skb_len);
2409         if (!skb)
2410                 return -ENOMEM;
2411
2412         *skb_put(skb, 1) = !comm_mode;  /* ActPass */
2413         *skb_put(skb, 1) = 0x02;  /* 424 kbps */
2414
2415         next = skb_put(skb, 1);  /* Next */
2416         *next = 0;
2417
2418         /* Copy passive data */
2419         memcpy(skb_put(skb, PASSIVE_DATA_LEN), passive_data, PASSIVE_DATA_LEN);
2420         *next |= 1;
2421
2422         /* Copy NFCID3 (which is NFCID2 from SENSF_RES) */
2423         if (target && target->nfcid2_len)
2424                 memcpy(skb_put(skb, NFC_NFCID3_MAXSIZE), target->nfcid2,
2425                        target->nfcid2_len);
2426         else
2427                 memcpy(skb_put(skb, NFC_NFCID3_MAXSIZE), nfcid3,
2428                        NFC_NFCID3_MAXSIZE);
2429         *next |= 2;
2430
2431         if (gb != NULL && gb_len > 0) {
2432                 memcpy(skb_put(skb, gb_len), gb, gb_len);
2433                 *next |= 4; /* We have some Gi */
2434         } else {
2435                 *next = 0;
2436         }
2437
2438         arg = kmalloc(sizeof(*arg), GFP_KERNEL);
2439         if (!arg) {
2440                 dev_kfree_skb(skb);
2441                 return -ENOMEM;
2442         }
2443
2444         *arg = !comm_mode;
2445
2446         pn533_rf_field(dev->nfc_dev, 0);
2447
2448         rc = pn533_send_cmd_async(dev, PN533_CMD_IN_JUMP_FOR_DEP, skb,
2449                                   pn533_in_dep_link_up_complete, arg);
2450
2451         if (rc < 0) {
2452                 dev_kfree_skb(skb);
2453                 kfree(arg);
2454         }
2455
2456         return rc;
2457 }
2458
2459 static int pn533_dep_link_down(struct nfc_dev *nfc_dev)
2460 {
2461         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2462
2463         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2464
2465         pn533_poll_reset_mod_list(dev);
2466
2467         if (dev->tgt_mode || dev->tgt_active_prot)
2468                 pn533_abort_cmd(dev, GFP_KERNEL);
2469
2470         dev->tgt_active_prot = 0;
2471         dev->tgt_mode = 0;
2472
2473         skb_queue_purge(&dev->resp_q);
2474
2475         return 0;
2476 }
2477
2478 struct pn533_data_exchange_arg {
2479         data_exchange_cb_t cb;
2480         void *cb_context;
2481 };
2482
2483 static struct sk_buff *pn533_build_response(struct pn533 *dev)
2484 {
2485         struct sk_buff *skb, *tmp, *t;
2486         unsigned int skb_len = 0, tmp_len = 0;
2487
2488         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2489
2490         if (skb_queue_empty(&dev->resp_q))
2491                 return NULL;
2492
2493         if (skb_queue_len(&dev->resp_q) == 1) {
2494                 skb = skb_dequeue(&dev->resp_q);
2495                 goto out;
2496         }
2497
2498         skb_queue_walk_safe(&dev->resp_q, tmp, t)
2499                 skb_len += tmp->len;
2500
2501         dev_dbg(&dev->interface->dev, "%s total length %d\n",
2502                 __func__, skb_len);
2503
2504         skb = alloc_skb(skb_len, GFP_KERNEL);
2505         if (skb == NULL)
2506                 goto out;
2507
2508         skb_put(skb, skb_len);
2509
2510         skb_queue_walk_safe(&dev->resp_q, tmp, t) {
2511                 memcpy(skb->data + tmp_len, tmp->data, tmp->len);
2512                 tmp_len += tmp->len;
2513         }
2514
2515 out:
2516         skb_queue_purge(&dev->resp_q);
2517
2518         return skb;
2519 }
2520
2521 static int pn533_data_exchange_complete(struct pn533 *dev, void *_arg,
2522                                         struct sk_buff *resp)
2523 {
2524         struct pn533_data_exchange_arg *arg = _arg;
2525         struct sk_buff *skb;
2526         int rc = 0;
2527         u8 status, ret, mi;
2528
2529         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2530
2531         if (IS_ERR(resp)) {
2532                 rc = PTR_ERR(resp);
2533                 goto _error;
2534         }
2535
2536         status = resp->data[0];
