drivers/nfc/pn533/pn533.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  * Driver for NXP PN533 NFC Chip - core functions
   4  *
   5  * Copyright (C) 2011 Instituto Nokia de Tecnologia
   6  * Copyright (C) 2012-2013 Tieto Poland
   7  */
   8
   9 #include <linux/device.h>
  10 #include <linux/kernel.h>
  11 #include <linux/module.h>
  12 #include <linux/slab.h>
  13 #include <linux/nfc.h>
  14 #include <linux/netdevice.h>
  15 #include <net/nfc/nfc.h>
  16 #include "pn533.h"
  17
  18 #define VERSION "0.3"
  19
  20 /* How much time we spend listening for initiators */
  21 #define PN533_LISTEN_TIME 2
  22 /* Delay between each poll frame (ms) */
  23 #define PN533_POLL_INTERVAL 10
  24
  25 /* structs for pn533 commands */
  26
  27 /* PN533_CMD_GET_FIRMWARE_VERSION */
  28 struct pn533_fw_version {
  29         u8 ic;
  30         u8 ver;
  31         u8 rev;
  32         u8 support;
  33 };
  34
  35 /* PN533_CMD_RF_CONFIGURATION */
  36 #define PN533_CFGITEM_RF_FIELD    0x01
  37 #define PN533_CFGITEM_TIMING      0x02
  38 #define PN533_CFGITEM_MAX_RETRIES 0x05
  39 #define PN533_CFGITEM_PASORI      0x82
  40
  41 #define PN533_CFGITEM_RF_FIELD_AUTO_RFCA 0x2
  42 #define PN533_CFGITEM_RF_FIELD_ON        0x1
  43 #define PN533_CFGITEM_RF_FIELD_OFF       0x0
  44
  45 #define PN533_CONFIG_TIMING_102 0xb
  46 #define PN533_CONFIG_TIMING_204 0xc
  47 #define PN533_CONFIG_TIMING_409 0xd
  48 #define PN533_CONFIG_TIMING_819 0xe
  49
  50 #define PN533_CONFIG_MAX_RETRIES_NO_RETRY 0x00
  51 #define PN533_CONFIG_MAX_RETRIES_ENDLESS 0xFF
  52
  53 struct pn533_config_max_retries {
  54         u8 mx_rty_atr;
  55         u8 mx_rty_psl;
  56         u8 mx_rty_passive_act;
  57 } __packed;
  58
  59 struct pn533_config_timing {
  60         u8 rfu;
  61         u8 atr_res_timeout;
  62         u8 dep_timeout;
  63 } __packed;
  64
  65 /* PN533_CMD_IN_LIST_PASSIVE_TARGET */
  66
  67 /* felica commands opcode */
  68 #define PN533_FELICA_OPC_SENSF_REQ 0
  69 #define PN533_FELICA_OPC_SENSF_RES 1
  70 /* felica SENSF_REQ parameters */
  71 #define PN533_FELICA_SENSF_SC_ALL 0xFFFF
  72 #define PN533_FELICA_SENSF_RC_NO_SYSTEM_CODE 0
  73 #define PN533_FELICA_SENSF_RC_SYSTEM_CODE 1
  74 #define PN533_FELICA_SENSF_RC_ADVANCED_PROTOCOL 2
  75
  76 /* type B initiator_data values */
  77 #define PN533_TYPE_B_AFI_ALL_FAMILIES 0
  78 #define PN533_TYPE_B_POLL_METHOD_TIMESLOT 0
  79 #define PN533_TYPE_B_POLL_METHOD_PROBABILISTIC 1
  80
  81 union pn533_cmd_poll_initdata {
  82         struct {
  83                 u8 afi;
  84                 u8 polling_method;
  85         } __packed type_b;
  86         struct {
  87                 u8 opcode;
  88                 __be16 sc;
  89                 u8 rc;
  90                 u8 tsn;
  91         } __packed felica;
  92 };
  93
  94 struct pn533_poll_modulations {
  95         struct {
  96                 u8 maxtg;
  97                 u8 brty;
  98                 union pn533_cmd_poll_initdata initiator_data;
  99         } __packed data;
 100         u8 len;
 101 };
 102
 103 static const struct pn533_poll_modulations poll_mod[] = {
 104         [PN533_POLL_MOD_106KBPS_A] = {
 105                 .data = {
 106                         .maxtg = 1,
 107                         .brty = 0,
 108                 },
 109                 .len = 2,
 110         },
 111         [PN533_POLL_MOD_212KBPS_FELICA] = {
 112                 .data = {
 113                         .maxtg = 1,
 114                         .brty = 1,
 115                         .initiator_data.felica = {
 116                                 .opcode = PN533_FELICA_OPC_SENSF_REQ,
 117                                 .sc = PN533_FELICA_SENSF_SC_ALL,
 118                                 .rc = PN533_FELICA_SENSF_RC_SYSTEM_CODE,
 119                                 .tsn = 0x03,
 120                         },
 121                 },
 122                 .len = 7,
 123         },
 124         [PN533_POLL_MOD_424KBPS_FELICA] = {
 125                 .data = {
 126                         .maxtg = 1,
 127                         .brty = 2,
 128                         .initiator_data.felica = {
 129                                 .opcode = PN533_FELICA_OPC_SENSF_REQ,
 130                                 .sc = PN533_FELICA_SENSF_SC_ALL,
 131                                 .rc = PN533_FELICA_SENSF_RC_SYSTEM_CODE,
 132                                 .tsn = 0x03,
 133                         },
 134                  },
 135                 .len = 7,
 136         },
 137         [PN533_POLL_MOD_106KBPS_JEWEL] = {
 138                 .data = {
 139                         .maxtg = 1,
 140                         .brty = 4,
 141                 },
 142                 .len = 2,
 143         },
 144         [PN533_POLL_MOD_847KBPS_B] = {
 145                 .data = {
 146                         .maxtg = 1,
 147                         .brty = 8,
 148                         .initiator_data.type_b = {
 149                                 .afi = PN533_TYPE_B_AFI_ALL_FAMILIES,
 150                                 .polling_method =
 151                                         PN533_TYPE_B_POLL_METHOD_TIMESLOT,
 152                         },
 153                 },
 154                 .len = 3,
 155         },
 156         [PN533_LISTEN_MOD] = {
 157                 .len = 0,
 158         },
 159 };
 160
 161 /* PN533_CMD_IN_ATR */
 162
 163 struct pn533_cmd_activate_response {
 164         u8 status;
 165         u8 nfcid3t[10];
 166         u8 didt;
 167         u8 bst;
 168         u8 brt;
 169         u8 to;
 170         u8 ppt;
 171         /* optional */
 172         u8 gt[];
 173 } __packed;
 174
 175 struct pn533_cmd_jump_dep_response {
 176         u8 status;
 177         u8 tg;
 178         u8 nfcid3t[10];
 179         u8 didt;
 180         u8 bst;
 181         u8 brt;
 182         u8 to;
 183         u8 ppt;
 184         /* optional */
 185         u8 gt[];
 186 } __packed;
 187
 188
 189 /* PN533_TG_INIT_AS_TARGET */
 190 #define PN533_INIT_TARGET_PASSIVE 0x1
 191 #define PN533_INIT_TARGET_DEP 0x2
 192
 193 #define PN533_INIT_TARGET_RESP_FRAME_MASK 0x3
 194 #define PN533_INIT_TARGET_RESP_ACTIVE     0x1
 195 #define PN533_INIT_TARGET_RESP_DEP        0x4
 196
 197 /* The rule: value(high byte) + value(low byte) + checksum = 0 */
 198 static inline u8 pn533_ext_checksum(u16 value)
 199 {
 200         return ~(u8)(((value & 0xFF00) >> 8) + (u8)(value & 0xFF)) + 1;
 201 }
 202
 203 /* The rule: value + checksum = 0 */
 204 static inline u8 pn533_std_checksum(u8 value)
 205 {
 206         return ~value + 1;
 207 }
 208
 209 /* The rule: sum(data elements) + checksum = 0 */
 210 static u8 pn533_std_data_checksum(u8 *data, int datalen)
 211 {
 212         u8 sum = 0;
 213         int i;
 214
 215         for (i = 0; i < datalen; i++)
 216                 sum += data[i];
 217
 218         return pn533_std_checksum(sum);
 219 }
 220
 221 static void pn533_std_tx_frame_init(void *_frame, u8 cmd_code)
 222 {
 223         struct pn533_std_frame *frame = _frame;
 224
 225         frame->preamble = 0;
 226         frame->start_frame = cpu_to_be16(PN533_STD_FRAME_SOF);
 227         PN533_STD_FRAME_IDENTIFIER(frame) = PN533_STD_FRAME_DIR_OUT;
 228         PN533_FRAME_CMD(frame) = cmd_code;
 229         frame->datalen = 2;
 230 }
 231
 232 static void pn533_std_tx_frame_finish(void *_frame)
 233 {
 234         struct pn533_std_frame *frame = _frame;
 235
 236         frame->datalen_checksum = pn533_std_checksum(frame->datalen);
 237
 238         PN533_STD_FRAME_CHECKSUM(frame) =
 239                 pn533_std_data_checksum(frame->data, frame->datalen);
 240
 241         PN533_STD_FRAME_POSTAMBLE(frame) = 0;
 242 }
 243
 244 static void pn533_std_tx_update_payload_len(void *_frame, int len)
 245 {
 246         struct pn533_std_frame *frame = _frame;
 247
 248         frame->datalen += len;
 249 }
 250
 251 static bool pn533_std_rx_frame_is_valid(void *_frame, struct pn533 *dev)
 252 {
 253         u8 checksum;
 254         struct pn533_std_frame *stdf = _frame;
 255
 256         if (stdf->start_frame != cpu_to_be16(PN533_STD_FRAME_SOF))
 257                 return false;
 258
 259         if (likely(!PN533_STD_IS_EXTENDED(stdf))) {
 260                 /* Standard frame code */
 261                 dev->ops->rx_header_len = PN533_STD_FRAME_HEADER_LEN;
 262
 263                 checksum = pn533_std_checksum(stdf->datalen);
 264                 if (checksum != stdf->datalen_checksum)
 265                         return false;
 266
 267                 checksum = pn533_std_data_checksum(stdf->data, stdf->datalen);
 268                 if (checksum != PN533_STD_FRAME_CHECKSUM(stdf))
 269                         return false;
 270         } else {
 271                 /* Extended */
 272                 struct pn533_ext_frame *eif = _frame;
 273
 274                 dev->ops->rx_header_len = PN533_EXT_FRAME_HEADER_LEN;
 275
 276                 checksum = pn533_ext_checksum(be16_to_cpu(eif->datalen));
 277                 if (checksum != eif->datalen_checksum)
 278                         return false;
 279
 280                 /* check data checksum */
 281                 checksum = pn533_std_data_checksum(eif->data,
 282                                                    be16_to_cpu(eif->datalen));
 283                 if (checksum != PN533_EXT_FRAME_CHECKSUM(eif))
 284                         return false;
 285         }
 286
 287         return true;
 288 }
 289
 290 bool pn533_rx_frame_is_ack(void *_frame)
 291 {
 292         struct pn533_std_frame *frame = _frame;
 293
 294         if (frame->start_frame != cpu_to_be16(PN533_STD_FRAME_SOF))
 295                 return false;
 296
 297         if (frame->datalen != 0 || frame->datalen_checksum != 0xFF)
 298                 return false;
 299
 300         return true;
 301 }
