Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
[linux-3.10.git] / drivers / nfc / pn533.c
1 /*
2  * Copyright (C) 2011 Instituto Nokia de Tecnologia
3  *
4  * Authors:
5  *    Lauro Ramos Venancio <lauro.venancio@openbossa.org>
6  *    Aloisio Almeida Jr <aloisio.almeida@openbossa.org>
7  *
8  * This program is free software; you can redistribute it and/or modify
9  * it under the terms of the GNU General Public License as published by
10  * the Free Software Foundation; either version 2 of the License, or
11  * (at your option) any later version.
12  *
13  * This program is distributed in the hope that it will be useful,
14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16  * GNU General Public License for more details.
17  *
18  * You should have received a copy of the GNU General Public License
19  * along with this program; if not, write to the
20  * Free Software Foundation, Inc.,
21  * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
22  */
23
24 #include <linux/device.h>
25 #include <linux/kernel.h>
26 #include <linux/module.h>
27 #include <linux/slab.h>
28 #include <linux/usb.h>
29 #include <linux/nfc.h>
30 #include <linux/netdevice.h>
31 #include <net/nfc/nfc.h>
32
33 #define VERSION "0.1"
34
35 #define PN533_VENDOR_ID 0x4CC
36 #define PN533_PRODUCT_ID 0x2533
37
38 #define SCM_VENDOR_ID 0x4E6
39 #define SCL3711_PRODUCT_ID 0x5591
40
41 #define SONY_VENDOR_ID         0x054c
42 #define PASORI_PRODUCT_ID      0x02e1
43
44 #define PN533_QUIRKS_TYPE_A          BIT(0)
45 #define PN533_QUIRKS_TYPE_F          BIT(1)
46 #define PN533_QUIRKS_DEP             BIT(2)
47 #define PN533_QUIRKS_RAW_EXCHANGE    BIT(3)
48
49 #define PN533_DEVICE_STD    0x1
50 #define PN533_DEVICE_PASORI 0x2
51
52 #define PN533_ALL_PROTOCOLS (NFC_PROTO_JEWEL_MASK | NFC_PROTO_MIFARE_MASK |\
53                              NFC_PROTO_FELICA_MASK | NFC_PROTO_ISO14443_MASK |\
54                              NFC_PROTO_NFC_DEP_MASK |\
55                              NFC_PROTO_ISO14443_B_MASK)
56
57 #define PN533_NO_TYPE_B_PROTOCOLS (NFC_PROTO_JEWEL_MASK | \
58                                    NFC_PROTO_MIFARE_MASK | \
59                                    NFC_PROTO_FELICA_MASK | \
60                                    NFC_PROTO_ISO14443_MASK | \
61                                    NFC_PROTO_NFC_DEP_MASK)
62
63 static const struct usb_device_id pn533_table[] = {
64         { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE,
65           .idVendor             = PN533_VENDOR_ID,
66           .idProduct            = PN533_PRODUCT_ID,
67           .driver_info          = PN533_DEVICE_STD,
68         },
69         { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE,
70           .idVendor             = SCM_VENDOR_ID,
71           .idProduct            = SCL3711_PRODUCT_ID,
72           .driver_info          = PN533_DEVICE_STD,
73         },
74         { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE,
75           .idVendor             = SONY_VENDOR_ID,
76           .idProduct            = PASORI_PRODUCT_ID,
77           .driver_info          = PN533_DEVICE_PASORI,
78         },
79         { }
80 };
81 MODULE_DEVICE_TABLE(usb, pn533_table);
82
83 /* How much time we spend listening for initiators */
84 #define PN533_LISTEN_TIME 2
85
86 /* frame definitions */
87 #define PN533_NORMAL_FRAME_MAX_LEN 262  /* 6   (PREAMBLE, SOF, LEN, LCS, TFI)
88                                            254 (DATA)
89                                            2   (DCS, postamble) */
90
91 #define PN533_FRAME_TAIL_SIZE 2
92 #define PN533_FRAME_SIZE(f) (sizeof(struct pn533_frame) + f->datalen + \
93                                 PN533_FRAME_TAIL_SIZE)
94 #define PN533_FRAME_ACK_SIZE (sizeof(struct pn533_frame) + 1)
95 #define PN533_FRAME_CHECKSUM(f) (f->data[f->datalen])
96 #define PN533_FRAME_POSTAMBLE(f) (f->data[f->datalen + 1])
97
98 /* start of frame */
99 #define PN533_SOF 0x00FF
100
101 /* frame identifier: in/out/error */
102 #define PN533_FRAME_IDENTIFIER(f) (f->data[0])
103 #define PN533_DIR_OUT 0xD4
104 #define PN533_DIR_IN 0xD5
105
106 /* PN533 Commands */
107 #define PN533_FRAME_CMD(f) (f->data[1])
108 #define PN533_FRAME_CMD_PARAMS_PTR(f) (&f->data[2])
109 #define PN533_FRAME_CMD_PARAMS_LEN(f) (f->datalen - 2)
110
111 #define PN533_CMD_GET_FIRMWARE_VERSION 0x02
112 #define PN533_CMD_RF_CONFIGURATION 0x32
113 #define PN533_CMD_IN_DATA_EXCHANGE 0x40
114 #define PN533_CMD_IN_COMM_THRU     0x42
115 #define PN533_CMD_IN_LIST_PASSIVE_TARGET 0x4A
116 #define PN533_CMD_IN_ATR 0x50
117 #define PN533_CMD_IN_RELEASE 0x52
118 #define PN533_CMD_IN_JUMP_FOR_DEP 0x56
119
120 #define PN533_CMD_TG_INIT_AS_TARGET 0x8c
121 #define PN533_CMD_TG_GET_DATA 0x86
122 #define PN533_CMD_TG_SET_DATA 0x8e
123
124 #define PN533_CMD_RESPONSE(cmd) (cmd + 1)
125
126 /* PN533 Return codes */
127 #define PN533_CMD_RET_MASK 0x3F
128 #define PN533_CMD_MI_MASK 0x40
129 #define PN533_CMD_RET_SUCCESS 0x00
130
131 /* PN533 status codes */
132 #define PN533_STATUS_TARGET_RELEASED 0x29
133
134 struct pn533;
135
136 typedef int (*pn533_cmd_complete_t) (struct pn533 *dev, void *arg,
137                                         u8 *params, int params_len);
138
139 /* structs for pn533 commands */
140
141 /* PN533_CMD_GET_FIRMWARE_VERSION */
142 struct pn533_fw_version {
143         u8 ic;
144         u8 ver;
145         u8 rev;
146         u8 support;
147 };
148
149 /* PN533_CMD_RF_CONFIGURATION */
150 #define PN533_CFGITEM_TIMING 0x02
151 #define PN533_CFGITEM_MAX_RETRIES 0x05
152 #define PN533_CFGITEM_PASORI 0x82
153
154 #define PN533_CONFIG_TIMING_102 0xb
155 #define PN533_CONFIG_TIMING_204 0xc
156 #define PN533_CONFIG_TIMING_409 0xd
157 #define PN533_CONFIG_TIMING_819 0xe
158
159 #define PN533_CONFIG_MAX_RETRIES_NO_RETRY 0x00
160 #define PN533_CONFIG_MAX_RETRIES_ENDLESS 0xFF
161
162 struct pn533_config_max_retries {
163         u8 mx_rty_atr;
164         u8 mx_rty_psl;
165         u8 mx_rty_passive_act;
166 } __packed;
167
168 struct pn533_config_timing {
169         u8 rfu;
170         u8 atr_res_timeout;
171         u8 dep_timeout;
172 } __packed;
173
174 /* PN533_CMD_IN_LIST_PASSIVE_TARGET */
175
176 /* felica commands opcode */
177 #define PN533_FELICA_OPC_SENSF_REQ 0
178 #define PN533_FELICA_OPC_SENSF_RES 1
179 /* felica SENSF_REQ parameters */
180 #define PN533_FELICA_SENSF_SC_ALL 0xFFFF
181 #define PN533_FELICA_SENSF_RC_NO_SYSTEM_CODE 0
182 #define PN533_FELICA_SENSF_RC_SYSTEM_CODE 1
183 #define PN533_FELICA_SENSF_RC_ADVANCED_PROTOCOL 2
184
185 /* type B initiator_data values */
186 #define PN533_TYPE_B_AFI_ALL_FAMILIES 0
187 #define PN533_TYPE_B_POLL_METHOD_TIMESLOT 0
188 #define PN533_TYPE_B_POLL_METHOD_PROBABILISTIC 1
189
190 union pn533_cmd_poll_initdata {
191         struct {
192                 u8 afi;
193                 u8 polling_method;
194         } __packed type_b;
195         struct {
196                 u8 opcode;
197                 __be16 sc;
198                 u8 rc;
199                 u8 tsn;
200         } __packed felica;
201 };
202
203 /* Poll modulations */
204 enum {
205         PN533_POLL_MOD_106KBPS_A,
206         PN533_POLL_MOD_212KBPS_FELICA,
207         PN533_POLL_MOD_424KBPS_FELICA,
208         PN533_POLL_MOD_106KBPS_JEWEL,
209         PN533_POLL_MOD_847KBPS_B,
210         PN533_LISTEN_MOD,
211
212         __PN533_POLL_MOD_AFTER_LAST,
213 };
214 #define PN533_POLL_MOD_MAX (__PN533_POLL_MOD_AFTER_LAST - 1)
215
216 struct pn533_poll_modulations {
217         struct {
218                 u8 maxtg;
219                 u8 brty;
220                 union pn533_cmd_poll_initdata initiator_data;
221         } __packed data;
222         u8 len;
223 };
224
225 const struct pn533_poll_modulations poll_mod[] = {
226         [PN533_POLL_MOD_106KBPS_A] = {
227                 .data = {
228                         .maxtg = 1,
229                         .brty = 0,
230                 },
231                 .len = 2,
232         },
233         [PN533_POLL_MOD_212KBPS_FELICA] = {
234                 .data = {
235                         .maxtg = 1,
236                         .brty = 1,
237                         .initiator_data.felica = {
238                                 .opcode = PN533_FELICA_OPC_SENSF_REQ,
239                                 .sc = PN533_FELICA_SENSF_SC_ALL,
240                                 .rc = PN533_FELICA_SENSF_RC_NO_SYSTEM_CODE,
241                                 .tsn = 0,
242                         },
243                 },
244                 .len = 7,
245         },
246         [PN533_POLL_MOD_424KBPS_FELICA] = {
247                 .data = {
248                         .maxtg = 1,
249                         .brty = 2,
250                         .initiator_data.felica = {
251                                 .opcode = PN533_FELICA_OPC_SENSF_REQ,
252                                 .sc = PN533_FELICA_SENSF_SC_ALL,
253                                 .rc = PN533_FELICA_SENSF_RC_NO_SYSTEM_CODE,
254                                 .tsn = 0,
255                         },
256                  },
257                 .len = 7,
258         },
259         [PN533_POLL_MOD_106KBPS_JEWEL] = {
260                 .data = {
261                         .maxtg = 1,
262                         .brty = 4,
263                 },
264                 .len = 2,
265         },
266         [PN533_POLL_MOD_847KBPS_B] = {
267                 .data = {
268                         .maxtg = 1,
269                         .brty = 8,
270                         .initiator_data.type_b = {
271                                 .afi = PN533_TYPE_B_AFI_ALL_FAMILIES,
272                                 .polling_method =
273                                         PN533_TYPE_B_POLL_METHOD_TIMESLOT,
274                         },
275                 },
276                 .len = 3,
277         },
278         [PN533_LISTEN_MOD] = {
279                 .len = 0,
280         },
281 };
282
283 /* PN533_CMD_IN_ATR */
284
285 struct pn533_cmd_activate_param {
286         u8 tg;
287         u8 next;
288 } __packed;
289
290 struct pn533_cmd_activate_response {
291         u8 status;
292         u8 nfcid3t[10];
293         u8 didt;
294         u8 bst;
295         u8 brt;
296         u8 to;
297         u8 ppt;
298         /* optional */
299         u8 gt[];
300 } __packed;
301
302 /* PN533_CMD_IN_JUMP_FOR_DEP */
303 struct pn533_cmd_jump_dep {
304         u8 active;
305         u8 baud;
306         u8 next;
307         u8 data[];
308 } __packed;
309
310 struct pn533_cmd_jump_dep_response {
311         u8 status;
312         u8 tg;
313         u8 nfcid3t[10];
314         u8 didt;
315         u8 bst;
316         u8 brt;
317         u8 to;
318         u8 ppt;
319         /* optional */
320         u8 gt[];
321 } __packed;
322
323
324 /* PN533_TG_INIT_AS_TARGET */
325 #define PN533_INIT_TARGET_PASSIVE 0x1
326 #define PN533_INIT_TARGET_DEP 0x2
327
328 #define PN533_INIT_TARGET_RESP_FRAME_MASK 0x3
329 #define PN533_INIT_TARGET_RESP_ACTIVE     0x1
330 #define PN533_INIT_TARGET_RESP_DEP        0x4
331
332 struct pn533_cmd_init_target {
333         u8 mode;
334         u8 mifare[6];
335         u8 felica[18];
336         u8 nfcid3[10];
337         u8 gb_len;
338         u8 gb[];
339 } __packed;
340
341 struct pn533_cmd_init_target_response {
342         u8 mode;