2537         ret = status & PN533_CMD_RET_MASK;
2538         mi = status & PN533_CMD_MI_MASK;
2539
2540         skb_pull(resp, sizeof(status));
2541
2542         if (ret != PN533_CMD_RET_SUCCESS) {
2543                 nfc_err(&dev->interface->dev,
2544                         "Exchanging data failed (error 0x%x)\n", ret);
2545                 rc = -EIO;
2546                 goto error;
2547         }
2548
2549         skb_queue_tail(&dev->resp_q, resp);
2550
2551         if (mi) {
2552                 dev->cmd_complete_mi_arg = arg;
2553                 queue_work(dev->wq, &dev->mi_rx_work);
2554                 return -EINPROGRESS;
2555         }
2556
2557         /* Prepare for the next round */
2558         if (skb_queue_len(&dev->fragment_skb) > 0) {
2559                 dev->cmd_complete_dep_arg = arg;
2560                 queue_work(dev->wq, &dev->mi_tx_work);
2561
2562                 return -EINPROGRESS;
2563         }
2564
2565         skb = pn533_build_response(dev);
2566         if (!skb)
2567                 goto error;
2568
2569         arg->cb(arg->cb_context, skb, 0);
2570         kfree(arg);
2571         return 0;
2572
2573 error:
2574         dev_kfree_skb(resp);
2575 _error:
2576         skb_queue_purge(&dev->resp_q);
2577         arg->cb(arg->cb_context, NULL, rc);
2578         kfree(arg);
2579         return rc;
2580 }
2581
2582 /* Split the Tx skb into small chunks */
2583 static int pn533_fill_fragment_skbs(struct pn533 *dev, struct sk_buff *skb)
2584 {
2585         struct sk_buff *frag;
2586         int  frag_size;
2587
2588         do {
2589                 /* Remaining size */
2590                 if (skb->len > PN533_CMD_DATAFRAME_MAXLEN)
2591                         frag_size = PN533_CMD_DATAFRAME_MAXLEN;
2592                 else
2593                         frag_size = skb->len;
2594
2595                 /* Allocate and reserve */
2596                 frag = pn533_alloc_skb(dev, frag_size);
2597                 if (!frag) {
2598                         skb_queue_purge(&dev->fragment_skb);
2599                         break;
2600                 }
2601
2602                 if (!dev->tgt_mode) {
2603                         /* Reserve the TG/MI byte */
2604                         skb_reserve(frag, 1);
2605
2606                         /* MI + TG */
2607                         if (frag_size  == PN533_CMD_DATAFRAME_MAXLEN)
2608                                 *skb_push(frag, sizeof(u8)) =
2609                                                         (PN533_CMD_MI_MASK | 1);
2610                         else
2611                                 *skb_push(frag, sizeof(u8)) =  1; /* TG */
2612                 }
2613
2614                 memcpy(skb_put(frag, frag_size), skb->data, frag_size);
2615
2616                 /* Reduce the size of incoming buffer */
2617                 skb_pull(skb, frag_size);
2618
2619                 /* Add this to skb_queue */
2620                 skb_queue_tail(&dev->fragment_skb, frag);
2621
2622         } while (skb->len > 0);
2623
2624         dev_kfree_skb(skb);
2625
2626         return skb_queue_len(&dev->fragment_skb);
2627 }
2628
2629 static int pn533_transceive(struct nfc_dev *nfc_dev,
2630                             struct nfc_target *target, struct sk_buff *skb,
2631                             data_exchange_cb_t cb, void *cb_context)
2632 {
2633         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2634         struct pn533_data_exchange_arg *arg = NULL;
2635         int rc;
2636
2637         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2638
2639         if (!dev->tgt_active_prot) {
2640                 nfc_err(&dev->interface->dev,
2641                         "Can't exchange data if there is no active target\n");
2642                 rc = -EINVAL;
2643                 goto error;
2644         }
2645
2646         arg = kmalloc(sizeof(*arg), GFP_KERNEL);
2647         if (!arg) {
2648                 rc = -ENOMEM;