 302 EXPORT_SYMBOL_GPL(pn533_rx_frame_is_ack);
 303
 304 static inline int pn533_std_rx_frame_size(void *frame)
 305 {
 306         struct pn533_std_frame *f = frame;
 307
 308         /* check for Extended Information frame */
 309         if (PN533_STD_IS_EXTENDED(f)) {
 310                 struct pn533_ext_frame *eif = frame;
 311
 312                 return sizeof(struct pn533_ext_frame)
 313                         + be16_to_cpu(eif->datalen) + PN533_STD_FRAME_TAIL_LEN;
 314         }
 315
 316         return sizeof(struct pn533_std_frame) + f->datalen +
 317                PN533_STD_FRAME_TAIL_LEN;
 318 }
 319
 320 static u8 pn533_std_get_cmd_code(void *frame)
 321 {
 322         struct pn533_std_frame *f = frame;
 323         struct pn533_ext_frame *eif = frame;
 324
 325         if (PN533_STD_IS_EXTENDED(f))
 326                 return PN533_FRAME_CMD(eif);
 327         else
 328                 return PN533_FRAME_CMD(f);
 329 }
 330
 331 bool pn533_rx_frame_is_cmd_response(struct pn533 *dev, void *frame)
 332 {
 333         return (dev->ops->get_cmd_code(frame) ==
 334                                 PN533_CMD_RESPONSE(dev->cmd->code));
 335 }
 336 EXPORT_SYMBOL_GPL(pn533_rx_frame_is_cmd_response);
 337
 338
 339 static struct pn533_frame_ops pn533_std_frame_ops = {
 340         .tx_frame_init = pn533_std_tx_frame_init,
 341         .tx_frame_finish = pn533_std_tx_frame_finish,
 342         .tx_update_payload_len = pn533_std_tx_update_payload_len,
 343         .tx_header_len = PN533_STD_FRAME_HEADER_LEN,
 344         .tx_tail_len = PN533_STD_FRAME_TAIL_LEN,
 345
 346         .rx_is_frame_valid = pn533_std_rx_frame_is_valid,
 347         .rx_frame_size = pn533_std_rx_frame_size,
 348         .rx_header_len = PN533_STD_FRAME_HEADER_LEN,
 349         .rx_tail_len = PN533_STD_FRAME_TAIL_LEN,
 350
 351         .max_payload_len =  PN533_STD_FRAME_MAX_PAYLOAD_LEN,
 352         .get_cmd_code = pn533_std_get_cmd_code,
 353 };
 354
 355 static void pn533_build_cmd_frame(struct pn533 *dev, u8 cmd_code,
 356                                   struct sk_buff *skb)
 357 {
 358         /* payload is already there, just update datalen */
 359         int payload_len = skb->len;
 360         struct pn533_frame_ops *ops = dev->ops;
 361
 362
 363         skb_push(skb, ops->tx_header_len);
 364         skb_put(skb, ops->tx_tail_len);
 365
 366         ops->tx_frame_init(skb->data, cmd_code);
 367         ops->tx_update_payload_len(skb->data, payload_len);
 368         ops->tx_frame_finish(skb->data);
 369 }
 370
 371 static int pn533_send_async_complete(struct pn533 *dev)
 372 {
 373         struct pn533_cmd *cmd = dev->cmd;
 374         struct sk_buff *resp;
 375         int status, rc = 0;
 376
 377         if (!cmd) {
 378                 dev_dbg(dev->dev, "%s: cmd not set\n", __func__);
 379                 goto done;
 380         }
 381
 382         dev_kfree_skb(cmd->req);
 383
 384         status = cmd->status;
 385         resp = cmd->resp;
 386
 387         if (status < 0) {
 388                 rc = cmd->complete_cb(dev, cmd->complete_cb_context,
 389                                       ERR_PTR(status));
 390                 dev_kfree_skb(resp);
 391                 goto done;
 392         }
 393
 394         /* when no response is set we got interrupted */
 395         if (!resp)
 396                 resp = ERR_PTR(-EINTR);
 397
 398         if (!IS_ERR(resp)) {
 399                 skb_pull(resp, dev->ops->rx_header_len);
 400                 skb_trim(resp, resp->len - dev->ops->rx_tail_len);
 401         }
 402
 403         rc = cmd->complete_cb(dev, cmd->complete_cb_context, resp);
 404
 405 done:
 406         kfree(cmd);
 407         dev->cmd = NULL;
 408         return rc;
 409 }
 410
 411 static int __pn533_send_async(struct pn533 *dev, u8 cmd_code,
 412                               struct sk_buff *req,
 413                               pn533_send_async_complete_t complete_cb,
 414                               void *complete_cb_context)
 415 {
 416         struct pn533_cmd *cmd;
 417         int rc = 0;
 418
 419         dev_dbg(dev->dev, "Sending command 0x%x\n", cmd_code);
 420
 421         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
 422         if (!cmd)
 423                 return -ENOMEM;
 424
 425         cmd->code = cmd_code;
 426         cmd->req = req;
 427         cmd->complete_cb = complete_cb;
 428         cmd->complete_cb_context = complete_cb_context;
 429
 430         pn533_build_cmd_frame(dev, cmd_code, req);
 431
 432         mutex_lock(&dev->cmd_lock);
 433
 434         if (!dev->cmd_pending) {
 435                 dev->cmd = cmd;
 436                 rc = dev->phy_ops->send_frame(dev, req);
 437                 if (rc) {
 438                         dev->cmd = NULL;
 439                         goto error;
 440                 }
 441
 442                 dev->cmd_pending = 1;
 443                 goto unlock;
 444         }
 445
 446         dev_dbg(dev->dev, "%s Queueing command 0x%x\n",
 447                 __func__, cmd_code);
 448
 449         INIT_LIST_HEAD(&cmd->queue);
 450         list_add_tail(&cmd->queue, &dev->cmd_queue);
 451
 452         goto unlock;
 453
 454 error:
 455         kfree(cmd);
 456 unlock:
 457         mutex_unlock(&dev->cmd_lock);
 458         return rc;
 459 }
 460
 461 static int pn533_send_data_async(struct pn533 *dev, u8 cmd_code,
 462                                  struct sk_buff *req,
 463                                  pn533_send_async_complete_t complete_cb,
 464                                  void *complete_cb_context)
 465 {
 466         int rc;
 467
 468         rc = __pn533_send_async(dev, cmd_code, req, complete_cb,
 469                                 complete_cb_context);
 470
 471         return rc;
 472 }
 473
 474 static int pn533_send_cmd_async(struct pn533 *dev, u8 cmd_code,
 475                                 struct sk_buff *req,
 476                                 pn533_send_async_complete_t complete_cb,
 477                                 void *complete_cb_context)
 478 {
 479         int rc;
 480
 481         rc = __pn533_send_async(dev, cmd_code, req, complete_cb,
 482                                 complete_cb_context);
 483
 484         return rc;
 485 }
 486
 487 /*
 488  * pn533_send_cmd_direct_async
 489  *
 490  * The function sends a piority cmd directly to the chip omitting the cmd
 491  * queue. It's intended to be used by chaining mechanism of received responses
 492  * where the host has to request every single chunk of data before scheduling
 493  * next cmd from the queue.
 494  */
 495 static int pn533_send_cmd_direct_async(struct pn533 *dev, u8 cmd_code,
 496                                        struct sk_buff *req,
 497                                        pn533_send_async_complete_t complete_cb,
 498                                        void *complete_cb_context)
 499 {
 500         struct pn533_cmd *cmd;
 501         int rc;
 502
 503         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
 504         if (!cmd)
 505                 return -ENOMEM;
 506
 507         cmd->code = cmd_code;
 508         cmd->req = req;
 509         cmd->complete_cb = complete_cb;
 510         cmd->complete_cb_context = complete_cb_context;
 511
 512         pn533_build_cmd_frame(dev, cmd_code, req);
 513
 514         dev->cmd = cmd;
 515         rc = dev->phy_ops->send_frame(dev, req);
 516         if (rc < 0) {
 517                 dev->cmd = NULL;
 518                 kfree(cmd);
 519         }
 520
 521         return rc;
 522 }
 523
 524 static void pn533_wq_cmd_complete(struct work_struct *work)
 525 {
 526         struct pn533 *dev = container_of(work, struct pn533, cmd_complete_work);
 527         int rc;
 528
 529         rc = pn533_send_async_complete(dev);
 530         if (rc != -EINPROGRESS)
 531                 queue_work(dev->wq, &dev->cmd_work);
 532 }
 533
 534 static void pn533_wq_cmd(struct work_struct *work)
 535 {
 536         struct pn533 *dev = container_of(work, struct pn533, cmd_work);
 537         struct pn533_cmd *cmd;
 538         int rc;
 539
 540         mutex_lock(&dev->cmd_lock);
 541
 542         if (list_empty(&dev->cmd_queue)) {
 543                 dev->cmd_pending = 0;
 544                 mutex_unlock(&dev->cmd_lock);
 545                 return;
 546         }
 547
 548         cmd = list_first_entry(&dev->cmd_queue, struct pn533_cmd, queue);
 549
 550         list_del(&cmd->queue);
 551
 552         mutex_unlock(&dev->cmd_lock);
 553
 554         dev->cmd = cmd;
 555         rc = dev->phy_ops->send_frame(dev, cmd->req);
 556         if (rc < 0) {
 557                 dev->cmd = NULL;
 558                 dev_kfree_skb(cmd->req);
 559                 kfree(cmd);
 560                 return;
 561         }
 562
 563 }
 564
 565 struct pn533_sync_cmd_response {
 566         struct sk_buff *resp;
 567         struct completion done;
 568 };
 569
 570 static int pn533_send_sync_complete(struct pn533 *dev, void *_arg,
 571                                     struct sk_buff *resp)
 572 {
 573         struct pn533_sync_cmd_response *arg = _arg;
 574
 575         arg->resp = resp;
 576         complete(&arg->done);
 577
 578         return 0;
 579 }
 580
 581 /*  pn533_send_cmd_sync
 582  *
 583  *  Please note the req parameter is freed inside the function to
 584  *  limit a number of return value interpretations by the caller.
 585  *
 586  *  1. negative in case of error during TX path -> req should be freed
 587  *
 588  *  2. negative in case of error during RX path -> req should not be freed
 589  *     as it's been already freed at the beginning of RX path by
 590  *     async_complete_cb.
 591  *
 592  *  3. valid pointer in case of succesfult RX path
 593  *
 594  *  A caller has to check a return value with IS_ERR macro. If the test pass,
 595  *  the returned pointer is valid.