343         u8 cmd[];
344 } __packed;
345
346 struct pn533 {
347         struct usb_device *udev;
348         struct usb_interface *interface;
349         struct nfc_dev *nfc_dev;
350
351         struct urb *out_urb;
352         int out_maxlen;
353         struct pn533_frame *out_frame;
354
355         struct urb *in_urb;
356         int in_maxlen;
357         struct pn533_frame *in_frame;
358
359         struct sk_buff_head resp_q;
360
361         struct workqueue_struct *wq;
362         struct work_struct cmd_work;
363         struct work_struct cmd_complete_work;
364         struct work_struct poll_work;
365         struct work_struct mi_work;
366         struct work_struct tg_work;
367         struct timer_list listen_timer;
368         struct pn533_frame *wq_in_frame;
369         int wq_in_error;
370         int cancel_listen;
371
372         pn533_cmd_complete_t cmd_complete;
373         void *cmd_complete_arg;
374         struct mutex cmd_lock;
375         u8 cmd;
376
377         struct pn533_poll_modulations *poll_mod_active[PN533_POLL_MOD_MAX + 1];
378         u8 poll_mod_count;
379         u8 poll_mod_curr;
380         u32 poll_protocols;
381         u32 listen_protocols;
382
383         u8 *gb;
384         size_t gb_len;
385
386         u8 tgt_available_prots;
387         u8 tgt_active_prot;
388         u8 tgt_mode;
389
390         u32 device_type;
391
392         struct list_head cmd_queue;
393         u8 cmd_pending;
394 };
395
396 struct pn533_cmd {
397         struct list_head queue;
398         struct pn533_frame *out_frame;
399         struct pn533_frame *in_frame;
400         int in_frame_len;
401         pn533_cmd_complete_t cmd_complete;
402         void *arg;
403         gfp_t flags;
404 };
405
406 struct pn533_frame {
407         u8 preamble;
408         __be16 start_frame;
409         u8 datalen;
410         u8 datalen_checksum;
411         u8 data[];
412 } __packed;
413
414 /* The rule: value + checksum = 0 */
415 static inline u8 pn533_checksum(u8 value)
416 {
417         return ~value + 1;
418 }
419
420 /* The rule: sum(data elements) + checksum = 0 */
421 static u8 pn533_data_checksum(u8 *data, int datalen)
422 {
423         u8 sum = 0;
424         int i;
425
426         for (i = 0; i < datalen; i++)
427                 sum += data[i];
428
429         return pn533_checksum(sum);
430 }
431
432 /**
433  * pn533_tx_frame_ack - create a ack frame
434  * @frame:      The frame to be set as ack
435  *
436  * Ack is different type of standard frame. As a standard frame, it has
437  * preamble and start_frame. However the checksum of this frame must fail,
438  * i.e. datalen + datalen_checksum must NOT be zero. When the checksum test
439  * fails and datalen = 0 and datalen_checksum = 0xFF, the frame is a ack.
440  * After datalen_checksum field, the postamble is placed.
441  */
442 static void pn533_tx_frame_ack(struct pn533_frame *frame)
443 {
444         frame->preamble = 0;
445         frame->start_frame = cpu_to_be16(PN533_SOF);
446         frame->datalen = 0;
447         frame->datalen_checksum = 0xFF;
448         /* data[0] is used as postamble */
449         frame->data[0] = 0;
450 }
451
452 static void pn533_tx_frame_init(struct pn533_frame *frame, u8 cmd)
453 {
454         frame->preamble = 0;
455         frame->start_frame = cpu_to_be16(PN533_SOF);
456         PN533_FRAME_IDENTIFIER(frame) = PN533_DIR_OUT;
457         PN533_FRAME_CMD(frame) = cmd;
458         frame->datalen = 2;
459 }
460
461 static void pn533_tx_frame_finish(struct pn533_frame *frame)
462 {
463         frame->datalen_checksum = pn533_checksum(frame->datalen);
464
465         PN533_FRAME_CHECKSUM(frame) =
466                 pn533_data_checksum(frame->data, frame->datalen);
467
468         PN533_FRAME_POSTAMBLE(frame) = 0;
469 }
470
471 static bool pn533_rx_frame_is_valid(struct pn533_frame *frame)
472 {
473         u8 checksum;
474
475         if (frame->start_frame != cpu_to_be16(PN533_SOF))
476                 return false;
477
478         checksum = pn533_checksum(frame->datalen);
479         if (checksum != frame->datalen_checksum)
480                 return false;
481
482         checksum = pn533_data_checksum(frame->data, frame->datalen);
483         if (checksum != PN533_FRAME_CHECKSUM(frame))
484                 return false;
485
486         return true;
487 }
488
489 static bool pn533_rx_frame_is_ack(struct pn533_frame *frame)
490 {
491         if (frame->start_frame != cpu_to_be16(PN533_SOF))
492                 return false;
493
494         if (frame->datalen != 0 || frame->datalen_checksum != 0xFF)
495                 return false;
496
497         return true;
498 }
499
500 static bool pn533_rx_frame_is_cmd_response(struct pn533_frame *frame, u8 cmd)
501 {
502         return (PN533_FRAME_CMD(frame) == PN533_CMD_RESPONSE(cmd));
503 }
504
505
506 static void pn533_wq_cmd_complete(struct work_struct *work)
507 {
508         struct pn533 *dev = container_of(work, struct pn533, cmd_complete_work);
509         struct pn533_frame *in_frame;
510         int rc;
511
512         in_frame = dev->wq_in_frame;
513
514         if (dev->wq_in_error)
515                 rc = dev->cmd_complete(dev, dev->cmd_complete_arg, NULL,
516                                                         dev->wq_in_error);
517         else
518                 rc = dev->cmd_complete(dev, dev->cmd_complete_arg,
519                                         PN533_FRAME_CMD_PARAMS_PTR(in_frame),
520                                         PN533_FRAME_CMD_PARAMS_LEN(in_frame));
521
522         if (rc != -EINPROGRESS)
523                 queue_work(dev->wq, &dev->cmd_work);
524 }
525
526 static void pn533_recv_response(struct urb *urb)
527 {
528         struct pn533 *dev = urb->context;
529         struct pn533_frame *in_frame;
530
531         dev->wq_in_frame = NULL;
532
533         switch (urb->status) {
534         case 0:
535                 /* success */
536                 break;
537         case -ECONNRESET:
538         case -ENOENT:
539         case -ESHUTDOWN:
540                 nfc_dev_dbg(&dev->interface->dev, "Urb shutting down with"
541                                                 " status: %d", urb->status);
542                 dev->wq_in_error = urb->status;
543                 goto sched_wq;
544         default:
545                 nfc_dev_err(&dev->interface->dev, "Nonzero urb status received:"
546                                                         " %d", urb->status);
547                 dev->wq_in_error = urb->status;
548                 goto sched_wq;
549         }
550
551         in_frame = dev->in_urb->transfer_buffer;
552
553         if (!pn533_rx_frame_is_valid(in_frame)) {
554                 nfc_dev_err(&dev->interface->dev, "Received an invalid frame");
555                 dev->wq_in_error = -EIO;
556                 goto sched_wq;
557         }
558
559         if (!pn533_rx_frame_is_cmd_response(in_frame, dev->cmd)) {
560                 nfc_dev_err(&dev->interface->dev, "The received frame is not "
561                                                 "response to the last command");
562                 dev->wq_in_error = -EIO;
563                 goto sched_wq;
564         }
565
566         nfc_dev_dbg(&dev->interface->dev, "Received a valid frame");
567         dev->wq_in_error = 0;
568         dev->wq_in_frame = in_frame;
569
570 sched_wq:
571         queue_work(dev->wq, &dev->cmd_complete_work);
572 }
573
574 static int pn533_submit_urb_for_response(struct pn533 *dev, gfp_t flags)
575 {
576         dev->in_urb->complete = pn533_recv_response;
577
578         return usb_submit_urb(dev->in_urb, flags);
579 }
580
581 static void pn533_recv_ack(struct urb *urb)
582 {
583         struct pn533 *dev = urb->context;
584         struct pn533_frame *in_frame;
585         int rc;
586
587         switch (urb->status) {
588         case 0:
589                 /* success */
590                 break;
591         case -ECONNRESET:
592         case -ENOENT:
593         case -ESHUTDOWN:
594                 nfc_dev_dbg(&dev->interface->dev, "Urb shutting down with"
595                                                 " status: %d", urb->status);
596                 dev->wq_in_error = urb->status;
597                 goto sched_wq;
598         default:
599                 nfc_dev_err(&dev->interface->dev, "Nonzero urb status received:"
600                                                         " %d", urb->status);
601                 dev->wq_in_error = urb->status;
602                 goto sched_wq;
603         }
604
605         in_frame = dev->in_urb->transfer_buffer;
606
607         if (!pn533_rx_frame_is_ack(in_frame)) {
608                 nfc_dev_err(&dev->interface->dev, "Received an invalid ack");
609                 dev->wq_in_error = -EIO;
610                 goto sched_wq;
611         }
612
613         nfc_dev_dbg(&dev->interface->dev, "Received a valid ack");
614
615         rc = pn533_submit_urb_for_response(dev, GFP_ATOMIC);
616         if (rc) {
617                 nfc_dev_err(&dev->interface->dev, "usb_submit_urb failed with"
618                                                         " result %d", rc);
619                 dev->wq_in_error = rc;
620                 goto sched_wq;
621         }
622
623         return;
624
625 sched_wq:
626         dev->wq_in_frame = NULL;
627         queue_work(dev->wq, &dev->cmd_complete_work);
628 }
629
630 static int pn533_submit_urb_for_ack(struct pn533 *dev, gfp_t flags)
631 {
632         dev->in_urb->complete = pn533_recv_ack;
633
634         return usb_submit_urb(dev->in_urb, flags);
635 }
636
637 static int pn533_send_ack(struct pn533 *dev, gfp_t flags)
638 {
639         int rc;
640
641         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
642
643         pn533_tx_frame_ack(dev->out_frame);
644
645         dev->out_urb->transfer_buffer = dev->out_frame;
646         dev->out_urb->transfer_buffer_length = PN533_FRAME_ACK_SIZE;
647         rc = usb_submit_urb(dev->out_urb, flags);
648
649         return rc;
650 }
651
652 static int __pn533_send_cmd_frame_async(struct pn533 *dev,
653                                         struct pn533_frame *out_frame,
654                                         struct pn533_frame *in_frame,
655                                         int in_frame_len,
656                                         pn533_cmd_complete_t cmd_complete,
657                                         void *arg, gfp_t flags)
658 {
659         int rc;
660
661         nfc_dev_dbg(&dev->interface->dev, "Sending command 0x%x",
662                                                 PN533_FRAME_CMD(out_frame));
663
664         dev->cmd = PN533_FRAME_CMD(out_frame);
665         dev->cmd_complete = cmd_complete;
666         dev->cmd_complete_arg = arg;
667
668         dev->out_urb->transfer_buffer = out_frame;
669         dev->out_urb->transfer_buffer_length =
670                                 PN533_FRAME_SIZE(out_frame);
671
672         dev->in_urb->transfer_buffer = in_frame;
673         dev->in_urb->transfer_buffer_length = in_frame_len;
674
675         rc = usb_submit_urb(dev->out_urb, flags);
676         if (rc)
677                 return rc;
678
679         rc = pn533_submit_urb_for_ack(dev, flags);
680         if (rc)
681                 goto error;
682