2649                 goto error;
2650         }
2651
2652         arg->cb = cb;
2653         arg->cb_context = cb_context;
2654
2655         switch (dev->device_type) {
2656         case PN533_DEVICE_PASORI:
2657                 if (dev->tgt_active_prot == NFC_PROTO_FELICA) {
2658                         rc = pn533_send_data_async(dev, PN533_CMD_IN_COMM_THRU,
2659                                                    skb,
2660                                                    pn533_data_exchange_complete,
2661                                                    arg);
2662
2663                         break;
2664                 }
2665         default:
2666                 /* jumbo frame ? */
2667                 if (skb->len > PN533_CMD_DATAEXCH_DATA_MAXLEN) {
2668                         rc = pn533_fill_fragment_skbs(dev, skb);
2669                         if (rc <= 0)
2670                                 goto error;
2671
2672                         skb = skb_dequeue(&dev->fragment_skb);
2673                         if (!skb) {
2674                                 rc = -EIO;
2675                                 goto error;
2676                         }
2677                 } else {
2678                         *skb_push(skb, sizeof(u8)) =  1; /* TG */
2679                 }
2680
2681                 rc = pn533_send_data_async(dev, PN533_CMD_IN_DATA_EXCHANGE,
2682                                            skb, pn533_data_exchange_complete,
2683                                            arg);
2684
2685                 break;
2686         }
2687
2688         if (rc < 0) /* rc from send_async */
2689                 goto error;
2690
2691         return 0;
2692
2693 error:
2694         kfree(arg);
2695         dev_kfree_skb(skb);
2696         return rc;
2697 }
2698
2699 static int pn533_tm_send_complete(struct pn533 *dev, void *arg,
2700                                   struct sk_buff *resp)
2701 {
2702         u8 status;
2703
2704         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2705
2706         if (IS_ERR(resp))
2707                 return PTR_ERR(resp);
2708
2709         status = resp->data[0];
2710
2711         /* Prepare for the next round */
2712         if (skb_queue_len(&dev->fragment_skb) > 0) {
2713                 queue_work(dev->wq, &dev->mi_tm_tx_work);
2714                 return -EINPROGRESS;
2715         }
2716         dev_kfree_skb(resp);
2717
2718         if (status != 0) {
2719                 nfc_tm_deactivated(dev->nfc_dev);
2720
2721                 dev->tgt_mode = 0;
2722
2723                 return 0;
2724         }
2725
2726         queue_work(dev->wq, &dev->tg_work);
2727
2728         return 0;
2729 }
2730
2731 static int pn533_tm_send(struct nfc_dev *nfc_dev, struct sk_buff *skb)
2732 {
2733         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2734         int rc;
2735
2736         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2737
2738         /* let's split in multiple chunks if size's too big */
2739         if (skb->len > PN533_CMD_DATAEXCH_DATA_MAXLEN) {
2740                 rc = pn533_fill_fragment_skbs(dev, skb);
2741                 if (rc <= 0)
2742                         goto error;
2743
2744                 /* get the first skb */
2745                 skb = skb_dequeue(&dev->fragment_skb);
2746                 if (!skb) {
2747                         rc = -EIO;
2748                         goto error;
2749                 }
2750
2751                 rc = pn533_send_data_async(dev, PN533_CMD_TG_SET_META_DATA, skb,
2752                                                 pn533_tm_send_complete, NULL);
2753         } else {
2754                 /* Send th skb */
2755                 rc = pn533_send_data_async(dev, PN533_CMD_TG_SET_DATA, skb,
2756                                                 pn533_tm_send_complete, NULL);
2757         }
2758
2759 error:
2760         if (rc < 0) {
2761                 dev_kfree_skb(skb);
2762                 skb_queue_purge(&dev->fragment_skb);