 596  *
 597  */
 598 static struct sk_buff *pn533_send_cmd_sync(struct pn533 *dev, u8 cmd_code,
 599                                                struct sk_buff *req)
 600 {
 601         int rc;
 602         struct pn533_sync_cmd_response arg;
 603
 604         init_completion(&arg.done);
 605
 606         rc = pn533_send_cmd_async(dev, cmd_code, req,
 607                                   pn533_send_sync_complete, &arg);
 608         if (rc) {
 609                 dev_kfree_skb(req);
 610                 return ERR_PTR(rc);
 611         }
 612
 613         wait_for_completion(&arg.done);
 614
 615         return arg.resp;
 616 }
 617
 618 static struct sk_buff *pn533_alloc_skb(struct pn533 *dev, unsigned int size)
 619 {
 620         struct sk_buff *skb;
 621
 622         skb = alloc_skb(dev->ops->tx_header_len +
 623                         size +
 624                         dev->ops->tx_tail_len, GFP_KERNEL);
 625
 626         if (skb)
 627                 skb_reserve(skb, dev->ops->tx_header_len);
 628
 629         return skb;
 630 }
 631
 632 struct pn533_target_type_a {
 633         __be16 sens_res;
 634         u8 sel_res;
 635         u8 nfcid_len;
 636         u8 nfcid_data[];
 637 } __packed;
 638
 639
 640 #define PN533_TYPE_A_SENS_RES_NFCID1(x) ((u8)((be16_to_cpu(x) & 0x00C0) >> 6))
 641 #define PN533_TYPE_A_SENS_RES_SSD(x) ((u8)((be16_to_cpu(x) & 0x001F) >> 0))
 642 #define PN533_TYPE_A_SENS_RES_PLATCONF(x) ((u8)((be16_to_cpu(x) & 0x0F00) >> 8))
 643
 644 #define PN533_TYPE_A_SENS_RES_SSD_JEWEL 0x00
 645 #define PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL 0x0C
 646
 647 #define PN533_TYPE_A_SEL_PROT(x) (((x) & 0x60) >> 5)
 648 #define PN533_TYPE_A_SEL_CASCADE(x) (((x) & 0x04) >> 2)
 649
 650 #define PN533_TYPE_A_SEL_PROT_MIFARE 0
 651 #define PN533_TYPE_A_SEL_PROT_ISO14443 1
 652 #define PN533_TYPE_A_SEL_PROT_DEP 2
 653 #define PN533_TYPE_A_SEL_PROT_ISO14443_DEP 3
 654
 655 static bool pn533_target_type_a_is_valid(struct pn533_target_type_a *type_a,
 656                                                         int target_data_len)
 657 {
 658         u8 ssd;
 659         u8 platconf;
 660
 661         if (target_data_len < sizeof(struct pn533_target_type_a))
 662                 return false;
 663
 664         /*
 665          * The length check of nfcid[] and ats[] are not being performed because
 666          * the values are not being used
 667          */
 668
 669         /* Requirement 4.6.3.3 from NFC Forum Digital Spec */
 670         ssd = PN533_TYPE_A_SENS_RES_SSD(type_a->sens_res);
 671         platconf = PN533_TYPE_A_SENS_RES_PLATCONF(type_a->sens_res);
 672
 673         if ((ssd == PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
 674              platconf != PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL) ||
 675             (ssd != PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
 676              platconf == PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL))
 677                 return false;
 678
 679         /* Requirements 4.8.2.1, 4.8.2.3, 4.8.2.5 and 4.8.2.7 from NFC Forum */
 680         if (PN533_TYPE_A_SEL_CASCADE(type_a->sel_res) != 0)
 681                 return false;
 682
 683         return true;
 684 }
 685
 686 static int pn533_target_found_type_a(struct nfc_target *nfc_tgt, u8 *tgt_data,
 687                                                         int tgt_data_len)
 688 {
 689         struct pn533_target_type_a *tgt_type_a;
 690
 691         tgt_type_a = (struct pn533_target_type_a *)tgt_data;
 692
 693         if (!pn533_target_type_a_is_valid(tgt_type_a, tgt_data_len))
 694                 return -EPROTO;
 695
 696         switch (PN533_TYPE_A_SEL_PROT(tgt_type_a->sel_res)) {
 697         case PN533_TYPE_A_SEL_PROT_MIFARE:
 698                 nfc_tgt->supported_protocols = NFC_PROTO_MIFARE_MASK;
 699                 break;
 700         case PN533_TYPE_A_SEL_PROT_ISO14443:
 701                 nfc_tgt->supported_protocols = NFC_PROTO_ISO14443_MASK;
 702                 break;
 703         case PN533_TYPE_A_SEL_PROT_DEP:
 704                 nfc_tgt->supported_protocols = NFC_PROTO_NFC_DEP_MASK;
 705                 break;
 706         case PN533_TYPE_A_SEL_PROT_ISO14443_DEP:
 707                 nfc_tgt->supported_protocols = NFC_PROTO_ISO14443_MASK |
 708                                                         NFC_PROTO_NFC_DEP_MASK;
 709                 break;
 710         }
 711
 712         nfc_tgt->sens_res = be16_to_cpu(tgt_type_a->sens_res);
 713         nfc_tgt->sel_res = tgt_type_a->sel_res;
 714         nfc_tgt->nfcid1_len = tgt_type_a->nfcid_len;
 715         memcpy(nfc_tgt->nfcid1, tgt_type_a->nfcid_data, nfc_tgt->nfcid1_len);
 716
 717         return 0;
 718 }
 719
 720 struct pn533_target_felica {
 721         u8 pol_res;
 722         u8 opcode;
 723         u8 nfcid2[NFC_NFCID2_MAXSIZE];
 724         u8 pad[8];
 725         /* optional */
 726         u8 syst_code[];
 727 } __packed;
 728
 729 #define PN533_FELICA_SENSF_NFCID2_DEP_B1 0x01
 730 #define PN533_FELICA_SENSF_NFCID2_DEP_B2 0xFE
 731
 732 static bool pn533_target_felica_is_valid(struct pn533_target_felica *felica,
 733                                                         int target_data_len)
 734 {
 735         if (target_data_len < sizeof(struct pn533_target_felica))
 736                 return false;
 737
 738         if (felica->opcode != PN533_FELICA_OPC_SENSF_RES)
 739                 return false;
 740
 741         return true;
 742 }
 743
 744 static int pn533_target_found_felica(struct nfc_target *nfc_tgt, u8 *tgt_data,
 745                                                         int tgt_data_len)
 746 {
 747         struct pn533_target_felica *tgt_felica;
 748
 749         tgt_felica = (struct pn533_target_felica *)tgt_data;
 750
 751         if (!pn533_target_felica_is_valid(tgt_felica, tgt_data_len))
 752                 return -EPROTO;
 753
 754         if ((tgt_felica->nfcid2[0] == PN533_FELICA_SENSF_NFCID2_DEP_B1) &&
 755             (tgt_felica->nfcid2[1] == PN533_FELICA_SENSF_NFCID2_DEP_B2))
 756                 nfc_tgt->supported_protocols = NFC_PROTO_NFC_DEP_MASK;
 757         else
 758                 nfc_tgt->supported_protocols = NFC_PROTO_FELICA_MASK;
 759
 760         memcpy(nfc_tgt->sensf_res, &tgt_felica->opcode, 9);
 761         nfc_tgt->sensf_res_len = 9;
 762
 763         memcpy(nfc_tgt->nfcid2, tgt_felica->nfcid2, NFC_NFCID2_MAXSIZE);
 764         nfc_tgt->nfcid2_len = NFC_NFCID2_MAXSIZE;
 765
 766         return 0;
 767 }
 768
 769 struct pn533_target_jewel {
 770         __be16 sens_res;
 771         u8 jewelid[4];
 772 } __packed;
 773
 774 static bool pn533_target_jewel_is_valid(struct pn533_target_jewel *jewel,
 775                                                         int target_data_len)
 776 {
 777         u8 ssd;
 778         u8 platconf;
 779
 780         if (target_data_len < sizeof(struct pn533_target_jewel))
 781                 return false;
 782
 783         /* Requirement 4.6.3.3 from NFC Forum Digital Spec */
 784         ssd = PN533_TYPE_A_SENS_RES_SSD(jewel->sens_res);
 785         platconf = PN533_TYPE_A_SENS_RES_PLATCONF(jewel->sens_res);
 786
 787         if ((ssd == PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
 788              platconf != PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL) ||
 789             (ssd != PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
 790              platconf == PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL))
 791                 return false;
 792
 793         return true;
 794 }
 795
 796 static int pn533_target_found_jewel(struct nfc_target *nfc_tgt, u8 *tgt_data,
 797                                                         int tgt_data_len)
 798 {
 799         struct pn533_target_jewel *tgt_jewel;
 800
 801         tgt_jewel = (struct pn533_target_jewel *)tgt_data;
 802
 803         if (!pn533_target_jewel_is_valid(tgt_jewel, tgt_data_len))
 804                 return -EPROTO;
 805
 806         nfc_tgt->supported_protocols = NFC_PROTO_JEWEL_MASK;
 807         nfc_tgt->sens_res = be16_to_cpu(tgt_jewel->sens_res);
 808         nfc_tgt->nfcid1_len = 4;
 809         memcpy(nfc_tgt->nfcid1, tgt_jewel->jewelid, nfc_tgt->nfcid1_len);
 810
 811         return 0;
 812 }
 813
 814 struct pn533_type_b_prot_info {
 815         u8 bitrate;
 816         u8 fsci_type;
 817         u8 fwi_adc_fo;
 818 } __packed;
 819
 820 #define PN533_TYPE_B_PROT_FCSI(x) (((x) & 0xF0) >> 4)
 821 #define PN533_TYPE_B_PROT_TYPE(x) (((x) & 0x0F) >> 0)
 822 #define PN533_TYPE_B_PROT_TYPE_RFU_MASK 0x8
 823
 824 struct pn533_type_b_sens_res {
 825         u8 opcode;
 826         u8 nfcid[4];
 827         u8 appdata[4];
 828         struct pn533_type_b_prot_info prot_info;
 829 } __packed;
 830
 831 #define PN533_TYPE_B_OPC_SENSB_RES 0x50
 832
 833 struct pn533_target_type_b {
 834         struct pn533_type_b_sens_res sensb_res;
 835         u8 attrib_res_len;
 836         u8 attrib_res[];
 837 } __packed;
 838
 839 static bool pn533_target_type_b_is_valid(struct pn533_target_type_b *type_b,
 840                                                         int target_data_len)
 841 {
 842         if (target_data_len < sizeof(struct pn533_target_type_b))
 843                 return false;
 844
 845         if (type_b->sensb_res.opcode != PN533_TYPE_B_OPC_SENSB_RES)
 846                 return false;
 847
 848         if (PN533_TYPE_B_PROT_TYPE(type_b->sensb_res.prot_info.fsci_type) &
 849                                                 PN533_TYPE_B_PROT_TYPE_RFU_MASK)
 850                 return false;
 851
 852         return true;
 853 }
 854
 855 static int pn533_target_found_type_b(struct nfc_target *nfc_tgt, u8 *tgt_data,
 856                                                         int tgt_data_len)
 857 {
 858         struct pn533_target_type_b *tgt_type_b;
 859
 860         tgt_type_b = (struct pn533_target_type_b *)tgt_data;
 861
 862         if (!pn533_target_type_b_is_valid(tgt_type_b, tgt_data_len))
 863                 return -EPROTO;
 864
 865         nfc_tgt->supported_protocols = NFC_PROTO_ISO14443_B_MASK;
 866
 867         return 0;
 868 }
 869
 870 static void pn533_poll_reset_mod_list(struct pn533 *dev);
 871 static int pn533_target_found(struct pn533 *dev, u8 tg, u8 *tgdata,
 872                               int tgdata_len)
 873 {
 874         struct nfc_target nfc_tgt;
 875         int rc;
 876
 877         dev_dbg(dev->dev, "%s: modulation=%d\n",
 878                 __func__, dev->poll_mod_curr);
 879
 880         if (tg != 1)
 881                 return -EPROTO;
 882
 883         memset(&nfc_tgt, 0, sizeof(struct nfc_target));
 884
 885         switch (dev->poll_mod_curr) {
 886         case PN533_POLL_MOD_106KBPS_A:
 887                 rc = pn533_target_found_type_a(&nfc_tgt, tgdata, tgdata_len);
 888                 break;
 889         case PN533_POLL_MOD_212KBPS_FELICA:
 890         case PN533_POLL_MOD_424KBPS_FELICA:
 891                 rc = pn533_target_found_felica(&nfc_tgt, tgdata, tgdata_len);
 892                 break;
 893         case PN533_POLL_MOD_106KBPS_JEWEL:
 894                 rc = pn533_target_found_jewel(&nfc_tgt, tgdata, tgdata_len);
 895                 break;
 896         case PN533_POLL_MOD_847KBPS_B:
 897                 rc = pn533_target_found_type_b(&nfc_tgt, tgdata, tgdata_len);
 898                 break;
 899         default:
 900                 nfc_err(dev->dev,
 901                         "Unknown current poll modulation\n");
 902                 return -EPROTO;
 903         }
 904
 905         if (rc)
 906                 return rc;
 907
 908         if (!(nfc_tgt.supported_protocols & dev->poll_protocols)) {
 909                 dev_dbg(dev->dev,
 910                         "The Tg found doesn't have the desired protocol\n");
 911                 return -EAGAIN;
 912         }
 913
 914         dev_dbg(dev->dev,
 915                 "Target found - supported protocols: 0x%x\n",
 916                 nfc_tgt.supported_protocols);
 917
 918         dev->tgt_available_prots = nfc_tgt.supported_protocols;
 919
 920         pn533_poll_reset_mod_list(dev);
 921         nfc_targets_found(dev->nfc_dev, &nfc_tgt, 1);
 922
 923         return 0;
 924 }
 925
