1 /*
2 * Copyright (C) 2011 Instituto Nokia de Tecnologia
3 * Copyright (C) 2012-2013 Tieto Poland
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License as published by
7 * the Free Software Foundation; either version 2 of the License, or
8 * (at your option) any later version.
9 *
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
14 *
15 * You should have received a copy of the GNU General Public License
16 * along with this program; if not, see <http://www.gnu.org/licenses/>.
17 */
18
19 #include <linux/device.h>
20 #include <linux/kernel.h>
21 #include <linux/module.h>
22 #include <linux/slab.h>
23 #include <linux/usb.h>
24 #include <linux/nfc.h>
25 #include <linux/netdevice.h>
26 #include <net/nfc/nfc.h>
27
28 #define VERSION "0.2"
29
30 #define PN533_VENDOR_ID 0x4CC
31 #define PN533_PRODUCT_ID 0x2533
32
33 #define SCM_VENDOR_ID 0x4E6
34 #define SCL3711_PRODUCT_ID 0x5591
35
36 #define SONY_VENDOR_ID 0x054c
37 #define PASORI_PRODUCT_ID 0x02e1
38
39 #define ACS_VENDOR_ID 0x072f
40 #define ACR122U_PRODUCT_ID 0x2200
41
42 #define PN533_DEVICE_STD 0x1
43 #define PN533_DEVICE_PASORI 0x2
44 #define PN533_DEVICE_ACR122U 0x3
45
46 #define PN533_ALL_PROTOCOLS (NFC_PROTO_JEWEL_MASK | NFC_PROTO_MIFARE_MASK |\
47 NFC_PROTO_FELICA_MASK | NFC_PROTO_ISO14443_MASK |\
48 NFC_PROTO_NFC_DEP_MASK |\
49 NFC_PROTO_ISO14443_B_MASK)
50
51 #define PN533_NO_TYPE_B_PROTOCOLS (NFC_PROTO_JEWEL_MASK | \
52 NFC_PROTO_MIFARE_MASK | \
53 NFC_PROTO_FELICA_MASK | \
54 NFC_PROTO_ISO14443_MASK | \
55 NFC_PROTO_NFC_DEP_MASK)
56
57 static const struct usb_device_id pn533_table[] = {
58 { USB_DEVICE(PN533_VENDOR_ID, PN533_PRODUCT_ID),
59 .driver_info = PN533_DEVICE_STD },
60 { USB_DEVICE(SCM_VENDOR_ID, SCL3711_PRODUCT_ID),
61 .driver_info = PN533_DEVICE_STD },
62 { USB_DEVICE(SONY_VENDOR_ID, PASORI_PRODUCT_ID),
63 .driver_info = PN533_DEVICE_PASORI },
64 { USB_DEVICE(ACS_VENDOR_ID, ACR122U_PRODUCT_ID),
65 .driver_info = PN533_DEVICE_ACR122U },
66 { }
67 };
68 MODULE_DEVICE_TABLE(usb, pn533_table);
69
70 /* How much time we spend listening for initiators */
71 #define PN533_LISTEN_TIME 2
72 /* Delay between each poll frame (ms) */
73 #define PN533_POLL_INTERVAL 10
74
75 /* Standard pn533 frame definitions (standard and extended)*/
76 #define PN533_STD_FRAME_HEADER_LEN (sizeof(struct pn533_std_frame) \
77 + 2) /* data[0] TFI, data[1] CC */
78 #define PN533_STD_FRAME_TAIL_LEN 2 /* data[len] DCS, data[len + 1] postamble*/
79
80 #define PN533_EXT_FRAME_HEADER_LEN (sizeof(struct pn533_ext_frame) \
81 + 2) /* data[0] TFI, data[1] CC */
82
83 #define PN533_CMD_DATAEXCH_DATA_MAXLEN 262
84 #define PN533_CMD_DATAFRAME_MAXLEN 240 /* max data length (send) */
85
86 /*
87 * Max extended frame payload len, excluding TFI and CC
88 * which are already in PN533_FRAME_HEADER_LEN.