2763         }
2764
2765         return rc;
2766 }
2767
2768 static void pn533_wq_mi_recv(struct work_struct *work)
2769 {
2770         struct pn533 *dev = container_of(work, struct pn533, mi_rx_work);
2771         struct sk_buff *skb;
2772         int rc;
2773
2774         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2775
2776         skb = pn533_alloc_skb(dev, PN533_CMD_DATAEXCH_HEAD_LEN);
2777         if (!skb)
2778                 goto error;
2779
2780         switch (dev->device_type) {
2781         case PN533_DEVICE_PASORI:
2782                 if (dev->tgt_active_prot == NFC_PROTO_FELICA) {
2783                         rc = pn533_send_cmd_direct_async(dev,
2784                                                 PN533_CMD_IN_COMM_THRU,
2785                                                 skb,
2786                                                 pn533_data_exchange_complete,
2787                                                  dev->cmd_complete_mi_arg);
2788
2789                         break;
2790                 }
2791         default:
2792                 *skb_put(skb, sizeof(u8)) =  1; /*TG*/
2793
2794                 rc = pn533_send_cmd_direct_async(dev,
2795                                                  PN533_CMD_IN_DATA_EXCHANGE,
2796                                                  skb,
2797                                                  pn533_data_exchange_complete,
2798                                                  dev->cmd_complete_mi_arg);
2799
2800                 break;
2801         }
2802
2803         if (rc == 0) /* success */
2804                 return;
2805
2806         nfc_err(&dev->interface->dev,
2807                 "Error %d when trying to perform data_exchange\n", rc);
2808
2809         dev_kfree_skb(skb);
2810         kfree(dev->cmd_complete_mi_arg);
2811
2812 error:
2813         pn533_send_ack(dev, GFP_KERNEL);
2814         queue_work(dev->wq, &dev->cmd_work);
2815 }
2816
2817 static void pn533_wq_mi_send(struct work_struct *work)
2818 {
2819         struct pn533 *dev = container_of(work, struct pn533, mi_tx_work);
2820         struct sk_buff *skb;
2821         int rc;
2822
2823         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2824
2825         /* Grab the first skb in the queue */
2826         skb = skb_dequeue(&dev->fragment_skb);
2827
2828         if (skb == NULL) {      /* No more data */
2829                 /* Reset the queue for future use */
2830                 skb_queue_head_init(&dev->fragment_skb);
2831                 goto error;
2832         }
2833
2834         switch (dev->device_type) {
2835         case PN533_DEVICE_PASORI:
2836                 if (dev->tgt_active_prot != NFC_PROTO_FELICA) {
2837                         rc = -EIO;
2838                         break;
2839                 }
2840
2841                 rc = pn533_send_cmd_direct_async(dev, PN533_CMD_IN_COMM_THRU,
2842                                                  skb,
2843                                                  pn533_data_exchange_complete,
2844                                                  dev->cmd_complete_dep_arg);
2845
2846                 break;
2847
2848         default:
2849                 /* Still some fragments? */
2850                 rc = pn533_send_cmd_direct_async(dev,PN533_CMD_IN_DATA_EXCHANGE,
2851                                                  skb,
2852                                                  pn533_data_exchange_complete,
2853                                                  dev->cmd_complete_dep_arg);
2854
2855                 break;
2856         }
2857
2858         if (rc == 0) /* success */
2859                 return;
2860
2861         nfc_err(&dev->interface->dev,
2862                 "Error %d when trying to perform data_exchange\n", rc);
2863
2864         dev_kfree_skb(skb);
2865         kfree(dev->cmd_complete_dep_arg);
2866
2867 error:
2868         pn533_send_ack(dev, GFP_KERNEL);
2869         queue_work(dev->wq, &dev->cmd_work);