 926 static inline void pn533_poll_next_mod(struct pn533 *dev)
 927 {
 928         dev->poll_mod_curr = (dev->poll_mod_curr + 1) % dev->poll_mod_count;
 929 }
 930
 931 static void pn533_poll_reset_mod_list(struct pn533 *dev)
 932 {
 933         dev->poll_mod_count = 0;
 934 }
 935
 936 static void pn533_poll_add_mod(struct pn533 *dev, u8 mod_index)
 937 {
 938         dev->poll_mod_active[dev->poll_mod_count] =
 939                 (struct pn533_poll_modulations *)&poll_mod[mod_index];
 940         dev->poll_mod_count++;
 941 }
 942
 943 static void pn533_poll_create_mod_list(struct pn533 *dev,
 944                                        u32 im_protocols, u32 tm_protocols)
 945 {
 946         pn533_poll_reset_mod_list(dev);
 947
 948         if ((im_protocols & NFC_PROTO_MIFARE_MASK) ||
 949             (im_protocols & NFC_PROTO_ISO14443_MASK) ||
 950             (im_protocols & NFC_PROTO_NFC_DEP_MASK))
 951                 pn533_poll_add_mod(dev, PN533_POLL_MOD_106KBPS_A);
 952
 953         if (im_protocols & NFC_PROTO_FELICA_MASK ||
 954             im_protocols & NFC_PROTO_NFC_DEP_MASK) {
 955                 pn533_poll_add_mod(dev, PN533_POLL_MOD_212KBPS_FELICA);
 956                 pn533_poll_add_mod(dev, PN533_POLL_MOD_424KBPS_FELICA);
 957         }
 958
 959         if (im_protocols & NFC_PROTO_JEWEL_MASK)
 960                 pn533_poll_add_mod(dev, PN533_POLL_MOD_106KBPS_JEWEL);
 961
 962         if (im_protocols & NFC_PROTO_ISO14443_B_MASK)
 963                 pn533_poll_add_mod(dev, PN533_POLL_MOD_847KBPS_B);
 964
 965         if (tm_protocols)
 966                 pn533_poll_add_mod(dev, PN533_LISTEN_MOD);
 967 }
 968
 969 static int pn533_start_poll_complete(struct pn533 *dev, struct sk_buff *resp)
 970 {
 971         u8 nbtg, tg, *tgdata;
 972         int rc, tgdata_len;
 973
 974         /* Toggle the DEP polling */
 975         if (dev->poll_protocols & NFC_PROTO_NFC_DEP_MASK)
 976                 dev->poll_dep = 1;
 977
 978         nbtg = resp->data[0];
 979         tg = resp->data[1];
 980         tgdata = &resp->data[2];
 981         tgdata_len = resp->len - 2;  /* nbtg + tg */
 982
 983         if (nbtg) {
 984                 rc = pn533_target_found(dev, tg, tgdata, tgdata_len);
 985
 986                 /* We must stop the poll after a valid target found */
 987                 if (rc == 0)
 988                         return 0;
 989         }
 990
 991         return -EAGAIN;
 992 }
 993
 994 static struct sk_buff *pn533_alloc_poll_tg_frame(struct pn533 *dev)
 995 {
 996         struct sk_buff *skb;
 997         u8 *felica, *nfcid3;
 998
 999         u8 *gbytes = dev->gb;
1000         size_t gbytes_len = dev->gb_len;
1001
1002         u8 felica_params[18] = {0x1, 0xfe, /* DEP */
1003                                 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, /* random */
1004                                 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
1005                                 0xff, 0xff}; /* System code */
1006
1007         u8 mifare_params[6] = {0x1, 0x1, /* SENS_RES */
1008                                0x0, 0x0, 0x0,
1009                                0x40}; /* SEL_RES for DEP */
1010
1011         unsigned int skb_len = 36 + /*
1012                                      * mode (1), mifare (6),
1013                                      * felica (18), nfcid3 (10), gb_len (1)
1014                                      */
1015                                gbytes_len +
1016                                1;  /* len Tk*/
1017
1018         skb = pn533_alloc_skb(dev, skb_len);
1019         if (!skb)
1020                 return NULL;
1021
1022         /* DEP support only */
1023         skb_put_u8(skb, PN533_INIT_TARGET_DEP);
1024
1025         /* MIFARE params */
1026         skb_put_data(skb, mifare_params, 6);
1027
1028         /* Felica params */
1029         felica = skb_put_data(skb, felica_params, 18);
1030         get_random_bytes(felica + 2, 6);
1031
1032         /* NFCID3 */
1033         nfcid3 = skb_put_zero(skb, 10);
1034         memcpy(nfcid3, felica, 8);
1035
1036         /* General bytes */
1037         skb_put_u8(skb, gbytes_len);
1038
1039         skb_put_data(skb, gbytes, gbytes_len);
1040
1041         /* Len Tk */
1042         skb_put_u8(skb, 0);
1043
1044         return skb;
1045 }
1046
1047 static void pn533_wq_tm_mi_recv(struct work_struct *work);
1048 static struct sk_buff *pn533_build_response(struct pn533 *dev);
1049
1050 static int pn533_tm_get_data_complete(struct pn533 *dev, void *arg,
1051                                       struct sk_buff *resp)
1052 {
1053         struct sk_buff *skb;
1054         u8 status, ret, mi;
1055         int rc;
1056
1057         dev_dbg(dev->dev, "%s\n", __func__);
1058
1059         if (IS_ERR(resp)) {
1060                 skb_queue_purge(&dev->resp_q);
1061                 return PTR_ERR(resp);
1062         }
1063
1064         status = resp->data[0];
1065
1066         ret = status & PN533_CMD_RET_MASK;
1067         mi = status & PN533_CMD_MI_MASK;
1068
1069         skb_pull(resp, sizeof(status));
1070
1071         if (ret != PN533_CMD_RET_SUCCESS) {
1072                 rc = -EIO;
1073                 goto error;
1074         }
1075
1076         skb_queue_tail(&dev->resp_q, resp);
1077
1078         if (mi) {
1079                 queue_work(dev->wq, &dev->mi_tm_rx_work);
1080                 return -EINPROGRESS;
1081         }
1082
1083         skb = pn533_build_response(dev);
1084         if (!skb) {
1085                 rc = -EIO;
1086                 goto error;
1087         }
1088
1089         return nfc_tm_data_received(dev->nfc_dev, skb);
1090
1091 error:
1092         nfc_tm_deactivated(dev->nfc_dev);
1093         dev->tgt_mode = 0;
1094         skb_queue_purge(&dev->resp_q);
1095         dev_kfree_skb(resp);
1096
1097         return rc;
1098 }
1099
1100 static void pn533_wq_tm_mi_recv(struct work_struct *work)
1101 {
1102         struct pn533 *dev = container_of(work, struct pn533, mi_tm_rx_work);
1103         struct sk_buff *skb;
1104         int rc;
1105
1106         dev_dbg(dev->dev, "%s\n", __func__);
1107
1108         skb = pn533_alloc_skb(dev, 0);
1109         if (!skb)
1110                 return;
1111
1112         rc = pn533_send_cmd_direct_async(dev,
1113                                         PN533_CMD_TG_GET_DATA,
1114                                         skb,
1115                                         pn533_tm_get_data_complete,
1116                                         NULL);
1117
1118         if (rc < 0)
1119                 dev_kfree_skb(skb);
1120 }
1121
1122 static int pn533_tm_send_complete(struct pn533 *dev, void *arg,
1123                                   struct sk_buff *resp);
1124 static void pn533_wq_tm_mi_send(struct work_struct *work)
1125 {
1126         struct pn533 *dev = container_of(work, struct pn533, mi_tm_tx_work);
1127         struct sk_buff *skb;
1128         int rc;
1129
1130         dev_dbg(dev->dev, "%s\n", __func__);
1131
1132         /* Grab the first skb in the queue */
1133         skb = skb_dequeue(&dev->fragment_skb);
1134         if (skb == NULL) {      /* No more data */
1135                 /* Reset the queue for future use */
1136                 skb_queue_head_init(&dev->fragment_skb);
1137                 goto error;
1138         }
1139
1140         /* last entry - remove MI bit */
1141         if (skb_queue_len(&dev->fragment_skb) == 0) {
1142                 rc = pn533_send_cmd_direct_async(dev, PN533_CMD_TG_SET_DATA,
1143                                         skb, pn533_tm_send_complete, NULL);
1144         } else
1145                 rc = pn533_send_cmd_direct_async(dev,
1146                                         PN533_CMD_TG_SET_META_DATA,
1147                                         skb, pn533_tm_send_complete, NULL);
1148
1149         if (rc == 0) /* success */
1150                 return;
1151
1152         dev_err(dev->dev,
1153                 "Error %d when trying to perform set meta data_exchange", rc);
1154
1155         dev_kfree_skb(skb);
1156
1157 error:
1158         dev->phy_ops->send_ack(dev, GFP_KERNEL);
1159         queue_work(dev->wq, &dev->cmd_work);
1160 }
1161
1162 static void pn533_wq_tg_get_data(struct work_struct *work)
1163 {
1164         struct pn533 *dev = container_of(work, struct pn533, tg_work);
1165         struct sk_buff *skb;
1166         int rc;
1167
1168         dev_dbg(dev->dev, "%s\n", __func__);
1169
1170         skb = pn533_alloc_skb(dev, 0);
1171         if (!skb)
1172                 return;
1173
1174         rc = pn533_send_data_async(dev, PN533_CMD_TG_GET_DATA, skb,
1175                                    pn533_tm_get_data_complete, NULL);
1176
1177         if (rc < 0)
1178                 dev_kfree_skb(skb);
1179 }
1180
1181 #define ATR_REQ_GB_OFFSET 17
1182 static int pn533_init_target_complete(struct pn533 *dev, struct sk_buff *resp)
1183 {
1184         u8 mode, *cmd, comm_mode = NFC_COMM_PASSIVE, *gb;
1185         size_t gb_len;
1186         int rc;
1187
1188         dev_dbg(dev->dev, "%s\n", __func__);
1189
1190         if (resp->len < ATR_REQ_GB_OFFSET + 1)
1191                 return -EINVAL;
1192
1193         mode = resp->data[0];
1194         cmd = &resp->data[1];
1195
1196         dev_dbg(dev->dev, "Target mode 0x%x len %d\n",
1197                 mode, resp->len);
1198
1199         if ((mode & PN533_INIT_TARGET_RESP_FRAME_MASK) ==
1200             PN533_INIT_TARGET_RESP_ACTIVE)
1201                 comm_mode = NFC_COMM_ACTIVE;
1202
1203         if ((mode & PN533_INIT_TARGET_RESP_DEP) == 0)  /* Only DEP supported */
1204                 return -EOPNOTSUPP;
1205
1206         gb = cmd + ATR_REQ_GB_OFFSET;
1207         gb_len = resp->len - (ATR_REQ_GB_OFFSET + 1);
1208
1209         rc = nfc_tm_activated(dev->nfc_dev, NFC_PROTO_NFC_DEP_MASK,
1210                               comm_mode, gb, gb_len);
1211         if (rc < 0) {
1212                 nfc_err(dev->dev,
1213                         "Error when signaling target activation\n");
1214                 return rc;
1215         }
1216
1217         dev->tgt_mode = 1;
1218         queue_work(dev->wq, &dev->tg_work);
1219
1220         return 0;
1221 }
1222
1223 static void pn533_listen_mode_timer(struct timer_list *t)
1224 {
1225         struct pn533 *dev = from_timer(dev, t, listen_timer);
1226
1227         dev_dbg(dev->dev, "Listen mode timeout\n");
1228
1229         dev->cancel_listen = 1;
1230
1231         pn533_poll_next_mod(dev);
1232
1233         queue_delayed_work(dev->wq, &dev->poll_work,
1234                            msecs_to_jiffies(PN533_POLL_INTERVAL));
1235 }
1236
1237 static int pn533_rf_complete(struct pn533 *dev, void *arg,
1238                              struct sk_buff *resp)
1239 {
1240         int rc = 0;
1241
1242         dev_dbg(dev->dev, "%s\n", __func__);
1243
1244         if (IS_ERR(resp)) {
1245                 rc = PTR_ERR(resp);
1246
1247                 nfc_err(dev->dev, "RF setting error %d\n", rc);
1248
1249                 return rc;
1250         }
1251
1252         queue_delayed_work(dev->wq, &dev->poll_work,
1253                            msecs_to_jiffies(PN533_POLL_INTERVAL));
1254
1255         dev_kfree_skb(resp);
1256         return rc;
1257 }
1258
1259 static void pn533_wq_rf(struct work_struct *work)
1260 {
1261         struct pn533 *dev = container_of(work, struct pn533, rf_work);
1262         struct sk_buff *skb;
1263         int rc;
1264
1265         dev_dbg(dev->dev, "%s\n", __func__);
1266
1267         skb = pn533_alloc_skb(dev, 2);
1268         if (!skb)
1269                 return;
1270
1271         skb_put_u8(skb, PN533_CFGITEM_RF_FIELD);
1272         skb_put_u8(skb, PN533_CFGITEM_RF_FIELD_AUTO_RFCA);
1273
1274         rc = pn533_send_cmd_async(dev, PN533_CMD_RF_CONFIGURATION, skb,
1275                                   pn533_rf_complete, NULL);
1276         if (rc < 0) {
1277                 dev_kfree_skb(skb);
1278                 nfc_err(dev->dev, "RF setting error %d\n", rc);
1279         }
1280 }
1281
1282 static int pn533_poll_dep_complete(struct pn533 *dev, void *arg,
1283                                    struct sk_buff *resp)
1284 {
1285         struct pn533_cmd_jump_dep_response *rsp;
1286         struct nfc_target nfc_target;