89 */
90 #define PN533_STD_FRAME_MAX_PAYLOAD_LEN 263
91
92 #define PN533_STD_FRAME_ACK_SIZE 6 /* Preamble (1), SoPC (2), ACK Code (2),
93 Postamble (1) */
94 #define PN533_STD_FRAME_CHECKSUM(f) (f->data[f->datalen])
95 #define PN533_STD_FRAME_POSTAMBLE(f) (f->data[f->datalen + 1])
96 /* Half start code (3), LEN (4) should be 0xffff for extended frame */
97 #define PN533_STD_IS_EXTENDED(hdr) ((hdr)->datalen == 0xFF \
98 && (hdr)->datalen_checksum == 0xFF)
99 #define PN533_EXT_FRAME_CHECKSUM(f) (f->data[be16_to_cpu(f->datalen)])
100
101 /* start of frame */
102 #define PN533_STD_FRAME_SOF 0x00FF
103
104 /* standard frame identifier: in/out/error */
105 #define PN533_STD_FRAME_IDENTIFIER(f) (f->data[0]) /* TFI */
106 #define PN533_STD_FRAME_DIR_OUT 0xD4
107 #define PN533_STD_FRAME_DIR_IN 0xD5
108
109 /* ACS ACR122 pn533 frame definitions */
110 #define PN533_ACR122_TX_FRAME_HEADER_LEN (sizeof(struct pn533_acr122_tx_frame) \
111 + 2)
112 #define PN533_ACR122_TX_FRAME_TAIL_LEN 0
113 #define PN533_ACR122_RX_FRAME_HEADER_LEN (sizeof(struct pn533_acr122_rx_frame) \
114 + 2)
115 #define PN533_ACR122_RX_FRAME_TAIL_LEN 2
116 #define PN533_ACR122_FRAME_MAX_PAYLOAD_LEN PN533_STD_FRAME_MAX_PAYLOAD_LEN
117
118 /* CCID messages types */
119 #define PN533_ACR122_PC_TO_RDR_ICCPOWERON 0x62
120 #define PN533_ACR122_PC_TO_RDR_ESCAPE 0x6B
121
122 #define PN533_ACR122_RDR_TO_PC_ESCAPE 0x83
123
124 /* PN533 Commands */
125 #define PN533_FRAME_CMD(f) (f->data[1])
126
127 #define PN533_CMD_GET_FIRMWARE_VERSION 0x02
128 #define PN533_CMD_RF_CONFIGURATION 0x32
129 #define PN533_CMD_IN_DATA_EXCHANGE 0x40
130 #define PN533_CMD_IN_COMM_THRU 0x42
131 #define PN533_CMD_IN_LIST_PASSIVE_TARGET 0x4A
132 #define PN533_CMD_IN_ATR 0x50
133 #define PN533_CMD_IN_RELEASE 0x52
134 #define PN533_CMD_IN_JUMP_FOR_DEP 0x56
135
136 #define PN533_CMD_TG_INIT_AS_TARGET 0x8c
137 #define PN533_CMD_TG_GET_DATA 0x86
138 #define PN533_CMD_TG_SET_DATA 0x8e
139 #define PN533_CMD_TG_SET_META_DATA 0x94
140 #define PN533_CMD_UNDEF 0xff
141
142 #define PN533_CMD_RESPONSE(cmd) (cmd + 1)
143
144 /* PN533 Return codes */
145 #define PN533_CMD_RET_MASK 0x3F
146 #define PN533_CMD_MI_MASK 0x40
147 #define PN533_CMD_RET_SUCCESS 0x00
148
149 struct pn533;
150
151 typedef int (*pn533_send_async_complete_t) (struct pn533 *dev, void *arg,
152 struct sk_buff *resp);
153
154 /* structs for pn533 commands */
155
156 /* PN533_CMD_GET_FIRMWARE_VERSION */
157 struct pn533_fw_version {
158 u8 ic;
159 u8 ver;
160 u8 rev;
161 u8 support;
162 };
163
164 /* PN533_CMD_RF_CONFIGURATION */
165 #define PN533_CFGITEM_RF_FIELD 0x01
166 #define PN533_CFGITEM_TIMING 0x02
167 #define PN533_CFGITEM_MAX_RETRIES 0x05
168 #define PN533_CFGITEM_PASORI 0x82
169
170 #define PN533_CFGITEM_RF_FIELD_AUTO_RFCA 0x2
171 #define PN533_CFGITEM_RF_FIELD_ON 0x1
172 #define PN533_CFGITEM_RF_FIELD_OFF 0x0
173
174 #define PN533_CONFIG_TIMING_102 0xb
175 #define PN533_CONFIG_TIMING_204 0xc
176 #define PN533_CONFIG_TIMING_409 0xd
177 #define PN533_CONFIG_TIMING_819 0xe
178
179 #define PN533_CONFIG_MAX_RETRIES_NO_RETRY 0x00
180 #define PN533_CONFIG_MAX_RETRIES_ENDLESS 0xFF
181
182 struct pn533_config_max_retries {
183 u8 mx_rty_atr;
184 u8 mx_rty_psl;
185 u8 mx_rty_passive_act;
186 } __packed;
187
188 struct pn533_config_timing {
189 u8 rfu;
190 u8 atr_res_timeout;
191 u8 dep_timeout;
192 } __packed;
193
194 /* PN533_CMD_IN_LIST_PASSIVE_TARGET */
195
196 /* felica commands opcode */
197 #define PN533_FELICA_OPC_SENSF_REQ 0
198 #define PN533_FELICA_OPC_SENSF_RES 1
199 /* felica SENSF_REQ parameters */
200 #define PN533_FELICA_SENSF_SC_ALL 0xFFFF
201 #define PN533_FELICA_SENSF_RC_NO_SYSTEM_CODE 0
202 #define PN533_FELICA_SENSF_RC_SYSTEM_CODE 1