2870 }
2871
2872 static int pn533_set_configuration(struct pn533 *dev, u8 cfgitem, u8 *cfgdata,
2873                                                                 u8 cfgdata_len)
2874 {
2875         struct sk_buff *skb;
2876         struct sk_buff *resp;
2877         int skb_len;
2878
2879         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2880
2881         skb_len = sizeof(cfgitem) + cfgdata_len; /* cfgitem + cfgdata */
2882
2883         skb = pn533_alloc_skb(dev, skb_len);
2884         if (!skb)
2885                 return -ENOMEM;
2886
2887         *skb_put(skb, sizeof(cfgitem)) = cfgitem;
2888         memcpy(skb_put(skb, cfgdata_len), cfgdata, cfgdata_len);
2889
2890         resp = pn533_send_cmd_sync(dev, PN533_CMD_RF_CONFIGURATION, skb);
2891         if (IS_ERR(resp))
2892                 return PTR_ERR(resp);
2893
2894         dev_kfree_skb(resp);
2895         return 0;
2896 }
2897
2898 static int pn533_get_firmware_version(struct pn533 *dev,
2899                                       struct pn533_fw_version *fv)
2900 {
2901         struct sk_buff *skb;
2902         struct sk_buff *resp;
2903
2904         skb = pn533_alloc_skb(dev, 0);
2905         if (!skb)
2906                 return -ENOMEM;
2907
2908         resp = pn533_send_cmd_sync(dev, PN533_CMD_GET_FIRMWARE_VERSION, skb);
2909         if (IS_ERR(resp))
2910                 return PTR_ERR(resp);
2911
2912         fv->ic = resp->data[0];
2913         fv->ver = resp->data[1];
2914         fv->rev = resp->data[2];
2915         fv->support = resp->data[3];
2916
2917         dev_kfree_skb(resp);
2918         return 0;
2919 }
2920
2921 static int pn533_pasori_fw_reset(struct pn533 *dev)
2922 {
2923         struct sk_buff *skb;
2924         struct sk_buff *resp;
2925
2926         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2927
2928         skb = pn533_alloc_skb(dev, sizeof(u8));
2929         if (!skb)
2930                 return -ENOMEM;
2931
2932         *skb_put(skb, sizeof(u8)) = 0x1;
2933
2934         resp = pn533_send_cmd_sync(dev, 0x18, skb);
2935         if (IS_ERR(resp))
2936                 return PTR_ERR(resp);
2937
2938         dev_kfree_skb(resp);
2939
2940         return 0;
2941 }
2942
2943 struct pn533_acr122_poweron_rdr_arg {
2944         int rc;
2945         struct completion done;
2946 };
2947
2948 static void pn533_acr122_poweron_rdr_resp(struct urb *urb)
2949 {
2950         struct pn533_acr122_poweron_rdr_arg *arg = urb->context;
2951
2952         dev_dbg(&urb->dev->dev, "%s\n", __func__);
2953
2954         print_hex_dump_debug("ACR122 RX: ", DUMP_PREFIX_NONE, 16, 1,
2955                        urb->transfer_buffer, urb->transfer_buffer_length,
2956                        false);
2957
2958         arg->rc = urb->status;
2959         complete(&arg->done);
2960 }
2961
2962 static int pn533_acr122_poweron_rdr(struct pn533 *dev)
2963 {
2964         /* Power on th reader (CCID cmd) */
2965         u8 cmd[10] = {PN533_ACR122_PC_TO_RDR_ICCPOWERON,
2966                       0, 0, 0, 0, 0, 0, 3, 0, 0};
2967         u8 buf[255];
2968         int rc;
2969         void *cntx;
2970         struct pn533_acr122_poweron_rdr_arg arg;
2971
2972         dev_dbg(&dev->interface->dev, "%s\n", __func__);
2973
2974         init_completion(&arg.done);
2975         cntx = dev->in_urb->context;  /* backup context */
2976
2977         dev->in_urb->transfer_buffer = buf;
2978         dev->in_urb->transfer_buffer_length = 255;
2979         dev->in_urb->complete = pn533_acr122_poweron_rdr_resp;
2980         dev->in_urb->context = &arg;
2981
2982         dev->out_urb->transfer_buffer = cmd;
2983         dev->out_urb->transfer_buffer_length = sizeof(cmd);
2984
2985         print_hex_dump_debug("ACR122 TX: ", DUMP_PREFIX_NONE, 16, 1,
2986                        cmd, sizeof(cmd), false);
2987
2988         rc = usb_submit_urb(dev->out_urb, GFP_KERNEL);
2989         if (rc) {
2990                 nfc_err(&dev->interface->dev,