1287         u8 target_gt_len;
1288         int rc;
1289
1290         if (IS_ERR(resp))
1291                 return PTR_ERR(resp);
1292
1293         rsp = (struct pn533_cmd_jump_dep_response *)resp->data;
1294
1295         rc = rsp->status & PN533_CMD_RET_MASK;
1296         if (rc != PN533_CMD_RET_SUCCESS) {
1297                 /* Not target found, turn radio off */
1298                 queue_work(dev->wq, &dev->rf_work);
1299
1300                 dev_kfree_skb(resp);
1301                 return 0;
1302         }
1303
1304         dev_dbg(dev->dev, "Creating new target");
1305
1306         nfc_target.supported_protocols = NFC_PROTO_NFC_DEP_MASK;
1307         nfc_target.nfcid1_len = 10;
1308         memcpy(nfc_target.nfcid1, rsp->nfcid3t, nfc_target.nfcid1_len);
1309         rc = nfc_targets_found(dev->nfc_dev, &nfc_target, 1);
1310         if (rc)
1311                 goto error;
1312
1313         dev->tgt_available_prots = 0;
1314         dev->tgt_active_prot = NFC_PROTO_NFC_DEP;
1315
1316         /* ATR_RES general bytes are located at offset 17 */
1317         target_gt_len = resp->len - 17;
1318         rc = nfc_set_remote_general_bytes(dev->nfc_dev,
1319                                           rsp->gt, target_gt_len);
1320         if (!rc) {
1321                 rc = nfc_dep_link_is_up(dev->nfc_dev,
1322                                         dev->nfc_dev->targets[0].idx,
1323                                         0, NFC_RF_INITIATOR);
1324
1325                 if (!rc)
1326                         pn533_poll_reset_mod_list(dev);
1327         }
1328 error:
1329         dev_kfree_skb(resp);
1330         return rc;
1331 }
1332
1333 #define PASSIVE_DATA_LEN 5
1334 static int pn533_poll_dep(struct nfc_dev *nfc_dev)
1335 {
1336         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
1337         struct sk_buff *skb;
1338         int rc, skb_len;
1339         u8 *next, nfcid3[NFC_NFCID3_MAXSIZE];
1340         u8 passive_data[PASSIVE_DATA_LEN] = {0x00, 0xff, 0xff, 0x00, 0x3};
1341
1342         dev_dbg(dev->dev, "%s", __func__);
1343
1344         if (!dev->gb) {
1345                 dev->gb = nfc_get_local_general_bytes(nfc_dev, &dev->gb_len);
1346
1347                 if (!dev->gb || !dev->gb_len) {
1348                         dev->poll_dep = 0;
1349                         queue_work(dev->wq, &dev->rf_work);
1350                 }
1351         }
1352
1353         skb_len = 3 + dev->gb_len; /* ActPass + BR + Next */
1354         skb_len += PASSIVE_DATA_LEN;
1355
1356         /* NFCID3 */
1357         skb_len += NFC_NFCID3_MAXSIZE;
1358         nfcid3[0] = 0x1;
1359         nfcid3[1] = 0xfe;
1360         get_random_bytes(nfcid3 + 2, 6);
1361
1362         skb = pn533_alloc_skb(dev, skb_len);
1363         if (!skb)
1364                 return -ENOMEM;
1365
1366         skb_put_u8(skb, 0x01);  /* Active */
1367         skb_put_u8(skb, 0x02);  /* 424 kbps */
1368
1369         next = skb_put(skb, 1);  /* Next */
1370         *next = 0;
1371
1372         /* Copy passive data */
1373         skb_put_data(skb, passive_data, PASSIVE_DATA_LEN);
1374         *next |= 1;
1375
1376         /* Copy NFCID3 (which is NFCID2 from SENSF_RES) */
1377         skb_put_data(skb, nfcid3, NFC_NFCID3_MAXSIZE);
1378         *next |= 2;
1379
1380         skb_put_data(skb, dev->gb, dev->gb_len);
1381         *next |= 4; /* We have some Gi */
1382
1383         rc = pn533_send_cmd_async(dev, PN533_CMD_IN_JUMP_FOR_DEP, skb,
1384                                   pn533_poll_dep_complete, NULL);
1385
1386         if (rc < 0)
1387                 dev_kfree_skb(skb);
1388
1389         return rc;
1390 }
1391
1392 static int pn533_poll_complete(struct pn533 *dev, void *arg,
1393                                struct sk_buff *resp)
1394 {
1395         struct pn533_poll_modulations *cur_mod;
1396         int rc;
1397
1398         dev_dbg(dev->dev, "%s\n", __func__);
1399
1400         if (IS_ERR(resp)) {
1401                 rc = PTR_ERR(resp);
1402
1403                 nfc_err(dev->dev, "%s  Poll complete error %d\n",
1404                         __func__, rc);
1405
1406                 if (rc == -ENOENT) {
1407                         if (dev->poll_mod_count != 0)
1408                                 return rc;
1409                         goto stop_poll;
1410                 } else if (rc < 0) {
1411                         nfc_err(dev->dev,
1412                                 "Error %d when running poll\n", rc);
1413                         goto stop_poll;
1414                 }
1415         }
1416
1417         cur_mod = dev->poll_mod_active[dev->poll_mod_curr];
1418
1419         if (cur_mod->len == 0) { /* Target mode */
1420                 del_timer(&dev->listen_timer);
1421                 rc = pn533_init_target_complete(dev, resp);
1422                 goto done;
1423         }
1424
1425         /* Initiator mode */
1426         rc = pn533_start_poll_complete(dev, resp);
1427         if (!rc)
1428                 goto done;
1429
1430         if (!dev->poll_mod_count) {
1431                 dev_dbg(dev->dev, "Polling has been stopped\n");
1432                 goto done;
1433         }
1434
1435         pn533_poll_next_mod(dev);
1436         /* Not target found, turn radio off */
1437         queue_work(dev->wq, &dev->rf_work);
1438
1439 done:
1440         dev_kfree_skb(resp);
1441         return rc;
1442
1443 stop_poll:
1444         nfc_err(dev->dev, "Polling operation has been stopped\n");
1445
1446         pn533_poll_reset_mod_list(dev);
1447         dev->poll_protocols = 0;
1448         return rc;
1449 }
1450
1451 static struct sk_buff *pn533_alloc_poll_in_frame(struct pn533 *dev,
1452                                         struct pn533_poll_modulations *mod)
1453 {
1454         struct sk_buff *skb;
1455
1456         skb = pn533_alloc_skb(dev, mod->len);
1457         if (!skb)
1458                 return NULL;
1459
1460         skb_put_data(skb, &mod->data, mod->len);
1461
1462         return skb;
1463 }
1464
1465 static int pn533_send_poll_frame(struct pn533 *dev)
1466 {
1467         struct pn533_poll_modulations *mod;
1468         struct sk_buff *skb;
1469         int rc;
1470         u8 cmd_code;
1471
1472         mod = dev->poll_mod_active[dev->poll_mod_curr];
1473
1474         dev_dbg(dev->dev, "%s mod len %d\n",
1475                 __func__, mod->len);
1476
1477         if ((dev->poll_protocols & NFC_PROTO_NFC_DEP_MASK) && dev->poll_dep)  {
1478                 dev->poll_dep = 0;
1479                 return pn533_poll_dep(dev->nfc_dev);
1480         }
1481
1482         if (mod->len == 0) {  /* Listen mode */
1483                 cmd_code = PN533_CMD_TG_INIT_AS_TARGET;
1484                 skb = pn533_alloc_poll_tg_frame(dev);
1485         } else {  /* Polling mode */
1486                 cmd_code =  PN533_CMD_IN_LIST_PASSIVE_TARGET;
1487                 skb = pn533_alloc_poll_in_frame(dev, mod);
1488         }
1489
1490         if (!skb) {
1491                 nfc_err(dev->dev, "Failed to allocate skb\n");
1492                 return -ENOMEM;
1493         }
1494
1495         rc = pn533_send_cmd_async(dev, cmd_code, skb, pn533_poll_complete,
1496                                   NULL);
1497         if (rc < 0) {
1498                 dev_kfree_skb(skb);
1499                 nfc_err(dev->dev, "Polling loop error %d\n", rc);
1500         }
1501
1502         return rc;
1503 }
1504
1505 static void pn533_wq_poll(struct work_struct *work)
1506 {
1507         struct pn533 *dev = container_of(work, struct pn533, poll_work.work);
1508         struct pn533_poll_modulations *cur_mod;
1509         int rc;
1510
1511         cur_mod = dev->poll_mod_active[dev->poll_mod_curr];
1512
1513         dev_dbg(dev->dev,
1514                 "%s cancel_listen %d modulation len %d\n",
1515                 __func__, dev->cancel_listen, cur_mod->len);
1516
1517         if (dev->cancel_listen == 1) {
1518                 dev->cancel_listen = 0;
1519                 dev->phy_ops->abort_cmd(dev, GFP_ATOMIC);
1520         }
1521
1522         rc = pn533_send_poll_frame(dev);
1523         if (rc)
1524                 return;
1525
1526         if (cur_mod->len == 0 && dev->poll_mod_count > 1)
1527                 mod_timer(&dev->listen_timer, jiffies + PN533_LISTEN_TIME * HZ);
1528 }
1529
1530 static int pn533_start_poll(struct nfc_dev *nfc_dev,
1531                             u32 im_protocols, u32 tm_protocols)
1532 {
1533         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
1534         struct pn533_poll_modulations *cur_mod;
1535         u8 rand_mod;
1536         int rc;
1537
1538         dev_dbg(dev->dev,
1539                 "%s: im protocols 0x%x tm protocols 0x%x\n",
1540                 __func__, im_protocols, tm_protocols);
1541
1542         if (dev->tgt_active_prot) {
1543                 nfc_err(dev->dev,
1544                         "Cannot poll with a target already activated\n");
1545                 return -EBUSY;
1546         }
1547
1548         if (dev->tgt_mode) {
1549                 nfc_err(dev->dev,
1550                         "Cannot poll while already being activated\n");
1551                 return -EBUSY;
1552         }
1553
1554         if (tm_protocols) {
1555                 dev->gb = nfc_get_local_general_bytes(nfc_dev, &dev->gb_len);
1556                 if (dev->gb == NULL)
1557                         tm_protocols = 0;
1558         }
1559
1560         pn533_poll_create_mod_list(dev, im_protocols, tm_protocols);
1561         dev->poll_protocols = im_protocols;
1562         dev->listen_protocols = tm_protocols;
1563
1564         /* Do not always start polling from the same modulation */
1565         get_random_bytes(&rand_mod, sizeof(rand_mod));
1566         rand_mod %= dev->poll_mod_count;
1567         dev->poll_mod_curr = rand_mod;
1568
1569         cur_mod = dev->poll_mod_active[dev->poll_mod_curr];
1570
1571         rc = pn533_send_poll_frame(dev);
1572
1573         /* Start listen timer */
1574         if (!rc && cur_mod->len == 0 && dev->poll_mod_count > 1)
1575                 mod_timer(&dev->listen_timer, jiffies + PN533_LISTEN_TIME * HZ);
1576
1577         return rc;
1578 }
1579
1580 static void pn533_stop_poll(struct nfc_dev *nfc_dev)
1581 {
1582         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
1583
1584         del_timer(&dev->listen_timer);
1585
1586         if (!dev->poll_mod_count) {
1587                 dev_dbg(dev->dev,
1588                         "Polling operation was not running\n");
1589                 return;
1590         }
1591
1592         dev->phy_ops->abort_cmd(dev, GFP_KERNEL);
1593         flush_delayed_work(&dev->poll_work);
1594         pn533_poll_reset_mod_list(dev);
1595 }
1596
1597 static int pn533_activate_target_nfcdep(struct pn533 *dev)
1598 {
1599         struct pn533_cmd_activate_response *rsp;
1600         u16 gt_len;
1601         int rc;
1602         struct sk_buff *skb;
1603         struct sk_buff *resp;
1604
1605         dev_dbg(dev->dev, "%s\n", __func__);
1606
1607         skb = pn533_alloc_skb(dev, sizeof(u8) * 2); /*TG + Next*/
1608         if (!skb)
1609                 return -ENOMEM;
1610
1611         skb_put_u8(skb, 1); /* TG */
1612         skb_put_u8(skb, 0); /* Next */
1613
1614         resp = pn533_send_cmd_sync(dev, PN533_CMD_IN_ATR, skb);
1615         if (IS_ERR(resp))
1616                 return PTR_ERR(resp);
1617
1618         rsp = (struct pn533_cmd_activate_response *)resp->data;
1619         rc = rsp->status & PN533_CMD_RET_MASK;
1620         if (rc != PN533_CMD_RET_SUCCESS) {
1621                 nfc_err(dev->dev,
1622                         "Target activation failed (error 0x%x)\n", rc);
1623                 dev_kfree_skb(resp);
1624                 return -EIO;
1625         }
1626
1627         /* ATR_RES general bytes are located at offset 16 */
1628         gt_len = resp->len - 16;
1629         rc = nfc_set_remote_general_bytes(dev->nfc_dev, rsp->gt, gt_len);
1630
1631         dev_kfree_skb(resp);
1632         return rc;
1633 }
1634
1635 static int pn533_activate_target(struct nfc_dev *nfc_dev,
1636                                  struct nfc_target *target, u32 protocol)
1637 {
1638         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
1639         int rc;