203 #define PN533_FELICA_SENSF_RC_ADVANCED_PROTOCOL 2
204
205 /* type B initiator_data values */
206 #define PN533_TYPE_B_AFI_ALL_FAMILIES 0
207 #define PN533_TYPE_B_POLL_METHOD_TIMESLOT 0
208 #define PN533_TYPE_B_POLL_METHOD_PROBABILISTIC 1
209
210 union pn533_cmd_poll_initdata {
211 struct {
212 u8 afi;
213 u8 polling_method;
214 } __packed type_b;
215 struct {
216 u8 opcode;
217 __be16 sc;
218 u8 rc;
219 u8 tsn;
220 } __packed felica;
221 };
222
223 /* Poll modulations */
224 enum {
225 PN533_POLL_MOD_106KBPS_A,
226 PN533_POLL_MOD_212KBPS_FELICA,
227 PN533_POLL_MOD_424KBPS_FELICA,
228 PN533_POLL_MOD_106KBPS_JEWEL,
229 PN533_POLL_MOD_847KBPS_B,
230 PN533_LISTEN_MOD,
231
232 __PN533_POLL_MOD_AFTER_LAST,
233 };
234 #define PN533_POLL_MOD_MAX (__PN533_POLL_MOD_AFTER_LAST - 1)
235
236 struct pn533_poll_modulations {
237 struct {
238 u8 maxtg;
239 u8 brty;
240 union pn533_cmd_poll_initdata initiator_data;
241 } __packed data;
242 u8 len;
243 };
244
245 static const struct pn533_poll_modulations poll_mod[] = {
246 [PN533_POLL_MOD_106KBPS_A] = {
247 .data = {
248 .maxtg = 1,
249 .brty = 0,
250 },
251 .len = 2,
252 },
253 [PN533_POLL_MOD_212KBPS_FELICA] = {
254 .data = {
255 .maxtg = 1,
256 .brty = 1,
257 .initiator_data.felica = {
258 .opcode = PN533_FELICA_OPC_SENSF_REQ,
259 .sc = PN533_FELICA_SENSF_SC_ALL,
260 .rc = PN533_FELICA_SENSF_RC_SYSTEM_CODE,
261 .tsn = 0x03,
262 },
263 },
264 .len = 7,
265 },
266 [PN533_POLL_MOD_424KBPS_FELICA] = {
267 .data = {
268 .maxtg = 1,
269 .brty = 2,
270 .initiator_data.felica = {
271 .opcode = PN533_FELICA_OPC_SENSF_REQ,
272 .sc = PN533_FELICA_SENSF_SC_ALL,
273 .rc = PN533_FELICA_SENSF_RC_SYSTEM_CODE,
274 .tsn = 0x03,
275 },
276 },
277 .len = 7,
278 },
279 [PN533_POLL_MOD_106KBPS_JEWEL] = {
280 .data = {
281 .maxtg = 1,
282 .brty = 4,
283 },
284 .len = 2,
285 },
286 [PN533_POLL_MOD_847KBPS_B] = {
287 .data = {
288 .maxtg = 1,
289 .brty = 8,
290 .initiator_data.type_b = {
291 .afi = PN533_TYPE_B_AFI_ALL_FAMILIES,
292 .polling_method =
293 PN533_TYPE_B_POLL_METHOD_TIMESLOT,
294 },
295 },
296 .len = 3,
297 },
298 [PN533_LISTEN_MOD] = {
299 .len = 0,
300 },
301 };
302
303 /* PN533_CMD_IN_ATR */
304
305 struct pn533_cmd_activate_response {
306 u8 status;
307 u8 nfcid3t[10];
308 u8 didt;
309 u8 bst;
310 u8 brt;
311 u8 to;
312 u8 ppt;
313 /* optional */
314 u8 gt[];
315 } __packed;
316
317 struct pn533_cmd_jump_dep_response {
318 u8 status;
319 u8 tg;
320 u8 nfcid3t[10];
321 u8 didt;
322 u8 bst;
323 u8 brt;
324 u8 to;
325 u8 ppt;
326 /* optional */
327 u8 gt[];
328 } __packed;
329
330
331 /* PN533_TG_INIT_AS_TARGET */
332 #define PN533_INIT_TARGET_PASSIVE 0x1
333 #define PN533_INIT_TARGET_DEP 0x2
334
335 #define PN533_INIT_TARGET_RESP_FRAME_MASK 0x3
336 #define PN533_INIT_TARGET_RESP_ACTIVE 0x1
337 #define PN533_INIT_TARGET_RESP_DEP 0x4
338
339 enum pn533_protocol_type {
340 PN533_PROTO_REQ_ACK_RESP = 0,
341 PN533_PROTO_REQ_RESP
342 };
343
344 struct pn533 {
345 struct usb_device *udev;
346 struct usb_interface *interface;
347 struct nfc_dev *nfc_dev;
348 u32 device_type;
349 enum pn533_protocol_type protocol_type;
350
351 struct urb *out_urb;
352 struct urb *in_urb;
353
354 struct sk_buff_head resp_q;
355 struct sk_buff_head fragment_skb;
356
357 struct workqueue_struct *wq;
358 struct work_struct cmd_work;
359 struct work_struct cmd_complete_work;
360 struct delayed_work poll_work;
361 struct work_struct mi_rx_work;
362 struct work_struct mi_tx_work;
363 struct work_struct mi_tm_rx_work;
364 struct work_struct mi_tm_tx_work;
365 struct work_struct tg_work;
366 struct work_struct rf_work;
367
368 struct list_head cmd_queue;
369 struct pn533_cmd *cmd;
370 u8 cmd_pending;