2991                         "Reader power on cmd error %d\n", rc);
2992                 return rc;
2993         }
2994
2995         rc =  usb_submit_urb(dev->in_urb, GFP_KERNEL);
2996         if (rc) {
2997                 nfc_err(&dev->interface->dev,
2998                         "Can't submit reader poweron cmd response %d\n", rc);
2999                 return rc;
3000         }
3001
3002         wait_for_completion(&arg.done);
3003         dev->in_urb->context = cntx; /* restore context */
3004
3005         return arg.rc;
3006 }
3007
3008 static int pn533_rf_field(struct nfc_dev *nfc_dev, u8 rf)
3009 {
3010         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
3011         u8 rf_field = !!rf;
3012         int rc;
3013
3014         rf_field |= PN533_CFGITEM_RF_FIELD_AUTO_RFCA;
3015
3016         rc = pn533_set_configuration(dev, PN533_CFGITEM_RF_FIELD,
3017                                      (u8 *)&rf_field, 1);
3018         if (rc) {
3019                 nfc_err(&dev->interface->dev, "Error on setting RF field\n");
3020                 return rc;
3021         }
3022
3023         return rc;
3024 }
3025
3026 static int pn533_dev_up(struct nfc_dev *nfc_dev)
3027 {
3028         return pn533_rf_field(nfc_dev, 1);
3029 }
3030
3031 static int pn533_dev_down(struct nfc_dev *nfc_dev)
3032 {
3033         return pn533_rf_field(nfc_dev, 0);
3034 }
3035
3036 static struct nfc_ops pn533_nfc_ops = {
3037         .dev_up = pn533_dev_up,
3038         .dev_down = pn533_dev_down,
3039         .dep_link_up = pn533_dep_link_up,
3040         .dep_link_down = pn533_dep_link_down,
3041         .start_poll = pn533_start_poll,
3042         .stop_poll = pn533_stop_poll,
3043         .activate_target = pn533_activate_target,
3044         .deactivate_target = pn533_deactivate_target,
3045         .im_transceive = pn533_transceive,
3046         .tm_send = pn533_tm_send,
3047 };
3048
3049 static int pn533_setup(struct pn533 *dev)
3050 {
3051         struct pn533_config_max_retries max_retries;
3052         struct pn533_config_timing timing;
3053         u8 pasori_cfg[3] = {0x08, 0x01, 0x08};
3054         int rc;
3055
3056         switch (dev->device_type) {
3057         case PN533_DEVICE_STD:
3058         case PN533_DEVICE_PASORI:
3059         case PN533_DEVICE_ACR122U:
3060                 max_retries.mx_rty_atr = 0x2;
3061                 max_retries.mx_rty_psl = 0x1;
3062                 max_retries.mx_rty_passive_act =
3063                         PN533_CONFIG_MAX_RETRIES_NO_RETRY;
3064
3065                 timing.rfu = PN533_CONFIG_TIMING_102;
3066                 timing.atr_res_timeout = PN533_CONFIG_TIMING_102;
3067                 timing.dep_timeout = PN533_CONFIG_TIMING_204;
3068
3069                 break;
3070
3071         default:
3072                 nfc_err(&dev->interface->dev, "Unknown device type %d\n",
3073                         dev->device_type);
3074                 return -EINVAL;
3075         }
3076
3077         rc = pn533_set_configuration(dev, PN533_CFGITEM_MAX_RETRIES,
3078                                      (u8 *)&max_retries, sizeof(max_retries));
3079         if (rc) {
3080                 nfc_err(&dev->interface->dev,
3081                         "Error on setting MAX_RETRIES config\n");
3082                 return rc;
3083         }
3084
3085
3086         rc = pn533_set_configuration(dev, PN533_CFGITEM_TIMING,
3087                                      (u8 *)&timing, sizeof(timing));
3088         if (rc) {
3089                 nfc_err(&dev->interface->dev, "Error on setting RF timings\n");
3090                 return rc;
3091         }
3092
3093         switch (dev->device_type) {
3094         case PN533_DEVICE_STD:
3095                 break;
3096
3097         case PN533_DEVICE_PASORI:
3098                 pn533_pasori_fw_reset(dev);
3099
3100                 rc = pn533_set_configuration(dev, PN533_CFGITEM_PASORI,
3101                                              pasori_cfg, 3);
3102                 if (rc) {