1640
1641         dev_dbg(dev->dev, "%s: protocol=%u\n", __func__, protocol);
1642
1643         if (dev->poll_mod_count) {
1644                 nfc_err(dev->dev,
1645                         "Cannot activate while polling\n");
1646                 return -EBUSY;
1647         }
1648
1649         if (dev->tgt_active_prot) {
1650                 nfc_err(dev->dev,
1651                         "There is already an active target\n");
1652                 return -EBUSY;
1653         }
1654
1655         if (!dev->tgt_available_prots) {
1656                 nfc_err(dev->dev,
1657                         "There is no available target to activate\n");
1658                 return -EINVAL;
1659         }
1660
1661         if (!(dev->tgt_available_prots & (1 << protocol))) {
1662                 nfc_err(dev->dev,
1663                         "Target doesn't support requested proto %u\n",
1664                         protocol);
1665                 return -EINVAL;
1666         }
1667
1668         if (protocol == NFC_PROTO_NFC_DEP) {
1669                 rc = pn533_activate_target_nfcdep(dev);
1670                 if (rc) {
1671                         nfc_err(dev->dev,
1672                                 "Activating target with DEP failed %d\n", rc);
1673                         return rc;
1674                 }
1675         }
1676
1677         dev->tgt_active_prot = protocol;
1678         dev->tgt_available_prots = 0;
1679
1680         return 0;
1681 }
1682
1683 static int pn533_deactivate_target_complete(struct pn533 *dev, void *arg,
1684                              struct sk_buff *resp)
1685 {
1686         int rc = 0;
1687
1688         dev_dbg(dev->dev, "%s\n", __func__);
1689
1690         if (IS_ERR(resp)) {
1691                 rc = PTR_ERR(resp);
1692
1693                 nfc_err(dev->dev, "Target release error %d\n", rc);
1694
1695                 return rc;
1696         }
1697
1698         rc = resp->data[0] & PN533_CMD_RET_MASK;
1699         if (rc != PN533_CMD_RET_SUCCESS)
1700                 nfc_err(dev->dev,
1701                         "Error 0x%x when releasing the target\n", rc);
1702
1703         dev_kfree_skb(resp);
1704         return rc;
1705 }
1706
1707 static void pn533_deactivate_target(struct nfc_dev *nfc_dev,
1708                                     struct nfc_target *target, u8 mode)
1709 {
1710         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
1711         struct sk_buff *skb;
1712         int rc;
1713
1714         dev_dbg(dev->dev, "%s\n", __func__);
1715
1716         if (!dev->tgt_active_prot) {
1717                 nfc_err(dev->dev, "There is no active target\n");
1718                 return;
1719         }
1720
1721         dev->tgt_active_prot = 0;
1722         skb_queue_purge(&dev->resp_q);
1723
1724         skb = pn533_alloc_skb(dev, sizeof(u8));
1725         if (!skb)
1726                 return;
1727
1728         skb_put_u8(skb, 1); /* TG*/
1729
1730         rc = pn533_send_cmd_async(dev, PN533_CMD_IN_RELEASE, skb,
1731                                   pn533_deactivate_target_complete, NULL);
1732         if (rc < 0) {
1733                 dev_kfree_skb(skb);
1734                 nfc_err(dev->dev, "Target release error %d\n", rc);
1735         }
1736 }
1737
1738
1739 static int pn533_in_dep_link_up_complete(struct pn533 *dev, void *arg,
1740                                          struct sk_buff *resp)
1741 {
1742         struct pn533_cmd_jump_dep_response *rsp;
1743         u8 target_gt_len;
1744         int rc;
1745         u8 active = *(u8 *)arg;
1746
1747         kfree(arg);
1748
1749         if (IS_ERR(resp))
1750                 return PTR_ERR(resp);
1751
1752         if (dev->tgt_available_prots &&
1753             !(dev->tgt_available_prots & (1 << NFC_PROTO_NFC_DEP))) {
1754                 nfc_err(dev->dev,
1755                         "The target does not support DEP\n");
1756                 rc =  -EINVAL;
1757                 goto error;
1758         }
1759
1760         rsp = (struct pn533_cmd_jump_dep_response *)resp->data;
1761
1762         rc = rsp->status & PN533_CMD_RET_MASK;
1763         if (rc != PN533_CMD_RET_SUCCESS) {
1764                 nfc_err(dev->dev,
1765                         "Bringing DEP link up failed (error 0x%x)\n", rc);
1766                 goto error;
1767         }
1768
1769         if (!dev->tgt_available_prots) {
1770                 struct nfc_target nfc_target;
1771
1772                 dev_dbg(dev->dev, "Creating new target\n");
1773
1774                 nfc_target.supported_protocols = NFC_PROTO_NFC_DEP_MASK;
1775                 nfc_target.nfcid1_len = 10;
1776                 memcpy(nfc_target.nfcid1, rsp->nfcid3t, nfc_target.nfcid1_len);
1777                 rc = nfc_targets_found(dev->nfc_dev, &nfc_target, 1);
1778                 if (rc)
1779                         goto error;
1780
1781                 dev->tgt_available_prots = 0;
1782         }
1783
1784         dev->tgt_active_prot = NFC_PROTO_NFC_DEP;
1785
1786         /* ATR_RES general bytes are located at offset 17 */
1787         target_gt_len = resp->len - 17;
1788         rc = nfc_set_remote_general_bytes(dev->nfc_dev,
1789                                           rsp->gt, target_gt_len);
1790         if (rc == 0)
1791                 rc = nfc_dep_link_is_up(dev->nfc_dev,
1792                                         dev->nfc_dev->targets[0].idx,
1793                                         !active, NFC_RF_INITIATOR);
1794
1795 error:
1796         dev_kfree_skb(resp);
1797         return rc;
1798 }
1799
1800 static int pn533_rf_field(struct nfc_dev *nfc_dev, u8 rf);
1801 static int pn533_dep_link_up(struct nfc_dev *nfc_dev, struct nfc_target *target,
1802                              u8 comm_mode, u8 *gb, size_t gb_len)
1803 {
1804         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
1805         struct sk_buff *skb;
1806         int rc, skb_len;
1807         u8 *next, *arg, nfcid3[NFC_NFCID3_MAXSIZE];
1808         u8 passive_data[PASSIVE_DATA_LEN] = {0x00, 0xff, 0xff, 0x00, 0x3};
1809
1810         dev_dbg(dev->dev, "%s\n", __func__);
1811
1812         if (dev->poll_mod_count) {
1813                 nfc_err(dev->dev,
1814                         "Cannot bring the DEP link up while polling\n");
1815                 return -EBUSY;
1816         }
1817
1818         if (dev->tgt_active_prot) {
1819                 nfc_err(dev->dev,
1820                         "There is already an active target\n");
1821                 return -EBUSY;
1822         }
1823
1824         skb_len = 3 + gb_len; /* ActPass + BR + Next */
1825         skb_len += PASSIVE_DATA_LEN;
1826
1827         /* NFCID3 */
1828         skb_len += NFC_NFCID3_MAXSIZE;
1829         if (target && !target->nfcid2_len) {
1830                 nfcid3[0] = 0x1;
1831                 nfcid3[1] = 0xfe;
1832                 get_random_bytes(nfcid3 + 2, 6);
1833         }
1834
1835         skb = pn533_alloc_skb(dev, skb_len);
1836         if (!skb)
1837                 return -ENOMEM;
1838
1839         skb_put_u8(skb, !comm_mode);  /* ActPass */
1840         skb_put_u8(skb, 0x02);  /* 424 kbps */
1841
1842         next = skb_put(skb, 1);  /* Next */
1843         *next = 0;
1844
1845         /* Copy passive data */
1846         skb_put_data(skb, passive_data, PASSIVE_DATA_LEN);
1847         *next |= 1;
1848
1849         /* Copy NFCID3 (which is NFCID2 from SENSF_RES) */
1850         if (target && target->nfcid2_len)
1851                 memcpy(skb_put(skb, NFC_NFCID3_MAXSIZE), target->nfcid2,
1852                        target->nfcid2_len);
1853         else
1854                 skb_put_data(skb, nfcid3, NFC_NFCID3_MAXSIZE);
1855         *next |= 2;
1856
1857         if (gb != NULL && gb_len > 0) {
1858                 skb_put_data(skb, gb, gb_len);
1859                 *next |= 4; /* We have some Gi */
1860         } else {
1861                 *next = 0;
1862         }
1863
1864         arg = kmalloc(sizeof(*arg), GFP_KERNEL);
1865         if (!arg) {
1866                 dev_kfree_skb(skb);
1867                 return -ENOMEM;
1868         }
1869
1870         *arg = !comm_mode;
1871
1872         pn533_rf_field(dev->nfc_dev, 0);
1873
1874         rc = pn533_send_cmd_async(dev, PN533_CMD_IN_JUMP_FOR_DEP, skb,
1875                                   pn533_in_dep_link_up_complete, arg);
1876
1877         if (rc < 0) {
1878                 dev_kfree_skb(skb);
1879                 kfree(arg);
1880         }
1881
1882         return rc;
1883 }
1884
1885 static int pn533_dep_link_down(struct nfc_dev *nfc_dev)
1886 {
1887         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
1888
1889         dev_dbg(dev->dev, "%s\n", __func__);
1890
1891         pn533_poll_reset_mod_list(dev);
1892
1893         if (dev->tgt_mode || dev->tgt_active_prot)
1894                 dev->phy_ops->abort_cmd(dev, GFP_KERNEL);
1895
1896         dev->tgt_active_prot = 0;
1897         dev->tgt_mode = 0;
1898
1899         skb_queue_purge(&dev->resp_q);
1900
1901         return 0;
1902 }
1903
1904 struct pn533_data_exchange_arg {
1905         data_exchange_cb_t cb;
1906         void *cb_context;
1907 };
1908
1909 static struct sk_buff *pn533_build_response(struct pn533 *dev)
1910 {
1911         struct sk_buff *skb, *tmp, *t;
1912         unsigned int skb_len = 0, tmp_len = 0;
1913
1914         dev_dbg(dev->dev, "%s\n", __func__);
1915
1916         if (skb_queue_empty(&dev->resp_q))
1917                 return NULL;
1918
1919         if (skb_queue_len(&dev->resp_q) == 1) {
1920                 skb = skb_dequeue(&dev->resp_q);
1921                 goto out;
1922         }
1923
1924         skb_queue_walk_safe(&dev->resp_q, tmp, t)
1925                 skb_len += tmp->len;
1926
1927         dev_dbg(dev->dev, "%s total length %d\n",
1928                 __func__, skb_len);
1929
1930         skb = alloc_skb(skb_len, GFP_KERNEL);
1931         if (skb == NULL)
1932                 goto out;
1933
1934         skb_put(skb, skb_len);
1935
1936         skb_queue_walk_safe(&dev->resp_q, tmp, t) {
1937                 memcpy(skb->data + tmp_len, tmp->data, tmp->len);
1938                 tmp_len += tmp->len;
1939         }
1940
1941 out:
1942         skb_queue_purge(&dev->resp_q);
1943
1944         return skb;
1945 }
1946
1947 static int pn533_data_exchange_complete(struct pn533 *dev, void *_arg,
1948                                         struct sk_buff *resp)
1949 {
1950         struct pn533_data_exchange_arg *arg = _arg;
1951         struct sk_buff *skb;
1952         int rc = 0;
1953         u8 status, ret, mi;
1954
1955         dev_dbg(dev->dev, "%s\n", __func__);
1956
1957         if (IS_ERR(resp)) {
1958                 rc = PTR_ERR(resp);
1959                 goto _error;
1960         }
1961
1962         status = resp->data[0];
1963         ret = status & PN533_CMD_RET_MASK;
1964         mi = status & PN533_CMD_MI_MASK;
1965
1966         skb_pull(resp, sizeof(status));
1967
1968         if (ret != PN533_CMD_RET_SUCCESS) {
1969                 nfc_err(dev->dev,
1970                         "Exchanging data failed (error 0x%x)\n", ret);
1971                 rc = -EIO;
1972                 goto error;
1973         }
1974
1975         skb_queue_tail(&dev->resp_q, resp);
1976
1977         if (mi) {
1978                 dev->cmd_complete_mi_arg = arg;
1979                 queue_work(dev->wq, &dev->mi_rx_work);
1980                 return -EINPROGRESS;
1981         }
1982
1983         /* Prepare for the next round */
1984         if (skb_queue_len(&dev->fragment_skb) > 0) {
1985                 dev->cmd_complete_dep_arg = arg;
1986                 queue_work(dev->wq, &dev->mi_tx_work);
1987
1988                 return -EINPROGRESS;
1989         }
1990
1991         skb = pn533_build_response(dev);
1992         if (!skb) {
1993                 rc = -ENOMEM;
1994                 goto error;
1995         }
1996
1997         arg->cb(arg->cb_context, skb, 0);
1998         kfree(arg);
1999         return 0;
2000
2001 error:
2002         dev_kfree_skb(resp);
2003 _error:
2004         skb_queue_purge(&dev->resp_q);
2005         arg->cb(arg->cb_context, NULL, rc);
2006         kfree(arg);
2007         return rc;
2008 }
2009
2010 /*
2011  * Receive an incoming pn533 frame. skb contains only header and payload.