683         return 0;
684
685 error:
686         usb_unlink_urb(dev->out_urb);
687         return rc;
688 }
689
690 static void pn533_wq_cmd(struct work_struct *work)
691 {
692         struct pn533 *dev = container_of(work, struct pn533, cmd_work);
693         struct pn533_cmd *cmd;
694
695         mutex_lock(&dev->cmd_lock);
696
697         if (list_empty(&dev->cmd_queue)) {
698                 dev->cmd_pending = 0;
699                 mutex_unlock(&dev->cmd_lock);
700                 return;
701         }
702
703         cmd = list_first_entry(&dev->cmd_queue, struct pn533_cmd, queue);
704
705         list_del(&cmd->queue);
706
707         mutex_unlock(&dev->cmd_lock);
708
709         __pn533_send_cmd_frame_async(dev, cmd->out_frame, cmd->in_frame,
710                                      cmd->in_frame_len, cmd->cmd_complete,
711                                      cmd->arg, cmd->flags);
712
713         kfree(cmd);
714 }
715
716 static int pn533_send_cmd_frame_async(struct pn533 *dev,
717                                         struct pn533_frame *out_frame,
718                                         struct pn533_frame *in_frame,
719                                         int in_frame_len,
720                                         pn533_cmd_complete_t cmd_complete,
721                                         void *arg, gfp_t flags)
722 {
723         struct pn533_cmd *cmd;
724         int rc = 0;
725
726         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
727
728         mutex_lock(&dev->cmd_lock);
729
730         if (!dev->cmd_pending) {
731                 rc = __pn533_send_cmd_frame_async(dev, out_frame, in_frame,
732                                                   in_frame_len, cmd_complete,
733                                                   arg, flags);
734                 if (!rc)
735                         dev->cmd_pending = 1;
736
737                 goto unlock;
738         }
739
740         nfc_dev_dbg(&dev->interface->dev, "%s Queueing command", __func__);
741
742         cmd = kzalloc(sizeof(struct pn533_cmd), flags);
743         if (!cmd) {
744                 rc = -ENOMEM;
745                 goto unlock;
746         }
747
748         INIT_LIST_HEAD(&cmd->queue);
749         cmd->out_frame = out_frame;
750         cmd->in_frame = in_frame;
751         cmd->in_frame_len = in_frame_len;
752         cmd->cmd_complete = cmd_complete;
753         cmd->arg = arg;
754         cmd->flags = flags;
755
756         list_add_tail(&cmd->queue, &dev->cmd_queue);
757
758 unlock:
759         mutex_unlock(&dev->cmd_lock);
760
761         return rc;
762 }
763
764 struct pn533_sync_cmd_response {
765         int rc;
766         struct completion done;
767 };
768
769 static int pn533_sync_cmd_complete(struct pn533 *dev, void *_arg,
770                                         u8 *params, int params_len)
771 {
772         struct pn533_sync_cmd_response *arg = _arg;
773
774         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
775
776         arg->rc = 0;
777
778         if (params_len < 0) /* error */
779                 arg->rc = params_len;
780
781         complete(&arg->done);
782
783         return 0;
784 }
785
786 static int pn533_send_cmd_frame_sync(struct pn533 *dev,
787                                                 struct pn533_frame *out_frame,
788                                                 struct pn533_frame *in_frame,
789                                                 int in_frame_len)
790 {
791         int rc;
792         struct pn533_sync_cmd_response arg;
793
794         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
795
796         init_completion(&arg.done);
797
798         rc = pn533_send_cmd_frame_async(dev, out_frame, in_frame, in_frame_len,
799                                 pn533_sync_cmd_complete, &arg, GFP_KERNEL);
800         if (rc)
801                 return rc;
802
803         wait_for_completion(&arg.done);
804
805         return arg.rc;
806 }
807
808 static void pn533_send_complete(struct urb *urb)
809 {
810         struct pn533 *dev = urb->context;
811
812         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
813
814         switch (urb->status) {
815         case 0:
816                 /* success */
817                 break;
818         case -ECONNRESET:
819         case -ENOENT:
820         case -ESHUTDOWN:
821                 nfc_dev_dbg(&dev->interface->dev, "Urb shutting down with"
822                                                 " status: %d", urb->status);
823                 break;
824         default:
825                 nfc_dev_dbg(&dev->interface->dev, "Nonzero urb status received:"
826                                                         " %d", urb->status);
827         }
828 }
829
830 struct pn533_target_type_a {
831         __be16 sens_res;
832         u8 sel_res;
833         u8 nfcid_len;
834         u8 nfcid_data[];
835 } __packed;
836
837
838 #define PN533_TYPE_A_SENS_RES_NFCID1(x) ((u8)((be16_to_cpu(x) & 0x00C0) >> 6))
839 #define PN533_TYPE_A_SENS_RES_SSD(x) ((u8)((be16_to_cpu(x) & 0x001F) >> 0))
840 #define PN533_TYPE_A_SENS_RES_PLATCONF(x) ((u8)((be16_to_cpu(x) & 0x0F00) >> 8))
841
842 #define PN533_TYPE_A_SENS_RES_SSD_JEWEL 0x00
843 #define PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL 0x0C
844
845 #define PN533_TYPE_A_SEL_PROT(x) (((x) & 0x60) >> 5)
846 #define PN533_TYPE_A_SEL_CASCADE(x) (((x) & 0x04) >> 2)
847
848 #define PN533_TYPE_A_SEL_PROT_MIFARE 0
849 #define PN533_TYPE_A_SEL_PROT_ISO14443 1
850 #define PN533_TYPE_A_SEL_PROT_DEP 2
851 #define PN533_TYPE_A_SEL_PROT_ISO14443_DEP 3
852
853 static bool pn533_target_type_a_is_valid(struct pn533_target_type_a *type_a,
854                                                         int target_data_len)
855 {
856         u8 ssd;
857         u8 platconf;
858
859         if (target_data_len < sizeof(struct pn533_target_type_a))
860                 return false;
861
862         /* The lenght check of nfcid[] and ats[] are not being performed because
863            the values are not being used */
864
865         /* Requirement 4.6.3.3 from NFC Forum Digital Spec */
866         ssd = PN533_TYPE_A_SENS_RES_SSD(type_a->sens_res);
867         platconf = PN533_TYPE_A_SENS_RES_PLATCONF(type_a->sens_res);
868
869         if ((ssd == PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
870                         platconf != PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL) ||
871                         (ssd != PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
872                         platconf == PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL))
873                 return false;
874
875         /* Requirements 4.8.2.1, 4.8.2.3, 4.8.2.5 and 4.8.2.7 from NFC Forum */
876         if (PN533_TYPE_A_SEL_CASCADE(type_a->sel_res) != 0)
877                 return false;
878
879         return true;
880 }
881
882 static int pn533_target_found_type_a(struct nfc_target *nfc_tgt, u8 *tgt_data,
883                                                         int tgt_data_len)
884 {
885         struct pn533_target_type_a *tgt_type_a;
886
887         tgt_type_a = (struct pn533_target_type_a *) tgt_data;
888
889         if (!pn533_target_type_a_is_valid(tgt_type_a, tgt_data_len))
890                 return -EPROTO;
891
892         switch (PN533_TYPE_A_SEL_PROT(tgt_type_a->sel_res)) {
893         case PN533_TYPE_A_SEL_PROT_MIFARE:
894                 nfc_tgt->supported_protocols = NFC_PROTO_MIFARE_MASK;
895                 break;
896         case PN533_TYPE_A_SEL_PROT_ISO14443:
897                 nfc_tgt->supported_protocols = NFC_PROTO_ISO14443_MASK;
898                 break;
899         case PN533_TYPE_A_SEL_PROT_DEP:
900                 nfc_tgt->supported_protocols = NFC_PROTO_NFC_DEP_MASK;
901                 break;
902         case PN533_TYPE_A_SEL_PROT_ISO14443_DEP:
903                 nfc_tgt->supported_protocols = NFC_PROTO_ISO14443_MASK |
904                                                         NFC_PROTO_NFC_DEP_MASK;
905                 break;
906         }
907
908         nfc_tgt->sens_res = be16_to_cpu(tgt_type_a->sens_res);
909         nfc_tgt->sel_res = tgt_type_a->sel_res;
910         nfc_tgt->nfcid1_len = tgt_type_a->nfcid_len;
911         memcpy(nfc_tgt->nfcid1, tgt_type_a->nfcid_data, nfc_tgt->nfcid1_len);
912
913         return 0;
914 }
915
916 struct pn533_target_felica {
917         u8 pol_res;
918         u8 opcode;
919         u8 nfcid2[8];
920         u8 pad[8];
921         /* optional */
922         u8 syst_code[];
923 } __packed;
924
925 #define PN533_FELICA_SENSF_NFCID2_DEP_B1 0x01
926 #define PN533_FELICA_SENSF_NFCID2_DEP_B2 0xFE
927
928 static bool pn533_target_felica_is_valid(struct pn533_target_felica *felica,
929                                                         int target_data_len)
930 {
931         if (target_data_len < sizeof(struct pn533_target_felica))
932                 return false;
933
934         if (felica->opcode != PN533_FELICA_OPC_SENSF_RES)
935                 return false;
936
937         return true;
938 }
939
940 static int pn533_target_found_felica(struct nfc_target *nfc_tgt, u8 *tgt_data,
941                                                         int tgt_data_len)
942 {
943         struct pn533_target_felica *tgt_felica;
944
945         tgt_felica = (struct pn533_target_felica *) tgt_data;
946
947         if (!pn533_target_felica_is_valid(tgt_felica, tgt_data_len))
948                 return -EPROTO;
949
950         if (tgt_felica->nfcid2[0] == PN533_FELICA_SENSF_NFCID2_DEP_B1 &&
951                                         tgt_felica->nfcid2[1] ==
952                                         PN533_FELICA_SENSF_NFCID2_DEP_B2)
953                 nfc_tgt->supported_protocols = NFC_PROTO_NFC_DEP_MASK;
954         else
955                 nfc_tgt->supported_protocols = NFC_PROTO_FELICA_MASK;
956
957         memcpy(nfc_tgt->sensf_res, &tgt_felica->opcode, 9);
958         nfc_tgt->sensf_res_len = 9;
959
960         return 0;
961 }
962
963 struct pn533_target_jewel {
964         __be16 sens_res;
965         u8 jewelid[4];
966 } __packed;
967
968 static bool pn533_target_jewel_is_valid(struct pn533_target_jewel *jewel,
969                                                         int target_data_len)
970 {
971         u8 ssd;
972         u8 platconf;
973
974         if (target_data_len < sizeof(struct pn533_target_jewel))
975                 return false;
976
977         /* Requirement 4.6.3.3 from NFC Forum Digital Spec */
978         ssd = PN533_TYPE_A_SENS_RES_SSD(jewel->sens_res);
979         platconf = PN533_TYPE_A_SENS_RES_PLATCONF(jewel->sens_res);
980
981         if ((ssd == PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
982                         platconf != PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL) ||
983                         (ssd != PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
984                         platconf == PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL))
985                 return false;
986
987         return true;
988 }
989
990 static int pn533_target_found_jewel(struct nfc_target *nfc_tgt, u8 *tgt_data,
991                                                         int tgt_data_len)
992 {
993         struct pn533_target_jewel *tgt_jewel;