371 struct mutex cmd_lock; /* protects cmd queue */
372
373 void *cmd_complete_mi_arg;
374 void *cmd_complete_dep_arg;
375
376 struct pn533_poll_modulations *poll_mod_active[PN533_POLL_MOD_MAX + 1];
377 u8 poll_mod_count;
378 u8 poll_mod_curr;
379 u8 poll_dep;
380 u32 poll_protocols;
381 u32 listen_protocols;
382 struct timer_list listen_timer;
383 int cancel_listen;
384
385 u8 *gb;
386 size_t gb_len;
387
388 u8 tgt_available_prots;
389 u8 tgt_active_prot;
390 u8 tgt_mode;
391
392 struct pn533_frame_ops *ops;
393 };
394
395 struct pn533_cmd {
396 struct list_head queue;
397 u8 code;
398 int status;
399 struct sk_buff *req;
400 struct sk_buff *resp;
401 int resp_len;
402 pn533_send_async_complete_t complete_cb;
403 void *complete_cb_context;
404 };
405
406 struct pn533_std_frame {
407 u8 preamble;
408 __be16 start_frame;
409 u8 datalen;
410 u8 datalen_checksum;
411 u8 data[];
412 } __packed;
413
414 struct pn533_ext_frame { /* Extended Information frame */
415 u8 preamble;
416 __be16 start_frame;
417 __be16 eif_flag; /* fixed to 0xFFFF */
418 __be16 datalen;
419 u8 datalen_checksum;
420 u8 data[];
421 } __packed;
422
423 struct pn533_frame_ops {
424 void (*tx_frame_init)(void *frame, u8 cmd_code);
425 void (*tx_frame_finish)(void *frame);
426 void (*tx_update_payload_len)(void *frame, int len);
427 int tx_header_len;
428 int tx_tail_len;
429
430 bool (*rx_is_frame_valid)(void *frame, struct pn533 *dev);
431 int (*rx_frame_size)(void *frame);
432 int rx_header_len;
433 int rx_tail_len;
434
435 int max_payload_len;
436 u8 (*get_cmd_code)(void *frame);
437 };
438
439 struct pn533_acr122_ccid_hdr {
440 u8 type;
441 u32 datalen;
442 u8 slot;
443 u8 seq;
444 u8 params[3]; /* 3 msg specific bytes or status, error and 1 specific
445 byte for reposnse msg */
446 u8 data[]; /* payload */
447 } __packed;
448
449 struct pn533_acr122_apdu_hdr {
450 u8 class;
451 u8 ins;
452 u8 p1;
453 u8 p2;
454 } __packed;
455
456 struct pn533_acr122_tx_frame {
457 struct pn533_acr122_ccid_hdr ccid;
458 struct pn533_acr122_apdu_hdr apdu;
459 u8 datalen;
460 u8 data[]; /* pn533 frame: TFI ... */
461 } __packed;
462
463 struct pn533_acr122_rx_frame {
464 struct pn533_acr122_ccid_hdr ccid;
465 u8 data[]; /* pn533 frame : TFI ... */
466 } __packed;
467
pn533_acr122_tx_frame_init(void * _frame,u8 cmd_code)468 static void pn533_acr122_tx_frame_init(void *_frame, u8 cmd_code)
469 {
470 struct pn533_acr122_tx_frame *frame = _frame;
471
472 frame->ccid.type = PN533_ACR122_PC_TO_RDR_ESCAPE;
473 frame->ccid.datalen = sizeof(frame->apdu) + 1; /* sizeof(apdu_hdr) +
474 sizeof(datalen) */
475 frame->ccid.slot = 0;
476 frame->ccid.seq = 0;
477 frame->ccid.params[0] = 0;
478 frame->ccid.params[1] = 0;
479 frame->ccid.params[2] = 0;
480
481 frame->data[0] = PN533_STD_FRAME_DIR_OUT;
482 frame->data[1] = cmd_code;
483 frame->datalen = 2; /* data[0] + data[1] */
484
485 frame->apdu.class = 0xFF;
486 frame->apdu.ins = 0;
487 frame->apdu.p1 = 0;
488 frame->apdu.p2 = 0;
489 }
490
pn533_acr122_tx_frame_finish(void * _frame)491 static void pn533_acr122_tx_frame_finish(void *_frame)
492 {
493 struct pn533_acr122_tx_frame *frame = _frame;
494
495 frame->ccid.datalen += frame->datalen;
496 }
497
pn533_acr122_tx_update_payload_len(void * _frame,int len)498 static void pn533_acr122_tx_update_payload_len(void *_frame, int len)
499 {
500 struct pn533_acr122_tx_frame *frame = _frame;
501
502 frame->datalen += len;
503 }
504
pn533_acr122_is_rx_frame_valid(void * _frame,struct pn533 * dev)505 static bool pn533_acr122_is_rx_frame_valid(void *_frame, struct pn533 *dev)
506 {
507 struct pn533_acr122_rx_frame *frame = _frame;
508
509 if (frame->ccid.type != 0x83)