3103                         nfc_err(&dev->interface->dev,
3104                                 "Error while settings PASORI config\n");
3105                         return rc;
3106                 }
3107
3108                 pn533_pasori_fw_reset(dev);
3109
3110                 break;
3111         }
3112
3113         return 0;
3114 }
3115
3116 static int pn533_probe(struct usb_interface *interface,
3117                         const struct usb_device_id *id)
3118 {
3119         struct pn533_fw_version fw_ver;
3120         struct pn533 *dev;
3121         struct usb_host_interface *iface_desc;
3122         struct usb_endpoint_descriptor *endpoint;
3123         int in_endpoint = 0;
3124         int out_endpoint = 0;
3125         int rc = -ENOMEM;
3126         int i;
3127         u32 protocols;
3128
3129         dev = kzalloc(sizeof(*dev), GFP_KERNEL);
3130         if (!dev)
3131                 return -ENOMEM;
3132
3133         dev->udev = usb_get_dev(interface_to_usbdev(interface));
3134         dev->interface = interface;
3135         mutex_init(&dev->cmd_lock);
3136
3137         iface_desc = interface->cur_altsetting;
3138         for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
3139                 endpoint = &iface_desc->endpoint[i].desc;
3140
3141                 if (!in_endpoint && usb_endpoint_is_bulk_in(endpoint))
3142                         in_endpoint = endpoint->bEndpointAddress;
3143
3144                 if (!out_endpoint && usb_endpoint_is_bulk_out(endpoint))
3145                         out_endpoint = endpoint->bEndpointAddress;
3146         }
3147
3148         if (!in_endpoint || !out_endpoint) {
3149                 nfc_err(&interface->dev,
3150                         "Could not find bulk-in or bulk-out endpoint\n");
3151                 rc = -ENODEV;
3152                 goto error;
3153         }
3154
3155         dev->in_urb = usb_alloc_urb(0, GFP_KERNEL);
3156         dev->out_urb = usb_alloc_urb(0, GFP_KERNEL);
3157
3158         if (!dev->in_urb || !dev->out_urb)
3159                 goto error;
3160
3161         usb_fill_bulk_urb(dev->in_urb, dev->udev,
3162                           usb_rcvbulkpipe(dev->udev, in_endpoint),
3163                           NULL, 0, NULL, dev);
3164         usb_fill_bulk_urb(dev->out_urb, dev->udev,
3165                           usb_sndbulkpipe(dev->udev, out_endpoint),
3166                           NULL, 0, pn533_send_complete, dev);
3167
3168         INIT_WORK(&dev->cmd_work, pn533_wq_cmd);
3169         INIT_WORK(&dev->cmd_complete_work, pn533_wq_cmd_complete);
3170         INIT_WORK(&dev->mi_rx_work, pn533_wq_mi_recv);
3171         INIT_WORK(&dev->mi_tx_work, pn533_wq_mi_send);
3172         INIT_WORK(&dev->tg_work, pn533_wq_tg_get_data);
3173         INIT_WORK(&dev->mi_tm_rx_work, pn533_wq_tm_mi_recv);
3174         INIT_WORK(&dev->mi_tm_tx_work, pn533_wq_tm_mi_send);
3175         INIT_DELAYED_WORK(&dev->poll_work, pn533_wq_poll);
3176         INIT_WORK(&dev->rf_work, pn533_wq_rf);
3177         dev->wq = alloc_ordered_workqueue("pn533", 0);
3178         if (dev->wq == NULL)
3179                 goto error;
3180
3181         init_timer(&dev->listen_timer);
3182         dev->listen_timer.data = (unsigned long) dev;
3183         dev->listen_timer.function = pn533_listen_mode_timer;
3184
3185         skb_queue_head_init(&dev->resp_q);
3186         skb_queue_head_init(&dev->fragment_skb);
3187
3188         INIT_LIST_HEAD(&dev->cmd_queue);
3189
3190         usb_set_intfdata(interface, dev);
3191
3192         dev->ops = &pn533_std_frame_ops;
3193
3194         dev->protocol_type = PN533_PROTO_REQ_ACK_RESP;
3195         dev->device_type = id->driver_info;
3196         switch (dev->device_type) {
3197         case PN533_DEVICE_STD:
3198                 protocols = PN533_ALL_PROTOCOLS;
3199                 break;
3200
3201         case PN533_DEVICE_PASORI:
3202                 protocols = PN533_NO_TYPE_B_PROTOCOLS;
3203                 break;