994
995         tgt_jewel = (struct pn533_target_jewel *) tgt_data;
996
997         if (!pn533_target_jewel_is_valid(tgt_jewel, tgt_data_len))
998                 return -EPROTO;
999
1000         nfc_tgt->supported_protocols = NFC_PROTO_JEWEL_MASK;
1001         nfc_tgt->sens_res = be16_to_cpu(tgt_jewel->sens_res);
1002         nfc_tgt->nfcid1_len = 4;
1003         memcpy(nfc_tgt->nfcid1, tgt_jewel->jewelid, nfc_tgt->nfcid1_len);
1004
1005         return 0;
1006 }
1007
1008 struct pn533_type_b_prot_info {
1009         u8 bitrate;
1010         u8 fsci_type;
1011         u8 fwi_adc_fo;
1012 } __packed;
1013
1014 #define PN533_TYPE_B_PROT_FCSI(x) (((x) & 0xF0) >> 4)
1015 #define PN533_TYPE_B_PROT_TYPE(x) (((x) & 0x0F) >> 0)
1016 #define PN533_TYPE_B_PROT_TYPE_RFU_MASK 0x8
1017
1018 struct pn533_type_b_sens_res {
1019         u8 opcode;
1020         u8 nfcid[4];
1021         u8 appdata[4];
1022         struct pn533_type_b_prot_info prot_info;
1023 } __packed;
1024
1025 #define PN533_TYPE_B_OPC_SENSB_RES 0x50
1026
1027 struct pn533_target_type_b {
1028         struct pn533_type_b_sens_res sensb_res;
1029         u8 attrib_res_len;
1030         u8 attrib_res[];
1031 } __packed;
1032
1033 static bool pn533_target_type_b_is_valid(struct pn533_target_type_b *type_b,
1034                                                         int target_data_len)
1035 {
1036         if (target_data_len < sizeof(struct pn533_target_type_b))
1037                 return false;
1038
1039         if (type_b->sensb_res.opcode != PN533_TYPE_B_OPC_SENSB_RES)
1040                 return false;
1041
1042         if (PN533_TYPE_B_PROT_TYPE(type_b->sensb_res.prot_info.fsci_type) &
1043                                                 PN533_TYPE_B_PROT_TYPE_RFU_MASK)
1044                 return false;
1045
1046         return true;
1047 }
1048
1049 static int pn533_target_found_type_b(struct nfc_target *nfc_tgt, u8 *tgt_data,
1050                                                         int tgt_data_len)
1051 {
1052         struct pn533_target_type_b *tgt_type_b;
1053
1054         tgt_type_b = (struct pn533_target_type_b *) tgt_data;
1055
1056         if (!pn533_target_type_b_is_valid(tgt_type_b, tgt_data_len))
1057                 return -EPROTO;
1058
1059         nfc_tgt->supported_protocols = NFC_PROTO_ISO14443_B_MASK;
1060
1061         return 0;
1062 }
1063
1064 struct pn533_poll_response {
1065         u8 nbtg;
1066         u8 tg;
1067         u8 target_data[];
1068 } __packed;
1069
1070 static int pn533_target_found(struct pn533 *dev,
1071                         struct pn533_poll_response *resp, int resp_len)
1072 {
1073         int target_data_len;
1074         struct nfc_target nfc_tgt;
1075         int rc;
1076
1077         nfc_dev_dbg(&dev->interface->dev, "%s - modulation=%d", __func__,
1078                                                         dev->poll_mod_curr);
1079
1080         if (resp->tg != 1)
1081                 return -EPROTO;
1082
1083         memset(&nfc_tgt, 0, sizeof(struct nfc_target));
1084
1085         target_data_len = resp_len - sizeof(struct pn533_poll_response);
1086
1087         switch (dev->poll_mod_curr) {
1088         case PN533_POLL_MOD_106KBPS_A:
1089                 rc = pn533_target_found_type_a(&nfc_tgt, resp->target_data,
1090                                                         target_data_len);
1091                 break;
1092         case PN533_POLL_MOD_212KBPS_FELICA:
1093         case PN533_POLL_MOD_424KBPS_FELICA:
1094                 rc = pn533_target_found_felica(&nfc_tgt, resp->target_data,
1095                                                         target_data_len);
1096                 break;
1097         case PN533_POLL_MOD_106KBPS_JEWEL:
1098                 rc = pn533_target_found_jewel(&nfc_tgt, resp->target_data,
1099                                                         target_data_len);
1100                 break;
1101         case PN533_POLL_MOD_847KBPS_B:
1102                 rc = pn533_target_found_type_b(&nfc_tgt, resp->target_data,
1103                                                         target_data_len);
1104                 break;
1105         default:
1106                 nfc_dev_err(&dev->interface->dev, "Unknown current poll"
1107                                                                 " modulation");
1108                 return -EPROTO;
1109         }
1110
1111         if (rc)
1112                 return rc;
1113
1114         if (!(nfc_tgt.supported_protocols & dev->poll_protocols)) {
1115                 nfc_dev_dbg(&dev->interface->dev, "The target found does not"
1116                                                 " have the desired protocol");
1117                 return -EAGAIN;
1118         }
1119
1120         nfc_dev_dbg(&dev->interface->dev, "Target found - supported protocols: "
1121                                         "0x%x", nfc_tgt.supported_protocols);
1122
1123         dev->tgt_available_prots = nfc_tgt.supported_protocols;
1124
1125         nfc_targets_found(dev->nfc_dev, &nfc_tgt, 1);
1126
1127         return 0;
1128 }
1129
1130 static inline void pn533_poll_next_mod(struct pn533 *dev)
1131 {
1132         dev->poll_mod_curr = (dev->poll_mod_curr + 1) % dev->poll_mod_count;
1133 }
1134
1135 static void pn533_poll_reset_mod_list(struct pn533 *dev)
1136 {
1137         dev->poll_mod_count = 0;
1138 }
1139
1140 static void pn533_poll_add_mod(struct pn533 *dev, u8 mod_index)
1141 {
1142         dev->poll_mod_active[dev->poll_mod_count] =
1143                 (struct pn533_poll_modulations *) &poll_mod[mod_index];
1144         dev->poll_mod_count++;
1145 }
1146
1147 static void pn533_poll_create_mod_list(struct pn533 *dev,
1148                                        u32 im_protocols, u32 tm_protocols)
1149 {
1150         pn533_poll_reset_mod_list(dev);
1151
1152         if (im_protocols & NFC_PROTO_MIFARE_MASK
1153             || im_protocols & NFC_PROTO_ISO14443_MASK
1154             || im_protocols & NFC_PROTO_NFC_DEP_MASK)
1155                 pn533_poll_add_mod(dev, PN533_POLL_MOD_106KBPS_A);
1156
1157         if (im_protocols & NFC_PROTO_FELICA_MASK
1158             || im_protocols & NFC_PROTO_NFC_DEP_MASK) {
1159                 pn533_poll_add_mod(dev, PN533_POLL_MOD_212KBPS_FELICA);
1160                 pn533_poll_add_mod(dev, PN533_POLL_MOD_424KBPS_FELICA);
1161         }
1162
1163         if (im_protocols & NFC_PROTO_JEWEL_MASK)
1164                 pn533_poll_add_mod(dev, PN533_POLL_MOD_106KBPS_JEWEL);
1165
1166         if (im_protocols & NFC_PROTO_ISO14443_B_MASK)
1167                 pn533_poll_add_mod(dev, PN533_POLL_MOD_847KBPS_B);
1168
1169         if (tm_protocols)
1170                 pn533_poll_add_mod(dev, PN533_LISTEN_MOD);
1171 }
1172
1173 static int pn533_start_poll_complete(struct pn533 *dev, u8 *params, int params_len)
1174 {
1175         struct pn533_poll_response *resp;
1176         int rc;
1177
1178         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1179
1180         resp = (struct pn533_poll_response *) params;
1181         if (resp->nbtg) {
1182                 rc = pn533_target_found(dev, resp, params_len);
1183
1184                 /* We must stop the poll after a valid target found */
1185                 if (rc == 0) {
1186                         pn533_poll_reset_mod_list(dev);
1187                         return 0;
1188                 }
1189         }
1190
1191         return -EAGAIN;
1192 }
1193
1194 static int pn533_init_target_frame(struct pn533_frame *frame,
1195                                    u8 *gb, size_t gb_len)
1196 {
1197         struct pn533_cmd_init_target *cmd;
1198         size_t cmd_len;
1199         u8 felica_params[18] = {0x1, 0xfe, /* DEP */
1200                                 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, /* random */
1201                                 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
1202                                 0xff, 0xff}; /* System code */
1203         u8 mifare_params[6] = {0x1, 0x1, /* SENS_RES */
1204                                0x0, 0x0, 0x0,
1205                                0x40}; /* SEL_RES for DEP */
1206
1207         cmd_len = sizeof(struct pn533_cmd_init_target) + gb_len + 1;
1208         cmd = kzalloc(cmd_len, GFP_KERNEL);
1209         if (cmd == NULL)
1210                 return -ENOMEM;
1211
1212         pn533_tx_frame_init(frame, PN533_CMD_TG_INIT_AS_TARGET);
1213
1214         /* DEP support only */
1215         cmd->mode |= PN533_INIT_TARGET_DEP;
1216
1217         /* Felica params */
1218         memcpy(cmd->felica, felica_params, 18);
1219         get_random_bytes(cmd->felica + 2, 6);
1220
1221         /* NFCID3 */
1222         memset(cmd->nfcid3, 0, 10);
1223         memcpy(cmd->nfcid3, cmd->felica, 8);
1224
1225         /* MIFARE params */
1226         memcpy(cmd->mifare, mifare_params, 6);
1227
1228         /* General bytes */
1229         cmd->gb_len = gb_len;
1230         memcpy(cmd->gb, gb, gb_len);
1231
1232         /* Len Tk */
1233         cmd->gb[gb_len] = 0;
1234
1235         memcpy(PN533_FRAME_CMD_PARAMS_PTR(frame), cmd, cmd_len);
1236
1237         frame->datalen += cmd_len;
1238
1239         pn533_tx_frame_finish(frame);
1240
1241         kfree(cmd);
1242
1243         return 0;
1244 }
1245
1246 #define PN533_CMD_DATAEXCH_HEAD_LEN (sizeof(struct pn533_frame) + 3)
1247 #define PN533_CMD_DATAEXCH_DATA_MAXLEN 262
1248 static int pn533_tm_get_data_complete(struct pn533 *dev, void *arg,
1249                                       u8 *params, int params_len)
1250 {
1251         struct sk_buff *skb_resp = arg;
1252         struct pn533_frame *in_frame = (struct pn533_frame *) skb_resp->data;
1253
1254         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1255
1256         if (params_len < 0) {
1257                 nfc_dev_err(&dev->interface->dev,
1258                             "Error %d when starting as a target",
1259                             params_len);
1260
1261                 return params_len;
1262         }
1263
1264         if (params_len > 0 && params[0] != 0) {
1265                 nfc_tm_deactivated(dev->nfc_dev);
1266
1267                 dev->tgt_mode = 0;
1268
1269                 kfree_skb(skb_resp);
1270                 return 0;
1271         }
1272
1273         skb_put(skb_resp, PN533_FRAME_SIZE(in_frame));
1274         skb_pull(skb_resp, PN533_CMD_DATAEXCH_HEAD_LEN);
1275         skb_trim(skb_resp, skb_resp->len - PN533_FRAME_TAIL_SIZE);
1276
1277         return nfc_tm_data_received(dev->nfc_dev, skb_resp);
1278 }
1279
1280 static void pn533_wq_tg_get_data(struct work_struct *work)
1281 {
1282         struct pn533 *dev = container_of(work, struct pn533, tg_work);
1283         struct pn533_frame *in_frame;
1284         struct sk_buff *skb_resp;
1285         size_t skb_resp_len;
1286
1287         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1288
1289         skb_resp_len = PN533_CMD_DATAEXCH_HEAD_LEN +
1290                 PN533_CMD_DATAEXCH_DATA_MAXLEN +
1291                 PN533_FRAME_TAIL_SIZE;
1292
1293         skb_resp = nfc_alloc_recv_skb(skb_resp_len, GFP_KERNEL);
1294         if (!skb_resp)
1295                 return;
1296
1297         in_frame = (struct pn533_frame *)skb_resp->data;
1298
1299         pn533_tx_frame_init(dev->out_frame, PN533_CMD_TG_GET_DATA);