510 return false;
511
512 if (!frame->ccid.datalen)
513 return false;
514
515 if (frame->data[frame->ccid.datalen - 2] == 0x63)
516 return false;
517
518 return true;
519 }
520
pn533_acr122_rx_frame_size(void * frame)521 static int pn533_acr122_rx_frame_size(void *frame)
522 {
523 struct pn533_acr122_rx_frame *f = frame;
524
525 /* f->ccid.datalen already includes tail length */
526 return sizeof(struct pn533_acr122_rx_frame) + f->ccid.datalen;
527 }
528
pn533_acr122_get_cmd_code(void * frame)529 static u8 pn533_acr122_get_cmd_code(void *frame)
530 {
531 struct pn533_acr122_rx_frame *f = frame;
532
533 return PN533_FRAME_CMD(f);
534 }
535
536 static struct pn533_frame_ops pn533_acr122_frame_ops = {
537 .tx_frame_init = pn533_acr122_tx_frame_init,
538 .tx_frame_finish = pn533_acr122_tx_frame_finish,
539 .tx_update_payload_len = pn533_acr122_tx_update_payload_len,
540 .tx_header_len = PN533_ACR122_TX_FRAME_HEADER_LEN,
541 .tx_tail_len = PN533_ACR122_TX_FRAME_TAIL_LEN,
542
543 .rx_is_frame_valid = pn533_acr122_is_rx_frame_valid,
544 .rx_header_len = PN533_ACR122_RX_FRAME_HEADER_LEN,
545 .rx_tail_len = PN533_ACR122_RX_FRAME_TAIL_LEN,
546 .rx_frame_size = pn533_acr122_rx_frame_size,
547
548 .max_payload_len = PN533_ACR122_FRAME_MAX_PAYLOAD_LEN,
549 .get_cmd_code = pn533_acr122_get_cmd_code,
550 };
551
552 /* The rule: value(high byte) + value(low byte) + checksum = 0 */
pn533_ext_checksum(u16 value)553 static inline u8 pn533_ext_checksum(u16 value)
554 {
555 return ~(u8)(((value & 0xFF00) >> 8) + (u8)(value & 0xFF)) + 1;
556 }
557
558 /* The rule: value + checksum = 0 */
pn533_std_checksum(u8 value)559 static inline u8 pn533_std_checksum(u8 value)
560 {
561 return ~value + 1;
562 }
563
564 /* The rule: sum(data elements) + checksum = 0 */
pn533_std_data_checksum(u8 * data,int datalen)565 static u8 pn533_std_data_checksum(u8 *data, int datalen)
566 {
567 u8 sum = 0;
568 int i;
569
570 for (i = 0; i < datalen; i++)
571 sum += data[i];
572
573 return pn533_std_checksum(sum);
574 }
575
pn533_std_tx_frame_init(void * _frame,u8 cmd_code)576 static void pn533_std_tx_frame_init(void *_frame, u8 cmd_code)
577 {
578 struct pn533_std_frame *frame = _frame;
579
580 frame->preamble = 0;
581 frame->start_frame = cpu_to_be16(PN533_STD_FRAME_SOF);
582 PN533_STD_FRAME_IDENTIFIER(frame) = PN533_STD_FRAME_DIR_OUT;
583 PN533_FRAME_CMD(frame) = cmd_code;
584 frame->datalen = 2;
585 }
586
pn533_std_tx_frame_finish(void * _frame)587 static void pn533_std_tx_frame_finish(void *_frame)
588 {
589 struct pn533_std_frame *frame = _frame;
590
591 frame->datalen_checksum = pn533_std_checksum(frame->datalen);
592
593 PN533_STD_FRAME_CHECKSUM(frame) =
594 pn533_std_data_checksum(frame->data, frame->datalen);
595
596 PN533_STD_FRAME_POSTAMBLE(frame) = 0;
597 }
598
pn533_std_tx_update_payload_len(void * _frame,int len)599 static void pn533_std_tx_update_payload_len(void *_frame, int len)
600 {
601 struct pn533_std_frame *frame = _frame;
602
603 frame->datalen += len;
604 }
605
pn533_std_rx_frame_is_valid(void * _frame,struct pn533 * dev)606 static bool pn533_std_rx_frame_is_valid(void *_frame, struct pn533 *dev)
607 {
608 u8 checksum;
609 struct pn533_std_frame *stdf = _frame;
610
611 if (stdf->start_frame != cpu_to_be16(PN533_STD_FRAME_SOF))
612 return false;
613
614 if (likely(!PN533_STD_IS_EXTENDED(stdf))) {
615 /* Standard frame code */
616 dev->ops->rx_header_len = PN533_STD_FRAME_HEADER_LEN;
617
618 checksum = pn533_std_checksum(stdf->datalen);
619 if (checksum != stdf->datalen_checksum)
620 return false;
621
622 checksum = pn533_std_data_checksum(stdf->data, stdf->datalen);
623 if (checksum != PN533_STD_FRAME_CHECKSUM(stdf))
624 return false;
625 } else {