2012  * If skb == NULL, it is a notification that the link below is dead.
2013  */
2014 void pn533_recv_frame(struct pn533 *dev, struct sk_buff *skb, int status)
2015 {
2016         if (!dev->cmd)
2017                 goto sched_wq;
2018
2019         dev->cmd->status = status;
2020
2021         if (status != 0) {
2022                 dev_dbg(dev->dev, "%s: Error received: %d\n", __func__, status);
2023                 goto sched_wq;
2024         }
2025
2026         if (skb == NULL) {
2027                 pr_err("NULL Frame -> link is dead\n");
2028                 goto sched_wq;
2029         }
2030
2031         if (pn533_rx_frame_is_ack(skb->data)) {
2032                 dev_dbg(dev->dev, "%s: Received ACK frame\n", __func__);
2033                 dev_kfree_skb(skb);
2034                 return;
2035         }
2036
2037         print_hex_dump_debug("PN533 RX: ", DUMP_PREFIX_NONE, 16, 1, skb->data,
2038                              dev->ops->rx_frame_size(skb->data), false);
2039
2040         if (!dev->ops->rx_is_frame_valid(skb->data, dev)) {
2041                 nfc_err(dev->dev, "Received an invalid frame\n");
2042                 dev->cmd->status = -EIO;
2043         } else if (!pn533_rx_frame_is_cmd_response(dev, skb->data)) {
2044                 nfc_err(dev->dev, "It it not the response to the last command\n");
2045                 dev->cmd->status = -EIO;
2046         }
2047
2048         dev->cmd->resp = skb;
2049
2050 sched_wq:
2051         queue_work(dev->wq, &dev->cmd_complete_work);
2052 }
2053 EXPORT_SYMBOL(pn533_recv_frame);
2054
2055 /* Split the Tx skb into small chunks */
2056 static int pn533_fill_fragment_skbs(struct pn533 *dev, struct sk_buff *skb)
2057 {
2058         struct sk_buff *frag;
2059         int  frag_size;
2060
2061         do {
2062                 /* Remaining size */
2063                 if (skb->len > PN533_CMD_DATAFRAME_MAXLEN)
2064                         frag_size = PN533_CMD_DATAFRAME_MAXLEN;
2065                 else
2066                         frag_size = skb->len;
2067
2068                 /* Allocate and reserve */
2069                 frag = pn533_alloc_skb(dev, frag_size);
2070                 if (!frag) {
2071                         skb_queue_purge(&dev->fragment_skb);
2072                         break;
2073                 }
2074
2075                 if (!dev->tgt_mode) {
2076                         /* Reserve the TG/MI byte */
2077                         skb_reserve(frag, 1);
2078
2079                         /* MI + TG */
2080                         if (frag_size  == PN533_CMD_DATAFRAME_MAXLEN)
2081                                 *(u8 *)skb_push(frag, sizeof(u8)) =
2082                                                 (PN533_CMD_MI_MASK | 1);
2083                         else
2084                                 *(u8 *)skb_push(frag, sizeof(u8)) =  1; /* TG */
2085                 }
2086
2087                 skb_put_data(frag, skb->data, frag_size);
2088
2089                 /* Reduce the size of incoming buffer */
2090                 skb_pull(skb, frag_size);
2091
2092                 /* Add this to skb_queue */
2093                 skb_queue_tail(&dev->fragment_skb, frag);
2094
2095         } while (skb->len > 0);
2096
2097         dev_kfree_skb(skb);
2098
2099         return skb_queue_len(&dev->fragment_skb);
2100 }
2101
2102 static int pn533_transceive(struct nfc_dev *nfc_dev,
2103                             struct nfc_target *target, struct sk_buff *skb,
2104                             data_exchange_cb_t cb, void *cb_context)
2105 {
2106         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2107         struct pn533_data_exchange_arg *arg = NULL;
2108         int rc;
2109
2110         dev_dbg(dev->dev, "%s\n", __func__);
2111
2112         if (!dev->tgt_active_prot) {
2113                 nfc_err(dev->dev,
2114                         "Can't exchange data if there is no active target\n");
2115                 rc = -EINVAL;
2116                 goto error;
2117         }
2118
2119         arg = kmalloc(sizeof(*arg), GFP_KERNEL);
2120         if (!arg) {
2121                 rc = -ENOMEM;
2122                 goto error;
2123         }
2124
2125         arg->cb = cb;
2126         arg->cb_context = cb_context;
2127
2128         switch (dev->device_type) {
2129         case PN533_DEVICE_PASORI:
2130                 if (dev->tgt_active_prot == NFC_PROTO_FELICA) {
2131                         rc = pn533_send_data_async(dev, PN533_CMD_IN_COMM_THRU,
2132                                                    skb,
2133                                                    pn533_data_exchange_complete,
2134                                                    arg);
2135
2136                         break;
2137                 }
2138                 /* fall through */
2139         default:
2140                 /* jumbo frame ? */
2141                 if (skb->len > PN533_CMD_DATAEXCH_DATA_MAXLEN) {
2142                         rc = pn533_fill_fragment_skbs(dev, skb);
2143                         if (rc <= 0)
2144                                 goto error;
2145
2146                         skb = skb_dequeue(&dev->fragment_skb);
2147                         if (!skb) {
2148                                 rc = -EIO;
2149                                 goto error;
2150                         }
2151                 } else {
2152                         *(u8 *)skb_push(skb, sizeof(u8)) =  1; /* TG */
2153                 }
2154
2155                 rc = pn533_send_data_async(dev, PN533_CMD_IN_DATA_EXCHANGE,
2156                                            skb, pn533_data_exchange_complete,
2157                                            arg);
2158
2159                 break;
2160         }
2161
2162         if (rc < 0) /* rc from send_async */
2163                 goto error;
2164
2165         return 0;
2166
2167 error:
2168         kfree(arg);
2169         dev_kfree_skb(skb);
2170         return rc;
2171 }
2172
2173 static int pn533_tm_send_complete(struct pn533 *dev, void *arg,
2174                                   struct sk_buff *resp)
2175 {
2176         u8 status;
2177
2178         dev_dbg(dev->dev, "%s\n", __func__);
2179
2180         if (IS_ERR(resp))
2181                 return PTR_ERR(resp);
2182
2183         status = resp->data[0];
2184
2185         /* Prepare for the next round */
2186         if (skb_queue_len(&dev->fragment_skb) > 0) {
2187                 queue_work(dev->wq, &dev->mi_tm_tx_work);
2188                 return -EINPROGRESS;
2189         }
2190         dev_kfree_skb(resp);
2191
2192         if (status != 0) {
2193                 nfc_tm_deactivated(dev->nfc_dev);
2194
2195                 dev->tgt_mode = 0;
2196
2197                 return 0;
2198         }
2199
2200         queue_work(dev->wq, &dev->tg_work);
2201
2202         return 0;
2203 }
2204
2205 static int pn533_tm_send(struct nfc_dev *nfc_dev, struct sk_buff *skb)
2206 {
2207         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2208         int rc;
2209
2210         dev_dbg(dev->dev, "%s\n", __func__);
2211
2212         /* let's split in multiple chunks if size's too big */
2213         if (skb->len > PN533_CMD_DATAEXCH_DATA_MAXLEN) {
2214                 rc = pn533_fill_fragment_skbs(dev, skb);
2215                 if (rc <= 0)
2216                         goto error;
2217
2218                 /* get the first skb */
2219                 skb = skb_dequeue(&dev->fragment_skb);
2220                 if (!skb) {
2221                         rc = -EIO;
2222                         goto error;
2223                 }
2224
2225                 rc = pn533_send_data_async(dev, PN533_CMD_TG_SET_META_DATA, skb,
2226                                                 pn533_tm_send_complete, NULL);
2227         } else {
2228                 /* Send th skb */
2229                 rc = pn533_send_data_async(dev, PN533_CMD_TG_SET_DATA, skb,
2230                                                 pn533_tm_send_complete, NULL);
2231         }
2232
2233 error:
2234         if (rc < 0) {
2235                 dev_kfree_skb(skb);
2236                 skb_queue_purge(&dev->fragment_skb);
2237         }
2238
2239         return rc;
2240 }
2241
2242 static void pn533_wq_mi_recv(struct work_struct *work)
2243 {
2244         struct pn533 *dev = container_of(work, struct pn533, mi_rx_work);
2245         struct sk_buff *skb;
2246         int rc;
2247
2248         dev_dbg(dev->dev, "%s\n", __func__);
2249
2250         skb = pn533_alloc_skb(dev, PN533_CMD_DATAEXCH_HEAD_LEN);
2251         if (!skb)
2252                 goto error;
2253
2254         switch (dev->device_type) {
2255         case PN533_DEVICE_PASORI:
2256                 if (dev->tgt_active_prot == NFC_PROTO_FELICA) {
2257                         rc = pn533_send_cmd_direct_async(dev,
2258                                                 PN533_CMD_IN_COMM_THRU,
2259                                                 skb,
2260                                                 pn533_data_exchange_complete,
2261                                                  dev->cmd_complete_mi_arg);
2262
2263                         break;
2264                 }
2265                 /* fall through */
2266         default:
2267                 skb_put_u8(skb, 1); /*TG*/
2268
2269                 rc = pn533_send_cmd_direct_async(dev,
2270                                                  PN533_CMD_IN_DATA_EXCHANGE,
2271                                                  skb,
2272                                                  pn533_data_exchange_complete,
2273                                                  dev->cmd_complete_mi_arg);
2274
2275                 break;
2276         }
2277
2278         if (rc == 0) /* success */
2279                 return;
2280
2281         nfc_err(dev->dev,
2282                 "Error %d when trying to perform data_exchange\n", rc);
2283
2284         dev_kfree_skb(skb);
2285         kfree(dev->cmd_complete_mi_arg);
2286
2287 error:
2288         dev->phy_ops->send_ack(dev, GFP_KERNEL);
2289         queue_work(dev->wq, &dev->cmd_work);
2290 }
2291
2292 static void pn533_wq_mi_send(struct work_struct *work)
2293 {
2294         struct pn533 *dev = container_of(work, struct pn533, mi_tx_work);
2295         struct sk_buff *skb;
2296         int rc;
2297
2298         dev_dbg(dev->dev, "%s\n", __func__);
2299
2300         /* Grab the first skb in the queue */
2301         skb = skb_dequeue(&dev->fragment_skb);
2302
2303         if (skb == NULL) {      /* No more data */
2304                 /* Reset the queue for future use */
2305                 skb_queue_head_init(&dev->fragment_skb);
2306                 goto error;
2307         }
2308
2309         switch (dev->device_type) {
2310         case PN533_DEVICE_PASORI:
2311                 if (dev->tgt_active_prot != NFC_PROTO_FELICA) {
2312                         rc = -EIO;
2313                         break;
2314                 }
2315
2316                 rc = pn533_send_cmd_direct_async(dev, PN533_CMD_IN_COMM_THRU,
2317                                                  skb,
2318                                                  pn533_data_exchange_complete,
2319                                                  dev->cmd_complete_dep_arg);
2320
2321                 break;
2322
2323         default:
2324                 /* Still some fragments? */
2325                 rc = pn533_send_cmd_direct_async(dev,
2326                                                  PN533_CMD_IN_DATA_EXCHANGE,
2327                                                  skb,
2328                                                  pn533_data_exchange_complete,
2329                                                  dev->cmd_complete_dep_arg);
2330
2331                 break;
2332         }
2333
2334         if (rc == 0) /* success */