1300         pn533_tx_frame_finish(dev->out_frame);
1301
1302         pn533_send_cmd_frame_async(dev, dev->out_frame, in_frame,
1303                                    skb_resp_len,
1304                                    pn533_tm_get_data_complete,
1305                                    skb_resp, GFP_KERNEL);
1306
1307         return;
1308 }
1309
1310 #define ATR_REQ_GB_OFFSET 17
1311 static int pn533_init_target_complete(struct pn533 *dev, u8 *params, int params_len)
1312 {
1313         struct pn533_cmd_init_target_response *resp;
1314         u8 frame, comm_mode = NFC_COMM_PASSIVE, *gb;
1315         size_t gb_len;
1316         int rc;
1317
1318         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1319
1320         if (params_len < 0) {
1321                 nfc_dev_err(&dev->interface->dev,
1322                             "Error %d when starting as a target",
1323                             params_len);
1324
1325                 return params_len;
1326         }
1327
1328         if (params_len < ATR_REQ_GB_OFFSET + 1)
1329                 return -EINVAL;
1330
1331         resp = (struct pn533_cmd_init_target_response *) params;
1332
1333         nfc_dev_dbg(&dev->interface->dev, "Target mode 0x%x param len %d\n",
1334                     resp->mode, params_len);
1335
1336         frame = resp->mode & PN533_INIT_TARGET_RESP_FRAME_MASK;
1337         if (frame == PN533_INIT_TARGET_RESP_ACTIVE)
1338                 comm_mode = NFC_COMM_ACTIVE;
1339
1340         /* Again, only DEP */
1341         if ((resp->mode & PN533_INIT_TARGET_RESP_DEP) == 0)
1342                 return -EOPNOTSUPP;
1343
1344         gb = resp->cmd + ATR_REQ_GB_OFFSET;
1345         gb_len = params_len - (ATR_REQ_GB_OFFSET + 1);
1346
1347         rc = nfc_tm_activated(dev->nfc_dev, NFC_PROTO_NFC_DEP_MASK,
1348                               comm_mode, gb, gb_len);
1349         if (rc < 0) {
1350                 nfc_dev_err(&dev->interface->dev,
1351                             "Error when signaling target activation");
1352                 return rc;
1353         }
1354
1355         dev->tgt_mode = 1;
1356
1357         queue_work(dev->wq, &dev->tg_work);
1358
1359         return 0;
1360 }
1361
1362 static void pn533_listen_mode_timer(unsigned long data)
1363 {
1364         struct pn533 *dev = (struct pn533 *) data;
1365
1366         nfc_dev_dbg(&dev->interface->dev, "Listen mode timeout");
1367
1368         /* An ack will cancel the last issued command (poll) */
1369         pn533_send_ack(dev, GFP_ATOMIC);
1370
1371         dev->cancel_listen = 1;
1372
1373         pn533_poll_next_mod(dev);
1374
1375         queue_work(dev->wq, &dev->poll_work);
1376 }
1377
1378 static int pn533_poll_complete(struct pn533 *dev, void *arg,
1379                                u8 *params, int params_len)
1380 {
1381         struct pn533_poll_modulations *cur_mod;
1382         int rc;
1383
1384         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1385
1386         if (params_len == -ENOENT) {
1387                 if (dev->poll_mod_count != 0)
1388                         return 0;
1389
1390                 nfc_dev_err(&dev->interface->dev,
1391                             "Polling operation has been stopped");
1392
1393                 goto stop_poll;
1394         }
1395
1396         if (params_len < 0) {
1397                 nfc_dev_err(&dev->interface->dev,
1398                             "Error %d when running poll", params_len);
1399
1400                 goto stop_poll;
1401         }
1402
1403         cur_mod = dev->poll_mod_active[dev->poll_mod_curr];
1404
1405         if (cur_mod->len == 0) {
1406                 del_timer(&dev->listen_timer);
1407
1408                 return pn533_init_target_complete(dev, params, params_len);
1409         } else {
1410                 rc = pn533_start_poll_complete(dev, params, params_len);
1411                 if (!rc)
1412                         return rc;
1413         }
1414
1415         pn533_poll_next_mod(dev);
1416
1417         queue_work(dev->wq, &dev->poll_work);
1418
1419         return 0;
1420
1421 stop_poll:
1422         pn533_poll_reset_mod_list(dev);
1423         dev->poll_protocols = 0;
1424         return 0;
1425 }
1426
1427 static void pn533_build_poll_frame(struct pn533 *dev,
1428                                    struct pn533_frame *frame,
1429                                    struct pn533_poll_modulations *mod)
1430 {
1431         nfc_dev_dbg(&dev->interface->dev, "mod len %d\n", mod->len);
1432
1433         if (mod->len == 0) {
1434                 /* Listen mode */
1435                 pn533_init_target_frame(frame, dev->gb, dev->gb_len);
1436         } else {
1437                 /* Polling mode */
1438                 pn533_tx_frame_init(frame, PN533_CMD_IN_LIST_PASSIVE_TARGET);
1439
1440                 memcpy(PN533_FRAME_CMD_PARAMS_PTR(frame), &mod->data, mod->len);
1441                 frame->datalen += mod->len;
1442
1443                 pn533_tx_frame_finish(frame);
1444         }
1445 }
1446
1447 static int pn533_send_poll_frame(struct pn533 *dev)
1448 {
1449         struct pn533_poll_modulations *cur_mod;
1450         int rc;
1451
1452         cur_mod = dev->poll_mod_active[dev->poll_mod_curr];
1453
1454         pn533_build_poll_frame(dev, dev->out_frame, cur_mod);
1455
1456         rc = pn533_send_cmd_frame_async(dev, dev->out_frame, dev->in_frame,
1457                                 dev->in_maxlen, pn533_poll_complete,
1458                                 NULL, GFP_KERNEL);
1459         if (rc)
1460                 nfc_dev_err(&dev->interface->dev, "Polling loop error %d", rc);
1461
1462         return rc;
1463 }
1464
1465 static void pn533_wq_poll(struct work_struct *work)
1466 {
1467         struct pn533 *dev = container_of(work, struct pn533, poll_work);
1468         struct pn533_poll_modulations *cur_mod;
1469         int rc;
1470
1471         cur_mod = dev->poll_mod_active[dev->poll_mod_curr];
1472
1473         nfc_dev_dbg(&dev->interface->dev,
1474                     "%s cancel_listen %d modulation len %d",
1475                     __func__, dev->cancel_listen, cur_mod->len);
1476
1477         if (dev->cancel_listen == 1) {
1478                 dev->cancel_listen = 0;
1479                 usb_kill_urb(dev->in_urb);
1480         }
1481
1482         rc = pn533_send_poll_frame(dev);
1483         if (rc)
1484                 return;
1485
1486         if (cur_mod->len == 0 && dev->poll_mod_count > 1)
1487                 mod_timer(&dev->listen_timer, jiffies + PN533_LISTEN_TIME * HZ);
1488
1489         return;
1490 }
1491
1492 static int pn533_start_poll(struct nfc_dev *nfc_dev,
1493                             u32 im_protocols, u32 tm_protocols)
1494 {
1495         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
1496
1497         nfc_dev_dbg(&dev->interface->dev,
1498                     "%s: im protocols 0x%x tm protocols 0x%x",
1499                     __func__, im_protocols, tm_protocols);
1500
1501         if (dev->tgt_active_prot) {
1502                 nfc_dev_err(&dev->interface->dev,
1503                             "Cannot poll with a target already activated");
1504                 return -EBUSY;
1505         }
1506
1507         if (dev->tgt_mode) {
1508                 nfc_dev_err(&dev->interface->dev,
1509                             "Cannot poll while already being activated");
1510                 return -EBUSY;
1511         }
1512
1513         if (tm_protocols) {
1514                 dev->gb = nfc_get_local_general_bytes(nfc_dev, &dev->gb_len);
1515                 if (dev->gb == NULL)
1516                         tm_protocols = 0;
1517         }
1518
1519         dev->poll_mod_curr = 0;
1520         pn533_poll_create_mod_list(dev, im_protocols, tm_protocols);
1521         dev->poll_protocols = im_protocols;
1522         dev->listen_protocols = tm_protocols;
1523
1524         return pn533_send_poll_frame(dev);
1525 }
1526
1527 static void pn533_stop_poll(struct nfc_dev *nfc_dev)
1528 {
1529         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
1530
1531         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1532
1533         del_timer(&dev->listen_timer);
1534
1535         if (!dev->poll_mod_count) {
1536                 nfc_dev_dbg(&dev->interface->dev, "Polling operation was not"
1537                                                                 " running");
1538                 return;
1539         }
1540
1541         /* An ack will cancel the last issued command (poll) */
1542         pn533_send_ack(dev, GFP_KERNEL);
1543
1544         /* prevent pn533_start_poll_complete to issue a new poll meanwhile */
1545         usb_kill_urb(dev->in_urb);
1546
1547         pn533_poll_reset_mod_list(dev);
1548 }
1549
1550 static int pn533_activate_target_nfcdep(struct pn533 *dev)
1551 {
1552         struct pn533_cmd_activate_param param;
1553         struct pn533_cmd_activate_response *resp;
1554         u16 gt_len;
1555         int rc;
1556
1557         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1558
1559         pn533_tx_frame_init(dev->out_frame, PN533_CMD_IN_ATR);
1560
1561         param.tg = 1;
1562         param.next = 0;
1563         memcpy(PN533_FRAME_CMD_PARAMS_PTR(dev->out_frame), &param,
1564                                 sizeof(struct pn533_cmd_activate_param));
1565         dev->out_frame->datalen += sizeof(struct pn533_cmd_activate_param);
1566
1567         pn533_tx_frame_finish(dev->out_frame);
1568
1569         rc = pn533_send_cmd_frame_sync(dev, dev->out_frame, dev->in_frame,
1570                                                                 dev->in_maxlen);
1571         if (rc)
1572                 return rc;
1573
1574         resp = (struct pn533_cmd_activate_response *)
1575                                 PN533_FRAME_CMD_PARAMS_PTR(dev->in_frame);
1576         rc = resp->status & PN533_CMD_RET_MASK;
1577         if (rc != PN533_CMD_RET_SUCCESS)
1578                 return -EIO;
1579
1580         /* ATR_RES general bytes are located at offset 16 */
1581         gt_len = PN533_FRAME_CMD_PARAMS_LEN(dev->in_frame) - 16;
1582         rc = nfc_set_remote_general_bytes(dev->nfc_dev, resp->gt, gt_len);
1583
1584         return rc;
1585 }
1586
1587 static int pn533_activate_target(struct nfc_dev *nfc_dev,
1588                                  struct nfc_target *target, u32 protocol)
1589 {
1590         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
1591         int rc;
1592
1593         nfc_dev_dbg(&dev->interface->dev, "%s - protocol=%u", __func__,
1594                                                                 protocol);
1595
1596         if (dev->poll_mod_count) {
1597                 nfc_dev_err(&dev->interface->dev, "Cannot activate while"
1598                                                                 " polling");
1599                 return -EBUSY;
1600         }
1601
1602         if (dev->tgt_active_prot) {
1603                 nfc_dev_err(&dev->interface->dev, "There is already an active"
1604                                                                 " target");
1605                 return -EBUSY;
1606         }
1607
1608         if (!dev->tgt_available_prots) {
1609                 nfc_dev_err(&dev->interface->dev, "There is no available target"