626 /* Extended */
627 struct pn533_ext_frame *eif = _frame;
628
629 dev->ops->rx_header_len = PN533_EXT_FRAME_HEADER_LEN;
630
631 checksum = pn533_ext_checksum(be16_to_cpu(eif->datalen));
632 if (checksum != eif->datalen_checksum)
633 return false;
634
635 /* check data checksum */
636 checksum = pn533_std_data_checksum(eif->data,
637 be16_to_cpu(eif->datalen));
638 if (checksum != PN533_EXT_FRAME_CHECKSUM(eif))
639 return false;
640 }
641
642 return true;
643 }
644
pn533_std_rx_frame_is_ack(struct pn533_std_frame * frame)645 static bool pn533_std_rx_frame_is_ack(struct pn533_std_frame *frame)
646 {
647 if (frame->start_frame != cpu_to_be16(PN533_STD_FRAME_SOF))
648 return false;
649
650 if (frame->datalen != 0 || frame->datalen_checksum != 0xFF)
651 return false;
652
653 return true;
654 }
655
pn533_std_rx_frame_size(void * frame)656 static inline int pn533_std_rx_frame_size(void *frame)
657 {
658 struct pn533_std_frame *f = frame;
659
660 /* check for Extended Information frame */
661 if (PN533_STD_IS_EXTENDED(f)) {
662 struct pn533_ext_frame *eif = frame;
663
664 return sizeof(struct pn533_ext_frame)
665 + be16_to_cpu(eif->datalen) + PN533_STD_FRAME_TAIL_LEN;
666 }
667
668 return sizeof(struct pn533_std_frame) + f->datalen +
669 PN533_STD_FRAME_TAIL_LEN;
670 }
671
pn533_std_get_cmd_code(void * frame)672 static u8 pn533_std_get_cmd_code(void *frame)
673 {
674 struct pn533_std_frame *f = frame;
675 struct pn533_ext_frame *eif = frame;
676
677 if (PN533_STD_IS_EXTENDED(f))
678 return PN533_FRAME_CMD(eif);
679 else
680 return PN533_FRAME_CMD(f);
681 }
682
683 static struct pn533_frame_ops pn533_std_frame_ops = {
684 .tx_frame_init = pn533_std_tx_frame_init,
685 .tx_frame_finish = pn533_std_tx_frame_finish,
686 .tx_update_payload_len = pn533_std_tx_update_payload_len,
687 .tx_header_len = PN533_STD_FRAME_HEADER_LEN,
688 .tx_tail_len = PN533_STD_FRAME_TAIL_LEN,
689
690 .rx_is_frame_valid = pn533_std_rx_frame_is_valid,
691 .rx_frame_size = pn533_std_rx_frame_size,
692 .rx_header_len = PN533_STD_FRAME_HEADER_LEN,
693 .rx_tail_len = PN533_STD_FRAME_TAIL_LEN,
694
695 .max_payload_len = PN533_STD_FRAME_MAX_PAYLOAD_LEN,
696 .get_cmd_code = pn533_std_get_cmd_code,
697 };
698
pn533_rx_frame_is_cmd_response(struct pn533 * dev,void * frame)699 static bool pn533_rx_frame_is_cmd_response(struct pn533 *dev, void *frame)
700 {
701 return (dev->ops->get_cmd_code(frame) ==
702 PN533_CMD_RESPONSE(dev->cmd->code));
703 }
704
pn533_recv_response(struct urb * urb)705 static void pn533_recv_response(struct urb *urb)
706 {
707 struct pn533 *dev = urb->context;
708 struct pn533_cmd *cmd = dev->cmd;
709 u8 *in_frame;
710
711 cmd->status = urb->status;
712
713 switch (urb->status) {
714 case 0:
715 break; /* success */
716 case -ECONNRESET:
717 case -ENOENT:
718 dev_dbg(&dev->interface->dev,
719 "The urb has been canceled (status %d)\n",
720 urb->status);
721 goto sched_wq;
722 case -ESHUTDOWN:
723 default:
724 nfc_err(&dev->interface->dev,
725 "Urb failure (status %d)\n", urb->status);
726 goto sched_wq;
727 }
728
729 in_frame = dev->in_urb->transfer_buffer;
730
731 dev_dbg(&dev->interface->dev, "Received a frame\n");
732 print_hex_dump_debug("PN533 RX: ", DUMP_PREFIX_NONE, 16, 1, in_frame,
733 dev->ops->rx_frame_size(in_frame), false);
734
735 if (!dev->ops->rx_is_frame_valid(in_frame, dev)) {
736 nfc_err(&dev->interface->dev, "Received an invalid frame\n");
737 cmd->status = -EIO;
738 goto sched_wq;
739 }
740
741 if (!pn533_rx_frame_is_cmd_response(dev, in_frame)) {
742 nfc_err(&dev->interface->dev,
743 "It it not the response to the last command\n");
744 cmd->status = -EIO;
745 goto sched_wq;
746 }
747
748 sched_wq:
749 queue_work(dev->wq, &dev->cmd_complete_work);
750 }
751
pn533_submit_urb_for_response(struct pn533 * dev,gfp_t flags)752 static int pn533_submit_urb_for_response(struct pn533 *dev, gfp_t flags)
753 {
754 dev->in_urb->complete = pn533_recv_response;
755
756 return usb_submit_urb(dev->in_urb, flags);
757 }
758
pn533_recv_ack(struct urb * urb)759 static void pn533_recv_ack(struct urb *urb)
760 {
761 struct pn533 *dev = urb->context;
762 struct pn533_cmd *cmd = dev->cmd;
763 struct pn533_std_frame *in_frame;
764 int rc;
765
766 cmd->status = urb->status;
767
768 switch (urb->status) {
769 case 0:
770 break; /* success */
771 case -ECONNRESET:
772 case -ENOENT:
773 dev_dbg(&dev->interface->dev,
774 "The urb has been stopped (status %d)\n",
775 urb->status);
776 goto sched_wq;
777 case -ESHUTDOWN:
778 default:
779 nfc_err(&dev->interface->dev,
780 "Urb failure (status %d)\n", urb->status);
781 goto sched_wq;
782 }
783
784 in_frame = dev->in_urb->transfer_buffer;
785
786 if (!pn533_std_rx_frame_is_ack(in_frame)) {
787 nfc_err(&dev->interface->dev, "Received an invalid ack\n");
788 cmd->status = -EIO;
789 goto sched_wq;
790 }
791
792 rc = pn533_submit_urb_for_response(dev, GFP_ATOMIC);
793 if (rc) {
794 nfc_err(&dev->interface->dev,
795 "usb_submit_urb failed with result %d\n", rc);
796 cmd->status = rc;
797 goto sched_wq;
798 }
799
800 return;
801
802 sched_wq:
803 queue_work(dev->wq, &dev->cmd_complete_work);
804 }
805
pn533_submit_urb_for_ack(struct pn533 * dev,gfp_t flags)806 static int pn533_submit_urb_for_ack(struct pn533 *dev, gfp_t flags)
807 {
808 dev->in_urb->complete = pn533_recv_ack;
809
810 return usb_submit_urb(dev->in_urb, flags);
811 }
812
pn533_send_ack(struct pn533 * dev,gfp_t flags)813 static int pn533_send_ack(struct pn533 *dev, gfp_t flags)
814 {
815 u8 ack[PN533_STD_FRAME_ACK_SIZE] = {0x00, 0x00, 0xff, 0x00, 0xff, 0x00};
816 /* spec 7.1.1.3: Preamble, SoPC (2), ACK Code (2), Postamble */
817 int rc;
818
819 dev->out_urb->transfer_buffer = ack;
820 dev->out_urb->transfer_buffer_length = sizeof(ack);
821 rc = usb_submit_urb(dev->out_urb, flags);
822
823 return rc;
824 }
825
__pn533_send_frame_async(struct pn533 * dev,struct sk_buff * out,struct sk_buff * in,int in_len)826 static int __pn533_send_frame_async(struct pn533 *dev,
827 struct sk_buff *out,
828 struct sk_buff *in,
829 int in_len)
830 {
831 int rc;
832
833 dev->out_urb->transfer_buffer = out->data;
834 dev->out_urb->transfer_buffer_length = out->len;
835
836 dev->in_urb->transfer_buffer = in->data;
837 dev->in_urb->transfer_buffer_length = in_len;
838
839 print_hex_dump_debug("PN533 TX: ", DUMP_PREFIX_NONE, 16, 1,
840 out->data, out->len, false);
841
842 rc = usb_submit_urb(dev->out_urb, GFP_KERNEL);
843 if (rc)
844 return rc;
845
846 if (dev->protocol_type == PN533_PROTO_REQ_RESP) {
847 /* request for response for sent packet directly */
848 rc = pn533_submit_urb_for_response(dev, GFP_ATOMIC);
849 if (rc)
850 goto error;
851 } else if (dev->protocol_type == PN533_PROTO_REQ_ACK_RESP) {
852 /* request for ACK if that's the case */
853 rc = pn533_submit_urb_for_ack(dev, GFP_KERNEL);
854 if (rc)
855 goto error;
856 }
857
858 return 0;
859
860 error:
861 usb_unlink_urb(dev->out_urb);
862 return rc;
863 }
864
pn533_build_cmd_frame(struct pn533 * dev,u8 cmd_code,struct sk_buff * skb)865 static void pn533_build_cmd_frame(struct pn533 *dev, u8 cmd_code,
866 struct sk_buff *skb)
867 {
868 /* payload is already there, just update datalen */
869 int payload_len = skb->len;
870 struct pn533_frame_ops *ops = dev->ops;
871
872
873 skb_push(skb, ops->tx_header_len);
874 skb_put(skb, ops->tx_tail_len);
875
876 ops->tx_frame_init(skb->data, cmd_code);