2335                 return;
2336
2337         nfc_err(dev->dev,
2338                 "Error %d when trying to perform data_exchange\n", rc);
2339
2340         dev_kfree_skb(skb);
2341         kfree(dev->cmd_complete_dep_arg);
2342
2343 error:
2344         dev->phy_ops->send_ack(dev, GFP_KERNEL);
2345         queue_work(dev->wq, &dev->cmd_work);
2346 }
2347
2348 static int pn533_set_configuration(struct pn533 *dev, u8 cfgitem, u8 *cfgdata,
2349                                                                 u8 cfgdata_len)
2350 {
2351         struct sk_buff *skb;
2352         struct sk_buff *resp;
2353         int skb_len;
2354
2355         dev_dbg(dev->dev, "%s\n", __func__);
2356
2357         skb_len = sizeof(cfgitem) + cfgdata_len; /* cfgitem + cfgdata */
2358
2359         skb = pn533_alloc_skb(dev, skb_len);
2360         if (!skb)
2361                 return -ENOMEM;
2362
2363         skb_put_u8(skb, cfgitem);
2364         skb_put_data(skb, cfgdata, cfgdata_len);
2365
2366         resp = pn533_send_cmd_sync(dev, PN533_CMD_RF_CONFIGURATION, skb);
2367         if (IS_ERR(resp))
2368                 return PTR_ERR(resp);
2369
2370         dev_kfree_skb(resp);
2371         return 0;
2372 }
2373
2374 static int pn533_get_firmware_version(struct pn533 *dev,
2375                                       struct pn533_fw_version *fv)
2376 {
2377         struct sk_buff *skb;
2378         struct sk_buff *resp;
2379
2380         skb = pn533_alloc_skb(dev, 0);
2381         if (!skb)
2382                 return -ENOMEM;
2383
2384         resp = pn533_send_cmd_sync(dev, PN533_CMD_GET_FIRMWARE_VERSION, skb);
2385         if (IS_ERR(resp))
2386                 return PTR_ERR(resp);
2387
2388         fv->ic = resp->data[0];
2389         fv->ver = resp->data[1];
2390         fv->rev = resp->data[2];
2391         fv->support = resp->data[3];
2392
2393         dev_kfree_skb(resp);
2394         return 0;
2395 }
2396
2397 static int pn533_pasori_fw_reset(struct pn533 *dev)
2398 {
2399         struct sk_buff *skb;
2400         struct sk_buff *resp;
2401
2402         dev_dbg(dev->dev, "%s\n", __func__);
2403
2404         skb = pn533_alloc_skb(dev, sizeof(u8));
2405         if (!skb)
2406                 return -ENOMEM;
2407
2408         skb_put_u8(skb, 0x1);
2409
2410         resp = pn533_send_cmd_sync(dev, 0x18, skb);
2411         if (IS_ERR(resp))
2412                 return PTR_ERR(resp);
2413
2414         dev_kfree_skb(resp);
2415
2416         return 0;
2417 }
2418
2419 static int pn533_rf_field(struct nfc_dev *nfc_dev, u8 rf)
2420 {
2421         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2422         u8 rf_field = !!rf;
2423         int rc;
2424
2425         rf_field |= PN533_CFGITEM_RF_FIELD_AUTO_RFCA;
2426
2427         rc = pn533_set_configuration(dev, PN533_CFGITEM_RF_FIELD,
2428                                      (u8 *)&rf_field, 1);
2429         if (rc) {
2430                 nfc_err(dev->dev, "Error on setting RF field\n");
2431                 return rc;
2432         }
2433
2434         return rc;
2435 }
2436
2437 static int pn532_sam_configuration(struct nfc_dev *nfc_dev)
2438 {
2439         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2440         struct sk_buff *skb;
2441         struct sk_buff *resp;
2442
2443         skb = pn533_alloc_skb(dev, 1);
2444         if (!skb)
2445                 return -ENOMEM;
2446
2447         skb_put_u8(skb, 0x01);
2448
2449         resp = pn533_send_cmd_sync(dev, PN533_CMD_SAM_CONFIGURATION, skb);
2450         if (IS_ERR(resp))
2451                 return PTR_ERR(resp);
2452
2453         dev_kfree_skb(resp);
2454         return 0;
2455 }
2456
2457 static int pn533_dev_up(struct nfc_dev *nfc_dev)
2458 {
2459         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2460
2461         if (dev->device_type == PN533_DEVICE_PN532) {
2462                 int rc = pn532_sam_configuration(nfc_dev);
2463
2464                 if (rc)
2465                         return rc;
2466         }
2467
2468         return pn533_rf_field(nfc_dev, 1);
2469 }
2470
2471 static int pn533_dev_down(struct nfc_dev *nfc_dev)
2472 {
2473         return pn533_rf_field(nfc_dev, 0);
2474 }
2475
2476 static struct nfc_ops pn533_nfc_ops = {
2477         .dev_up = pn533_dev_up,
2478         .dev_down = pn533_dev_down,
2479         .dep_link_up = pn533_dep_link_up,
2480         .dep_link_down = pn533_dep_link_down,
2481         .start_poll = pn533_start_poll,
2482         .stop_poll = pn533_stop_poll,
2483         .activate_target = pn533_activate_target,
2484         .deactivate_target = pn533_deactivate_target,
2485         .im_transceive = pn533_transceive,
2486         .tm_send = pn533_tm_send,
2487 };
2488
2489 static int pn533_setup(struct pn533 *dev)
2490 {
2491         struct pn533_config_max_retries max_retries;
2492         struct pn533_config_timing timing;
2493         u8 pasori_cfg[3] = {0x08, 0x01, 0x08};
2494         int rc;
2495
2496         switch (dev->device_type) {
2497         case PN533_DEVICE_STD:
2498         case PN533_DEVICE_PASORI:
2499         case PN533_DEVICE_ACR122U:
2500         case PN533_DEVICE_PN532:
2501                 max_retries.mx_rty_atr = 0x2;
2502                 max_retries.mx_rty_psl = 0x1;
2503                 max_retries.mx_rty_passive_act =
2504                         PN533_CONFIG_MAX_RETRIES_NO_RETRY;
2505
2506                 timing.rfu = PN533_CONFIG_TIMING_102;
2507                 timing.atr_res_timeout = PN533_CONFIG_TIMING_102;
2508                 timing.dep_timeout = PN533_CONFIG_TIMING_204;
2509
2510                 break;
2511
2512         default:
2513                 nfc_err(dev->dev, "Unknown device type %d\n",
2514                         dev->device_type);
2515                 return -EINVAL;
2516         }
2517
2518         rc = pn533_set_configuration(dev, PN533_CFGITEM_MAX_RETRIES,
2519                                      (u8 *)&max_retries, sizeof(max_retries));
2520         if (rc) {
2521                 nfc_err(dev->dev,
2522                         "Error on setting MAX_RETRIES config\n");
2523                 return rc;
2524         }
2525
2526
2527         rc = pn533_set_configuration(dev, PN533_CFGITEM_TIMING,
2528                                      (u8 *)&timing, sizeof(timing));
2529         if (rc) {
2530                 nfc_err(dev->dev, "Error on setting RF timings\n");
2531                 return rc;
2532         }
2533
2534         switch (dev->device_type) {
2535         case PN533_DEVICE_STD:
2536         case PN533_DEVICE_PN532:
2537                 break;
2538
2539         case PN533_DEVICE_PASORI:
2540                 pn533_pasori_fw_reset(dev);
2541
2542                 rc = pn533_set_configuration(dev, PN533_CFGITEM_PASORI,
2543                                              pasori_cfg, 3);
2544                 if (rc) {
2545                         nfc_err(dev->dev,
2546                                 "Error while settings PASORI config\n");
2547                         return rc;
2548                 }
2549
2550                 pn533_pasori_fw_reset(dev);
2551
2552                 break;
2553         }
2554
2555         return 0;
2556 }
2557
2558 int pn533_finalize_setup(struct pn533 *dev)
2559 {
2560
2561         struct pn533_fw_version fw_ver;
2562         int rc;
2563
2564         memset(&fw_ver, 0, sizeof(fw_ver));
2565
2566         rc = pn533_get_firmware_version(dev, &fw_ver);
2567         if (rc) {
2568                 nfc_err(dev->dev, "Unable to get FW version\n");
2569                 return rc;
2570         }
2571
2572         nfc_info(dev->dev, "NXP PN5%02X firmware ver %d.%d now attached\n",
2573                 fw_ver.ic, fw_ver.ver, fw_ver.rev);
2574
2575         rc = pn533_setup(dev);
2576         if (rc)
2577                 return rc;
2578
2579         return 0;
2580 }
2581 EXPORT_SYMBOL_GPL(pn533_finalize_setup);
2582
2583 struct pn533 *pn533_register_device(u32 device_type,
2584                                 u32 protocols,
2585                                 enum pn533_protocol_type protocol_type,
2586                                 void *phy,
2587                                 struct pn533_phy_ops *phy_ops,
2588                                 struct pn533_frame_ops *fops,
2589                                 struct device *dev,
2590                                 struct device *parent)
2591 {
2592         struct pn533 *priv;
2593         int rc = -ENOMEM;
2594
2595         priv = kzalloc(sizeof(*priv), GFP_KERNEL);
2596         if (!priv)
2597                 return ERR_PTR(-ENOMEM);
2598
2599         priv->phy = phy;
2600         priv->phy_ops = phy_ops;
2601         priv->dev = dev;
2602         if (fops != NULL)
2603                 priv->ops = fops;
2604         else
2605                 priv->ops = &pn533_std_frame_ops;
2606
2607         priv->protocol_type = protocol_type;
2608         priv->device_type = device_type;
2609
2610         mutex_init(&priv->cmd_lock);
2611
2612         INIT_WORK(&priv->cmd_work, pn533_wq_cmd);
2613         INIT_WORK(&priv->cmd_complete_work, pn533_wq_cmd_complete);
2614         INIT_WORK(&priv->mi_rx_work, pn533_wq_mi_recv);
2615         INIT_WORK(&priv->mi_tx_work, pn533_wq_mi_send);
2616         INIT_WORK(&priv->tg_work, pn533_wq_tg_get_data);
2617         INIT_WORK(&priv->mi_tm_rx_work, pn533_wq_tm_mi_recv);
2618         INIT_WORK(&priv->mi_tm_tx_work, pn533_wq_tm_mi_send);
2619         INIT_DELAYED_WORK(&priv->poll_work, pn533_wq_poll);
2620         INIT_WORK(&priv->rf_work, pn533_wq_rf);
2621         priv->wq = alloc_ordered_workqueue("pn533", 0);
2622         if (priv->wq == NULL)
2623                 goto error;
2624
2625         timer_setup(&priv->listen_timer, pn533_listen_mode_timer, 0);
2626
2627         skb_queue_head_init(&priv->resp_q);
2628         skb_queue_head_init(&priv->fragment_skb);
2629
2630         INIT_LIST_HEAD(&priv->cmd_queue);
2631
2632         priv->nfc_dev = nfc_allocate_device(&pn533_nfc_ops, protocols,
2633                                            priv->ops->tx_header_len +
2634                                            PN533_CMD_DATAEXCH_HEAD_LEN,
2635                                            priv->ops->tx_tail_len);
2636         if (!priv->nfc_dev) {
2637                 rc = -ENOMEM;
2638                 goto destroy_wq;
2639         }
2640
2641         nfc_set_parent_dev(priv->nfc_dev, parent);
2642         nfc_set_drvdata(priv->nfc_dev, priv);
2643
2644         rc = nfc_register_device(priv->nfc_dev);
2645         if (rc)
2646                 goto free_nfc_dev;
2647
2648         return priv;
2649
2650 free_nfc_dev:
2651         nfc_free_device(priv->nfc_dev);
2652
2653 destroy_wq:
2654         destroy_workqueue(priv->wq);
2655 error:
2656         kfree(priv);
2657         return ERR_PTR(rc);
2658 }
2659 EXPORT_SYMBOL_GPL(pn533_register_device);
2660
2661 void pn533_unregister_device(struct pn533 *priv)
2662 {
2663         struct pn533_cmd *cmd, *n;
2664
2665         nfc_unregister_device(priv->nfc_dev);
2666         nfc_free_device(priv->nfc_dev);
2667
2668         flush_delayed_work(&priv->poll_work);
2669         destroy_workqueue(priv->wq);
2670
2671         skb_queue_purge(&priv->resp_q);
2672
2673         del_timer(&priv->listen_timer);
2674
2675         list_for_each_entry_safe(cmd, n, &priv->cmd_queue, queue) {
2676                 list_del(&cmd->queue);
2677                 kfree(cmd);
2678         }
2679
2680         kfree(priv);
2681 }
2682 EXPORT_SYMBOL_GPL(pn533_unregister_device);
2683
2684
2685 MODULE_AUTHOR("Lauro Ramos Venancio <[email protected]>");
2686 MODULE_AUTHOR("Aloisio Almeida Jr <[email protected]>");
2687 MODULE_AUTHOR("Waldemar Rymarkiewicz <[email protected]>");
2688 MODULE_DESCRIPTION("PN533 driver ver " VERSION);
2689 MODULE_VERSION(VERSION);
2690 MODULE_LICENSE("GPL");