1610                                                                 " to activate");
1611                 return -EINVAL;
1612         }
1613
1614         if (!(dev->tgt_available_prots & (1 << protocol))) {
1615                 nfc_dev_err(&dev->interface->dev, "The target does not support"
1616                                         " the requested protocol %u", protocol);
1617                 return -EINVAL;
1618         }
1619
1620         if (protocol == NFC_PROTO_NFC_DEP) {
1621                 rc = pn533_activate_target_nfcdep(dev);
1622                 if (rc) {
1623                         nfc_dev_err(&dev->interface->dev, "Error %d when"
1624                                                 " activating target with"
1625                                                 " NFC_DEP protocol", rc);
1626                         return rc;
1627                 }
1628         }
1629
1630         dev->tgt_active_prot = protocol;
1631         dev->tgt_available_prots = 0;
1632
1633         return 0;
1634 }
1635
1636 static void pn533_deactivate_target(struct nfc_dev *nfc_dev,
1637                                     struct nfc_target *target)
1638 {
1639         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
1640         u8 tg;
1641         u8 status;
1642         int rc;
1643
1644         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1645
1646         if (!dev->tgt_active_prot) {
1647                 nfc_dev_err(&dev->interface->dev, "There is no active target");
1648                 return;
1649         }
1650
1651         dev->tgt_active_prot = 0;
1652
1653         skb_queue_purge(&dev->resp_q);
1654
1655         pn533_tx_frame_init(dev->out_frame, PN533_CMD_IN_RELEASE);
1656
1657         tg = 1;
1658         memcpy(PN533_FRAME_CMD_PARAMS_PTR(dev->out_frame), &tg, sizeof(u8));
1659         dev->out_frame->datalen += sizeof(u8);
1660
1661         pn533_tx_frame_finish(dev->out_frame);
1662
1663         rc = pn533_send_cmd_frame_sync(dev, dev->out_frame, dev->in_frame,
1664                                                                 dev->in_maxlen);
1665         if (rc) {
1666                 nfc_dev_err(&dev->interface->dev, "Error when sending release"
1667                                                 " command to the controller");
1668                 return;
1669         }
1670
1671         status = PN533_FRAME_CMD_PARAMS_PTR(dev->in_frame)[0];
1672         rc = status & PN533_CMD_RET_MASK;
1673         if (rc != PN533_CMD_RET_SUCCESS)
1674                 nfc_dev_err(&dev->interface->dev, "Error 0x%x when releasing"
1675                                                         " the target", rc);
1676
1677         return;
1678 }
1679
1680
1681 static int pn533_in_dep_link_up_complete(struct pn533 *dev, void *arg,
1682                                                 u8 *params, int params_len)
1683 {
1684         struct pn533_cmd_jump_dep_response *resp;
1685         struct nfc_target nfc_target;
1686         u8 target_gt_len;
1687         int rc;
1688         struct pn533_cmd_jump_dep *cmd = (struct pn533_cmd_jump_dep *)arg;
1689         u8 active = cmd->active;
1690
1691         kfree(arg);
1692
1693         if (params_len == -ENOENT) {
1694                 nfc_dev_dbg(&dev->interface->dev, "");
1695                 return 0;
1696         }
1697
1698         if (params_len < 0) {
1699                 nfc_dev_err(&dev->interface->dev,
1700                                 "Error %d when bringing DEP link up",
1701                                                                 params_len);
1702                 return 0;
1703         }
1704
1705         if (dev->tgt_available_prots &&
1706             !(dev->tgt_available_prots & (1 << NFC_PROTO_NFC_DEP))) {
1707                 nfc_dev_err(&dev->interface->dev,
1708                         "The target does not support DEP");
1709                 return -EINVAL;
1710         }
1711
1712         resp = (struct pn533_cmd_jump_dep_response *) params;
1713         rc = resp->status & PN533_CMD_RET_MASK;
1714         if (rc != PN533_CMD_RET_SUCCESS) {
1715                 nfc_dev_err(&dev->interface->dev,
1716                                 "Bringing DEP link up failed %d", rc);
1717                 return 0;
1718         }
1719
1720         if (!dev->tgt_available_prots) {
1721                 nfc_dev_dbg(&dev->interface->dev, "Creating new target");
1722
1723                 nfc_target.supported_protocols = NFC_PROTO_NFC_DEP_MASK;
1724                 nfc_target.nfcid1_len = 10;
1725                 memcpy(nfc_target.nfcid1, resp->nfcid3t, nfc_target.nfcid1_len);
1726                 rc = nfc_targets_found(dev->nfc_dev, &nfc_target, 1);
1727                 if (rc)
1728                         return 0;
1729
1730                 dev->tgt_available_prots = 0;
1731         }
1732
1733         dev->tgt_active_prot = NFC_PROTO_NFC_DEP;
1734
1735         /* ATR_RES general bytes are located at offset 17 */
1736         target_gt_len = PN533_FRAME_CMD_PARAMS_LEN(dev->in_frame) - 17;
1737         rc = nfc_set_remote_general_bytes(dev->nfc_dev,
1738                                                 resp->gt, target_gt_len);
1739         if (rc == 0)
1740                 rc = nfc_dep_link_is_up(dev->nfc_dev,
1741                                                 dev->nfc_dev->targets[0].idx,
1742                                                 !active, NFC_RF_INITIATOR);
1743
1744         return 0;
1745 }
1746
1747 static int pn533_mod_to_baud(struct pn533 *dev)
1748 {
1749         switch (dev->poll_mod_curr) {
1750         case PN533_POLL_MOD_106KBPS_A:
1751                 return 0;
1752         case PN533_POLL_MOD_212KBPS_FELICA:
1753                 return 1;
1754         case PN533_POLL_MOD_424KBPS_FELICA:
1755                 return 2;
1756         default:
1757                 return -EINVAL;
1758         }
1759 }
1760
1761 #define PASSIVE_DATA_LEN 5
1762 static int pn533_dep_link_up(struct nfc_dev *nfc_dev, struct nfc_target *target,
1763                              u8 comm_mode, u8* gb, size_t gb_len)
1764 {
1765         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
1766         struct pn533_cmd_jump_dep *cmd;
1767         u8 cmd_len, *data_ptr;
1768         u8 passive_data[PASSIVE_DATA_LEN] = {0x00, 0xff, 0xff, 0x00, 0x3};
1769         int rc, baud;
1770
1771         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1772
1773         if (dev->poll_mod_count) {
1774                 nfc_dev_err(&dev->interface->dev,
1775                                 "Cannot bring the DEP link up while polling");
1776                 return -EBUSY;
1777         }
1778
1779         if (dev->tgt_active_prot) {
1780                 nfc_dev_err(&dev->interface->dev,
1781                                 "There is already an active target");
1782                 return -EBUSY;
1783         }
1784
1785         baud = pn533_mod_to_baud(dev);
1786         if (baud < 0) {
1787                 nfc_dev_err(&dev->interface->dev,
1788                             "Invalid curr modulation %d", dev->poll_mod_curr);
1789                 return baud;
1790         }
1791
1792         cmd_len = sizeof(struct pn533_cmd_jump_dep) + gb_len;
1793         if (comm_mode == NFC_COMM_PASSIVE)
1794                 cmd_len += PASSIVE_DATA_LEN;
1795
1796         cmd = kzalloc(cmd_len, GFP_KERNEL);
1797         if (cmd == NULL)
1798                 return -ENOMEM;
1799
1800         pn533_tx_frame_init(dev->out_frame, PN533_CMD_IN_JUMP_FOR_DEP);
1801
1802         cmd->active = !comm_mode;
1803         cmd->next = 0;
1804         cmd->baud = baud;
1805         data_ptr = cmd->data;
1806         if (comm_mode == NFC_COMM_PASSIVE && cmd->baud > 0) {
1807                 memcpy(data_ptr, passive_data, PASSIVE_DATA_LEN);
1808                 cmd->next |= 1;
1809                 data_ptr += PASSIVE_DATA_LEN;
1810         }
1811
1812         if (gb != NULL && gb_len > 0) {
1813                 cmd->next |= 4; /* We have some Gi */
1814                 memcpy(data_ptr, gb, gb_len);
1815         } else {
1816                 cmd->next = 0;
1817         }
1818
1819         memcpy(PN533_FRAME_CMD_PARAMS_PTR(dev->out_frame), cmd, cmd_len);
1820         dev->out_frame->datalen += cmd_len;
1821
1822         pn533_tx_frame_finish(dev->out_frame);
1823
1824         rc = pn533_send_cmd_frame_async(dev, dev->out_frame, dev->in_frame,
1825                                 dev->in_maxlen, pn533_in_dep_link_up_complete,
1826                                 cmd, GFP_KERNEL);
1827         if (rc < 0)
1828                 kfree(cmd);
1829
1830         return rc;
1831 }
1832
1833 static int pn533_dep_link_down(struct nfc_dev *nfc_dev)
1834 {
1835         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
1836
1837         pn533_poll_reset_mod_list(dev);
1838
1839         if (dev->tgt_mode || dev->tgt_active_prot) {
1840                 pn533_send_ack(dev, GFP_KERNEL);
1841                 usb_kill_urb(dev->in_urb);
1842         }
1843
1844         dev->tgt_active_prot = 0;
1845         dev->tgt_mode = 0;
1846
1847         skb_queue_purge(&dev->resp_q);
1848
1849         return 0;
1850 }
1851
1852 static int pn533_build_tx_frame(struct pn533 *dev, struct sk_buff *skb,
1853                                 bool target)
1854 {
1855         int payload_len = skb->len;
1856         struct pn533_frame *out_frame;
1857         u8 tg;
1858
1859         nfc_dev_dbg(&dev->interface->dev, "%s - Sending %d bytes", __func__,
1860                                                                 payload_len);
1861
1862         if (payload_len > PN533_CMD_DATAEXCH_DATA_MAXLEN) {
1863                 /* TODO: Implement support to multi-part data exchange */
1864                 nfc_dev_err(&dev->interface->dev, "Data length greater than the"
1865                                                 " max allowed: %d",
1866                                                 PN533_CMD_DATAEXCH_DATA_MAXLEN);
1867                 return -ENOSYS;
1868         }
1869
1870         if (target == true) {
1871                 switch (dev->device_type) {
1872                 case PN533_DEVICE_PASORI:
1873                         if (dev->tgt_active_prot == NFC_PROTO_FELICA) {
1874                                 skb_push(skb, PN533_CMD_DATAEXCH_HEAD_LEN - 1);
1875                                 out_frame = (struct pn533_frame *) skb->data;
1876                                 pn533_tx_frame_init(out_frame,
1877                                                     PN533_CMD_IN_COMM_THRU);
1878
1879                                 break;
1880                         }
1881
1882                 default:
1883                         skb_push(skb, PN533_CMD_DATAEXCH_HEAD_LEN);
1884                         out_frame = (struct pn533_frame *) skb->data;
1885                         pn533_tx_frame_init(out_frame,
1886                                             PN533_CMD_IN_DATA_EXCHANGE);
1887                         tg = 1;
1888                         memcpy(PN533_FRAME_CMD_PARAMS_PTR(out_frame),
1889                                &tg, sizeof(u8));
1890                         out_frame->datalen += sizeof(u8);
1891
1892                         break;
1893                 }
1894
1895         } else {
1896                 skb_push(skb, PN533_CMD_DATAEXCH_HEAD_LEN - 1);