3204
3205         case PN533_DEVICE_ACR122U:
3206                 protocols = PN533_NO_TYPE_B_PROTOCOLS;
3207                 dev->ops = &pn533_acr122_frame_ops;
3208                 dev->protocol_type = PN533_PROTO_REQ_RESP,
3209
3210                 rc = pn533_acr122_poweron_rdr(dev);
3211                 if (rc < 0) {
3212                         nfc_err(&dev->interface->dev,
3213                                 "Couldn't poweron the reader (error %d)\n", rc);
3214                         goto destroy_wq;
3215                 }
3216                 break;
3217
3218         default:
3219                 nfc_err(&dev->interface->dev, "Unknown device type %d\n",
3220                         dev->device_type);
3221                 rc = -EINVAL;
3222                 goto destroy_wq;
3223         }
3224
3225         memset(&fw_ver, 0, sizeof(fw_ver));
3226         rc = pn533_get_firmware_version(dev, &fw_ver);
3227         if (rc < 0)
3228                 goto destroy_wq;
3229
3230         nfc_info(&dev->interface->dev,
3231                  "NXP PN5%02X firmware ver %d.%d now attached\n",
3232                  fw_ver.ic, fw_ver.ver, fw_ver.rev);
3233
3234
3235         dev->nfc_dev = nfc_allocate_device(&pn533_nfc_ops, protocols,
3236                                            dev->ops->tx_header_len +
3237                                            PN533_CMD_DATAEXCH_HEAD_LEN,
3238                                            dev->ops->tx_tail_len);
3239         if (!dev->nfc_dev) {
3240                 rc = -ENOMEM;
3241                 goto destroy_wq;
3242         }
3243
3244         nfc_set_parent_dev(dev->nfc_dev, &interface->dev);
3245         nfc_set_drvdata(dev->nfc_dev, dev);
3246
3247         rc = nfc_register_device(dev->nfc_dev);
3248         if (rc)
3249                 goto free_nfc_dev;
3250
3251         rc = pn533_setup(dev);
3252         if (rc)
3253                 goto unregister_nfc_dev;
3254
3255         return 0;
3256
3257 unregister_nfc_dev:
3258         nfc_unregister_device(dev->nfc_dev);
3259
3260 free_nfc_dev:
3261         nfc_free_device(dev->nfc_dev);
3262
3263 destroy_wq:
3264         destroy_workqueue(dev->wq);
3265 error:
3266         usb_free_urb(dev->in_urb);
3267         usb_free_urb(dev->out_urb);
3268         usb_put_dev(dev->udev);
3269         kfree(dev);
3270         return rc;
3271 }
3272
3273 static void pn533_disconnect(struct usb_interface *interface)
3274 {
3275         struct pn533 *dev;
3276         struct pn533_cmd *cmd, *n;
3277
3278         dev = usb_get_intfdata(interface);
3279         usb_set_intfdata(interface, NULL);
3280
3281         nfc_unregister_device(dev->nfc_dev);
3282         nfc_free_device(dev->nfc_dev);
3283
3284         usb_kill_urb(dev->in_urb);
3285         usb_kill_urb(dev->out_urb);
3286
3287         flush_delayed_work(&dev->poll_work);
3288         destroy_workqueue(dev->wq);
3289
3290         skb_queue_purge(&dev->resp_q);
3291
3292         del_timer(&dev->listen_timer);
3293
3294         list_for_each_entry_safe(cmd, n, &dev->cmd_queue, queue) {
3295                 list_del(&cmd->queue);
3296                 kfree(cmd);
3297         }
3298
3299         usb_free_urb(dev->in_urb);
3300         usb_free_urb(dev->out_urb);
3301         kfree(dev);
3302
3303         nfc_info(&interface->dev, "NXP PN533 NFC device disconnected\n");
3304 }
3305
3306 static struct usb_driver pn533_driver = {
3307         .name =         "pn533",
3308         .probe =        pn533_probe,
3309         .disconnect =   pn533_disconnect,
3310         .id_table =     pn533_table,
3311 };
3312
3313 module_usb_driver(pn533_driver);
3314
3315 MODULE_AUTHOR("Lauro Ramos Venancio <lauro.venancio@openbossa.org>");
3316 MODULE_AUTHOR("Aloisio Almeida Jr <aloisio.almeida@openbossa.org>");
3317 MODULE_AUTHOR("Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>");
3318 MODULE_DESCRIPTION("PN533 usb driver ver " VERSION);
3319 MODULE_VERSION(VERSION);
3320 MODULE_LICENSE("GPL");