1897                 out_frame = (struct pn533_frame *) skb->data;
1898                 pn533_tx_frame_init(out_frame, PN533_CMD_TG_SET_DATA);
1899         }
1900
1901
1902         /* The data is already in the out_frame, just update the datalen */
1903         out_frame->datalen += payload_len;
1904
1905         pn533_tx_frame_finish(out_frame);
1906         skb_put(skb, PN533_FRAME_TAIL_SIZE);
1907
1908         return 0;
1909 }
1910
1911 struct pn533_data_exchange_arg {
1912         struct sk_buff *skb_resp;
1913         struct sk_buff *skb_out;
1914         data_exchange_cb_t cb;
1915         void *cb_context;
1916 };
1917
1918 static struct sk_buff *pn533_build_response(struct pn533 *dev)
1919 {
1920         struct sk_buff *skb, *tmp, *t;
1921         unsigned int skb_len = 0, tmp_len = 0;
1922
1923         nfc_dev_dbg(&dev->interface->dev, "%s\n", __func__);
1924
1925         if (skb_queue_empty(&dev->resp_q))
1926                 return NULL;
1927
1928         if (skb_queue_len(&dev->resp_q) == 1) {
1929                 skb = skb_dequeue(&dev->resp_q);
1930                 goto out;
1931         }
1932
1933         skb_queue_walk_safe(&dev->resp_q, tmp, t)
1934                 skb_len += tmp->len;
1935
1936         nfc_dev_dbg(&dev->interface->dev, "%s total length %d\n",
1937                     __func__, skb_len);
1938
1939         skb = alloc_skb(skb_len, GFP_KERNEL);
1940         if (skb == NULL)
1941                 goto out;
1942
1943         skb_put(skb, skb_len);
1944
1945         skb_queue_walk_safe(&dev->resp_q, tmp, t) {
1946                 memcpy(skb->data + tmp_len, tmp->data, tmp->len);
1947                 tmp_len += tmp->len;
1948         }
1949
1950 out:
1951         skb_queue_purge(&dev->resp_q);
1952
1953         return skb;
1954 }
1955
1956 static int pn533_data_exchange_complete(struct pn533 *dev, void *_arg,
1957                                                 u8 *params, int params_len)
1958 {
1959         struct pn533_data_exchange_arg *arg = _arg;
1960         struct sk_buff *skb = NULL, *skb_resp = arg->skb_resp;
1961         struct pn533_frame *in_frame = (struct pn533_frame *) skb_resp->data;
1962         int err = 0;
1963         u8 status;
1964         u8 cmd_ret;
1965
1966         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
1967
1968         dev_kfree_skb(arg->skb_out);
1969
1970         if (params_len < 0) { /* error */
1971                 err = params_len;
1972                 goto error;
1973         }
1974
1975         status = params[0];
1976
1977         cmd_ret = status & PN533_CMD_RET_MASK;
1978         if (cmd_ret != PN533_CMD_RET_SUCCESS) {
1979                 nfc_dev_err(&dev->interface->dev, "PN533 reported error %d when"
1980                                                 " exchanging data", cmd_ret);
1981                 err = -EIO;
1982                 goto error;
1983         }
1984
1985         skb_put(skb_resp, PN533_FRAME_SIZE(in_frame));
1986         skb_pull(skb_resp, PN533_CMD_DATAEXCH_HEAD_LEN);
1987         skb_trim(skb_resp, skb_resp->len - PN533_FRAME_TAIL_SIZE);
1988         skb_queue_tail(&dev->resp_q, skb_resp);
1989
1990         if (status & PN533_CMD_MI_MASK) {
1991                 queue_work(dev->wq, &dev->mi_work);
1992                 return -EINPROGRESS;
1993         }
1994
1995         skb = pn533_build_response(dev);
1996         if (skb == NULL)
1997                 goto error;
1998
1999         arg->cb(arg->cb_context, skb, 0);
2000         kfree(arg);
2001         return 0;
2002
2003 error:
2004         skb_queue_purge(&dev->resp_q);
2005         dev_kfree_skb(skb_resp);
2006         arg->cb(arg->cb_context, NULL, err);
2007         kfree(arg);
2008         return 0;
2009 }
2010
2011 static int pn533_transceive(struct nfc_dev *nfc_dev,
2012                             struct nfc_target *target, struct sk_buff *skb,
2013                             data_exchange_cb_t cb, void *cb_context)
2014 {
2015         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2016         struct pn533_frame *out_frame, *in_frame;
2017         struct pn533_data_exchange_arg *arg;
2018         struct sk_buff *skb_resp;
2019         int skb_resp_len;
2020         int rc;
2021
2022         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
2023
2024         if (!dev->tgt_active_prot) {
2025                 nfc_dev_err(&dev->interface->dev, "Cannot exchange data if"
2026                                                 " there is no active target");
2027                 rc = -EINVAL;
2028                 goto error;
2029         }
2030
2031         rc = pn533_build_tx_frame(dev, skb, true);
2032         if (rc)
2033                 goto error;
2034
2035         skb_resp_len = PN533_CMD_DATAEXCH_HEAD_LEN +
2036                         PN533_CMD_DATAEXCH_DATA_MAXLEN +
2037                         PN533_FRAME_TAIL_SIZE;
2038
2039         skb_resp = nfc_alloc_recv_skb(skb_resp_len, GFP_KERNEL);
2040         if (!skb_resp) {
2041                 rc = -ENOMEM;
2042                 goto error;
2043         }
2044
2045         in_frame = (struct pn533_frame *) skb_resp->data;
2046         out_frame = (struct pn533_frame *) skb->data;
2047
2048         arg = kmalloc(sizeof(struct pn533_data_exchange_arg), GFP_KERNEL);
2049         if (!arg) {
2050                 rc = -ENOMEM;
2051                 goto free_skb_resp;
2052         }
2053
2054         arg->skb_resp = skb_resp;
2055         arg->skb_out = skb;
2056         arg->cb = cb;
2057         arg->cb_context = cb_context;
2058
2059         rc = pn533_send_cmd_frame_async(dev, out_frame, in_frame, skb_resp_len,
2060                                         pn533_data_exchange_complete, arg,
2061                                         GFP_KERNEL);
2062         if (rc) {
2063                 nfc_dev_err(&dev->interface->dev, "Error %d when trying to"
2064                                                 " perform data_exchange", rc);
2065                 goto free_arg;
2066         }
2067
2068         return 0;
2069
2070 free_arg:
2071         kfree(arg);
2072 free_skb_resp:
2073         kfree_skb(skb_resp);
2074 error:
2075         kfree_skb(skb);
2076         return rc;
2077 }
2078
2079 static int pn533_tm_send_complete(struct pn533 *dev, void *arg,
2080                                   u8 *params, int params_len)
2081 {
2082         struct sk_buff *skb_out = arg;
2083
2084         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
2085
2086         dev_kfree_skb(skb_out);
2087
2088         if (params_len < 0) {
2089                 nfc_dev_err(&dev->interface->dev,
2090                             "Error %d when sending data",
2091                             params_len);
2092
2093                 return params_len;
2094         }
2095
2096         if (params_len > 0 && params[0] != 0) {
2097                 nfc_tm_deactivated(dev->nfc_dev);
2098
2099                 dev->tgt_mode = 0;
2100
2101                 return 0;
2102         }
2103
2104         queue_work(dev->wq, &dev->tg_work);
2105
2106         return 0;
2107 }
2108
2109 static int pn533_tm_send(struct nfc_dev *nfc_dev, struct sk_buff *skb)
2110 {
2111         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2112         struct pn533_frame *out_frame;
2113         int rc;
2114
2115         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
2116
2117         rc = pn533_build_tx_frame(dev, skb, false);
2118         if (rc)
2119                 goto error;
2120
2121         out_frame = (struct pn533_frame *) skb->data;
2122
2123         rc = pn533_send_cmd_frame_async(dev, out_frame, dev->in_frame,
2124                                         dev->in_maxlen, pn533_tm_send_complete,
2125                                         skb, GFP_KERNEL);
2126         if (rc) {
2127                 nfc_dev_err(&dev->interface->dev,
2128                             "Error %d when trying to send data", rc);
2129                 goto error;
2130         }
2131
2132         return 0;
2133
2134 error:
2135         kfree_skb(skb);
2136
2137         return rc;
2138 }
2139
2140 static void pn533_wq_mi_recv(struct work_struct *work)
2141 {
2142         struct pn533 *dev = container_of(work, struct pn533, mi_work);
2143         struct sk_buff *skb_cmd;
2144         struct pn533_data_exchange_arg *arg = dev->cmd_complete_arg;
2145         struct pn533_frame *out_frame, *in_frame;
2146         struct sk_buff *skb_resp;
2147         int skb_resp_len;
2148         int rc;
2149
2150         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
2151
2152         /* This is a zero payload size skb */
2153         skb_cmd = alloc_skb(PN533_CMD_DATAEXCH_HEAD_LEN + PN533_FRAME_TAIL_SIZE,
2154                             GFP_KERNEL);
2155         if (skb_cmd == NULL)
2156                 goto error_cmd;
2157
2158         skb_reserve(skb_cmd, PN533_CMD_DATAEXCH_HEAD_LEN);
2159
2160         rc = pn533_build_tx_frame(dev, skb_cmd, true);
2161         if (rc)
2162                 goto error_frame;
2163
2164         skb_resp_len = PN533_CMD_DATAEXCH_HEAD_LEN +
2165                         PN533_CMD_DATAEXCH_DATA_MAXLEN +
2166                         PN533_FRAME_TAIL_SIZE;
2167         skb_resp = alloc_skb(skb_resp_len, GFP_KERNEL);
2168         if (!skb_resp) {
2169                 rc = -ENOMEM;
2170                 goto error_frame;
2171         }
2172
2173         in_frame = (struct pn533_frame *) skb_resp->data;
2174         out_frame = (struct pn533_frame *) skb_cmd->data;
2175
2176         arg->skb_resp = skb_resp;
2177         arg->skb_out = skb_cmd;
2178
2179         rc = __pn533_send_cmd_frame_async(dev, out_frame, in_frame,
2180                                           skb_resp_len,
2181                                           pn533_data_exchange_complete,
2182                                           dev->cmd_complete_arg, GFP_KERNEL);
2183         if (!rc)
2184                 return;
2185
2186         nfc_dev_err(&dev->interface->dev, "Error %d when trying to"
2187                                                 " perform data_exchange", rc);
2188
2189         kfree_skb(skb_resp);
2190
2191 error_frame:
2192         kfree_skb(skb_cmd);
2193
2194 error_cmd:
2195         pn533_send_ack(dev, GFP_KERNEL);
2196
2197         kfree(arg);
2198
2199         queue_work(dev->wq, &dev->cmd_work);
2200 }
2201
2202 static int pn533_set_configuration(struct pn533 *dev, u8 cfgitem, u8 *cfgdata,
2203                                                                 u8 cfgdata_len)
2204 {
2205         int rc;
2206         u8 *params;
2207
2208         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
2209
2210         pn533_tx_frame_init(dev->out_frame, PN533_CMD_RF_CONFIGURATION);
2211
2212         params = PN533_FRAME_CMD_PARAMS_PTR(dev->out_frame);
2213         params[0] = cfgitem;
2214         memcpy(&params[1], cfgdata, cfgdata_len);
2215         dev->out_frame->datalen += (1 + cfgdata_len);
2216
2217         pn533_tx_frame_finish(dev->out_frame);
2218
2219         rc = pn533_send_cmd_frame_sync(dev, dev->out_frame, dev->in_frame,
2220                                                                 dev->in_maxlen);
2221
2222         return rc;
2223 }
2224
2225 static int pn533_fw_reset(struct pn533 *dev)
2226 {
2227         int rc;
2228         u8 *params;
2229
2230         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
2231
2232         pn533_tx_frame_init(dev->out_frame, 0x18);
2233
2234         params = PN533_FRAME_CMD_PARAMS_PTR(dev->out_frame);
2235         params[0] = 0x1;
2236         dev->out_frame->datalen += 1;
2237
2238         pn533_tx_frame_finish(dev->out_frame);
2239
2240         rc = pn533_send_cmd_frame_sync(dev, dev->out_frame, dev->in_frame,
2241                                        dev->in_maxlen);
2242
2243         return rc;
2244 }
2245
2246 static struct nfc_ops pn533_nfc_ops = {
2247         .dev_up = NULL,
2248         .dev_down = NULL,
2249         .dep_link_up = pn533_dep_link_up,
2250         .dep_link_down = pn533_dep_link_down,
2251         .start_poll = pn533_start_poll,
2252         .stop_poll = pn533_stop_poll,
2253         .activate_target = pn533_activate_target,
2254         .deactivate_target = pn533_deactivate_target,
2255         .im_transceive = pn533_transceive,
2256         .tm_send = pn533_tm_send,
2257 };
2258
2259 static int pn533_setup(struct pn533 *dev)
2260 {
2261         struct pn533_config_max_retries max_retries;
2262         struct pn533_config_timing timing;
2263         u8 pasori_cfg[3] = {0x08, 0x01, 0x08};
2264         int rc;
2265
2266         switch (dev->device_type) {
2267         case PN533_DEVICE_STD:
2268                 max_retries.mx_rty_atr = PN533_CONFIG_MAX_RETRIES_ENDLESS;
2269                 max_retries.mx_rty_psl = 2;
2270                 max_retries.mx_rty_passive_act =
2271                         PN533_CONFIG_MAX_RETRIES_NO_RETRY;
2272
2273                 timing.rfu = PN533_CONFIG_TIMING_102;
2274                 timing.atr_res_timeout = PN533_CONFIG_TIMING_204;
2275                 timing.dep_timeout = PN533_CONFIG_TIMING_409;
2276
2277                 break;
2278
2279         case PN533_DEVICE_PASORI:
2280                 max_retries.mx_rty_atr = 0x2;
2281                 max_retries.mx_rty_psl = 0x1;
2282                 max_retries.mx_rty_passive_act =
2283                         PN533_CONFIG_MAX_RETRIES_NO_RETRY;
2284
2285                 timing.rfu = PN533_CONFIG_TIMING_102;
2286                 timing.atr_res_timeout = PN533_CONFIG_TIMING_102;
2287                 timing.dep_timeout = PN533_CONFIG_TIMING_204;
2288
2289                 break;
2290
2291         default:
2292                 nfc_dev_err(&dev->interface->dev, "Unknown device type %d\n",
2293                             dev->device_type);
2294                 return -EINVAL;
2295         }
2296
2297         rc = pn533_set_configuration(dev, PN533_CFGITEM_MAX_RETRIES,
2298                                      (u8 *)&max_retries, sizeof(max_retries));
2299         if (rc) {
2300                 nfc_dev_err(&dev->interface->dev,
2301                             "Error on setting MAX_RETRIES config");
2302                 return rc;
2303         }
2304
2305
2306         rc = pn533_set_configuration(dev, PN533_CFGITEM_TIMING,
2307                                      (u8 *)&timing, sizeof(timing));
2308         if (rc) {
2309                 nfc_dev_err(&dev->interface->dev,
2310                             "Error on setting RF timings");
2311                 return rc;
2312         }
2313
2314         switch (dev->device_type) {
2315         case PN533_DEVICE_STD:
2316                 break;
2317
2318         case PN533_DEVICE_PASORI:
2319                 pn533_fw_reset(dev);
2320
2321                 rc = pn533_set_configuration(dev, PN533_CFGITEM_PASORI,
2322                                              pasori_cfg, 3);
2323                 if (rc) {
2324                         nfc_dev_err(&dev->interface->dev,
2325                                     "Error while settings PASORI config");
2326                         return rc;
2327                 }
2328
2329                 pn533_fw_reset(dev);
2330
2331                 break;
2332         }
2333
2334         return 0;
2335 }
2336
2337 static int pn533_probe(struct usb_interface *interface,
2338                         const struct usb_device_id *id)
2339 {
2340         struct pn533_fw_version *fw_ver;
2341         struct pn533 *dev;
2342         struct usb_host_interface *iface_desc;
2343         struct usb_endpoint_descriptor *endpoint;
2344         int in_endpoint = 0;
2345         int out_endpoint = 0;
2346         int rc = -ENOMEM;
2347         int i;
2348         u32 protocols;
2349
2350         dev = kzalloc(sizeof(*dev), GFP_KERNEL);
2351         if (!dev)
2352                 return -ENOMEM;
2353
2354         dev->udev = usb_get_dev(interface_to_usbdev(interface));
2355         dev->interface = interface;
2356         mutex_init(&dev->cmd_lock);
2357
2358         iface_desc = interface->cur_altsetting;
2359         for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
2360                 endpoint = &iface_desc->endpoint[i].desc;
2361
2362                 if (!in_endpoint && usb_endpoint_is_bulk_in(endpoint)) {
2363                         dev->in_maxlen = le16_to_cpu(endpoint->wMaxPacketSize);
2364                         in_endpoint = endpoint->bEndpointAddress;
2365                 }
2366
2367                 if (!out_endpoint && usb_endpoint_is_bulk_out(endpoint)) {
2368                         dev->out_maxlen =
2369                                 le16_to_cpu(endpoint->wMaxPacketSize);
2370                         out_endpoint = endpoint->bEndpointAddress;
2371                 }
2372         }
2373
2374         if (!in_endpoint || !out_endpoint) {
2375                 nfc_dev_err(&interface->dev, "Could not find bulk-in or"
2376                                                         " bulk-out endpoint");
2377                 rc = -ENODEV;
2378                 goto error;
2379         }
2380
2381         dev->in_frame = kmalloc(PN533_NORMAL_FRAME_MAX_LEN, GFP_KERNEL);
2382         dev->in_urb = usb_alloc_urb(0, GFP_KERNEL);
2383         dev->out_frame = kmalloc(PN533_NORMAL_FRAME_MAX_LEN, GFP_KERNEL);
2384         dev->out_urb = usb_alloc_urb(0, GFP_KERNEL);
2385
2386         if (!dev->in_frame || !dev->out_frame ||
2387                 !dev->in_urb || !dev->out_urb)
2388                 goto error;
2389
2390         usb_fill_bulk_urb(dev->in_urb, dev->udev,
2391                         usb_rcvbulkpipe(dev->udev, in_endpoint),
2392                         NULL, 0, NULL, dev);
2393         usb_fill_bulk_urb(dev->out_urb, dev->udev,
2394                         usb_sndbulkpipe(dev->udev, out_endpoint),
2395                         NULL, 0,
2396                         pn533_send_complete, dev);
2397
2398         INIT_WORK(&dev->cmd_work, pn533_wq_cmd);
2399         INIT_WORK(&dev->cmd_complete_work, pn533_wq_cmd_complete);
2400         INIT_WORK(&dev->mi_work, pn533_wq_mi_recv);
2401         INIT_WORK(&dev->tg_work, pn533_wq_tg_get_data);
2402         INIT_WORK(&dev->poll_work, pn533_wq_poll);
2403         dev->wq = alloc_ordered_workqueue("pn533", 0);
2404         if (dev->wq == NULL)
2405                 goto error;
2406
2407         init_timer(&dev->listen_timer);
2408         dev->listen_timer.data = (unsigned long) dev;
2409         dev->listen_timer.function = pn533_listen_mode_timer;
2410
2411         skb_queue_head_init(&dev->resp_q);
2412
2413         INIT_LIST_HEAD(&dev->cmd_queue);
2414
2415         usb_set_intfdata(interface, dev);
2416
2417         pn533_tx_frame_init(dev->out_frame, PN533_CMD_GET_FIRMWARE_VERSION);
2418         pn533_tx_frame_finish(dev->out_frame);
2419
2420         rc = pn533_send_cmd_frame_sync(dev, dev->out_frame, dev->in_frame,
2421                                                                 dev->in_maxlen);
2422         if (rc)
2423                 goto destroy_wq;
2424
2425         fw_ver = (struct pn533_fw_version *)
2426                                 PN533_FRAME_CMD_PARAMS_PTR(dev->in_frame);
2427         nfc_dev_info(&dev->interface->dev, "NXP PN533 firmware ver %d.%d now"
2428                                         " attached", fw_ver->ver, fw_ver->rev);
2429
2430         dev->device_type = id->driver_info;
2431         switch (dev->device_type) {
2432         case PN533_DEVICE_STD:
2433                 protocols = PN533_ALL_PROTOCOLS;
2434                 break;
2435
2436         case PN533_DEVICE_PASORI:
2437                 protocols = PN533_NO_TYPE_B_PROTOCOLS;
2438                 break;
2439
2440         default:
2441                 nfc_dev_err(&dev->interface->dev, "Unknown device type %d\n",
2442                             dev->device_type);
2443                 rc = -EINVAL;
2444                 goto destroy_wq;
2445         }
2446
2447         dev->nfc_dev = nfc_allocate_device(&pn533_nfc_ops, protocols,
2448                                            PN533_CMD_DATAEXCH_HEAD_LEN,
2449                                            PN533_FRAME_TAIL_SIZE);
2450         if (!dev->nfc_dev)
2451                 goto destroy_wq;
2452
2453         nfc_set_parent_dev(dev->nfc_dev, &interface->dev);
2454         nfc_set_drvdata(dev->nfc_dev, dev);
2455
2456         rc = nfc_register_device(dev->nfc_dev);
2457         if (rc)
2458                 goto free_nfc_dev;
2459
2460         rc = pn533_setup(dev);
2461         if (rc)
2462                 goto unregister_nfc_dev;
2463
2464         return 0;
2465
2466 unregister_nfc_dev:
2467         nfc_unregister_device(dev->nfc_dev);
2468
2469 free_nfc_dev:
2470         nfc_free_device(dev->nfc_dev);
2471
2472 destroy_wq:
2473         destroy_workqueue(dev->wq);
2474 error:
2475         kfree(dev->in_frame);
2476         usb_free_urb(dev->in_urb);
2477         kfree(dev->out_frame);
2478         usb_free_urb(dev->out_urb);
2479         kfree(dev);
2480         return rc;
2481 }
2482
2483 static void pn533_disconnect(struct usb_interface *interface)
2484 {
2485         struct pn533 *dev;
2486         struct pn533_cmd *cmd, *n;
2487
2488         dev = usb_get_intfdata(interface);
2489         usb_set_intfdata(interface, NULL);
2490
2491         nfc_unregister_device(dev->nfc_dev);
2492         nfc_free_device(dev->nfc_dev);
2493
2494         usb_kill_urb(dev->in_urb);
2495         usb_kill_urb(dev->out_urb);
2496
2497         destroy_workqueue(dev->wq);
2498
2499         skb_queue_purge(&dev->resp_q);
2500
2501         del_timer(&dev->listen_timer);
2502
2503         list_for_each_entry_safe(cmd, n, &dev->cmd_queue, queue) {
2504                 list_del(&cmd->queue);
2505                 kfree(cmd);
2506         }
2507
2508         kfree(dev->in_frame);
2509         usb_free_urb(dev->in_urb);
2510         kfree(dev->out_frame);
2511         usb_free_urb(dev->out_urb);
2512         kfree(dev);
2513
2514         nfc_dev_info(&interface->dev, "NXP PN533 NFC device disconnected");
2515 }
2516
2517 static struct usb_driver pn533_driver = {
2518         .name =         "pn533",
2519         .probe =        pn533_probe,
2520         .disconnect =   pn533_disconnect,
2521         .id_table =     pn533_table,
2522 };
2523
2524 module_usb_driver(pn533_driver);
2525
2526 MODULE_AUTHOR("Lauro Ramos Venancio <lauro.venancio@openbossa.org>,"
2527                         " Aloisio Almeida Jr <aloisio.almeida@openbossa.org>");
2528 MODULE_DESCRIPTION("PN533 usb driver ver " VERSION);
2529 MODULE_VERSION(VERSION);
2530 MODULE_LICENSE("GPL");