877 ops->tx_update_payload_len(skb->data, payload_len);
878 ops->tx_frame_finish(skb->data);
879 }
880
pn533_send_async_complete(struct pn533 * dev)881 static int pn533_send_async_complete(struct pn533 *dev)
882 {
883 struct pn533_cmd *cmd = dev->cmd;
884 int status = cmd->status;
885
886 struct sk_buff *req = cmd->req;
887 struct sk_buff *resp = cmd->resp;
888
889 int rc;
890
891 dev_kfree_skb(req);
892
893 if (status < 0) {
894 rc = cmd->complete_cb(dev, cmd->complete_cb_context,
895 ERR_PTR(status));
896 dev_kfree_skb(resp);
897 goto done;
898 }
899
900 skb_put(resp, dev->ops->rx_frame_size(resp->data));
901 skb_pull(resp, dev->ops->rx_header_len);
902 skb_trim(resp, resp->len - dev->ops->rx_tail_len);
903
904 rc = cmd->complete_cb(dev, cmd->complete_cb_context, resp);
905
906 done:
907 kfree(cmd);
908 dev->cmd = NULL;
909 return rc;
910 }
911
__pn533_send_async(struct pn533 * dev,u8 cmd_code,struct sk_buff * req,struct sk_buff * resp,int resp_len,pn533_send_async_complete_t complete_cb,void * complete_cb_context)912 static int __pn533_send_async(struct pn533 *dev, u8 cmd_code,
913 struct sk_buff *req, struct sk_buff *resp,
914 int resp_len,
915 pn533_send_async_complete_t complete_cb,
916 void *complete_cb_context)
917 {
918 struct pn533_cmd *cmd;
919 int rc = 0;
920
921 dev_dbg(&dev->interface->dev, "Sending command 0x%x\n", cmd_code);
922
923 cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
924 if (!cmd)
925 return -ENOMEM;
926
927 cmd->code = cmd_code;
928 cmd->req = req;
929 cmd->resp = resp;
930 cmd->resp_len = resp_len;
931 cmd->complete_cb = complete_cb;
932 cmd->complete_cb_context = complete_cb_context;
933
934 pn533_build_cmd_frame(dev, cmd_code, req);
935
936 mutex_lock(&dev->cmd_lock);
937
938 if (!dev->cmd_pending) {
939 rc = __pn533_send_frame_async(dev, req, resp, resp_len);
940 if (rc)
941 goto error;
942
943 dev->cmd_pending = 1;
944 dev->cmd = cmd;
945 goto unlock;
946 }
947
948 dev_dbg(&dev->interface->dev, "%s Queueing command 0x%x\n",
949 __func__, cmd_code);
950
951 INIT_LIST_HEAD(&cmd->queue);
952 list_add_tail(&cmd->queue, &dev->cmd_queue);
953
954 goto unlock;
955
956 error:
957 kfree(cmd);
958 unlock:
959 mutex_unlock(&dev->cmd_lock);
960 return rc;
961 }
962
pn533_send_data_async(struct pn533 * dev,u8 cmd_code,struct sk_buff * req,pn533_send_async_complete_t complete_cb,void * complete_cb_context)963 static int pn533_send_data_async(struct pn533 *dev, u8 cmd_code,
964 struct sk_buff *req,
965 pn533_send_async_complete_t complete_cb,
966 void *complete_cb_context)
967 {
968 struct sk_buff *resp;
969 int rc;
970 int resp_len = dev->ops->rx_header_len +
971 dev->ops->max_payload_len +
972 dev->ops->rx_tail_len;
973
974 resp = nfc_alloc_recv_skb(resp_len, GFP_KERNEL);
975 if (!resp)
976 return -ENOMEM;
977
978 rc = __pn533_send_async(dev, cmd_code, req, resp, resp_len, complete_cb,
979 complete_cb_context);
980 if (rc)
981 dev_kfree_skb(resp);
982
983 return rc;
984 }
985
pn533_send_cmd_async(struct pn533 * dev,u8 cmd_code,struct sk_buff * req,pn533_send_async_complete_t complete_cb,void * complete_cb_context)986 static int pn533_send_cmd_async(struct pn533 *dev, u8 cmd_code,
987 struct sk_buff *req,
988 pn533_send_async_complete_t complete_cb,
989 void *complete_cb_context)
990 {
991 struct sk_buff *resp;
992 int rc;
993 int resp_len = dev->ops->rx_header_len +
994 dev->ops->max_payload_len +
995 dev->ops->rx_tail_len;
996
997 resp = alloc_skb(resp_len, GFP_KERNEL);
998 if (!resp)
999 return -ENOMEM;
1000
1001 rc = __pn533_send_async(dev, cmd_code, req, resp, resp_len, complete_cb,
1002 complete_cb_context);
1003 if (rc)
1004 dev_kfree_skb(resp);
1005
1006 return rc;
1007 }
1008
1009 /*
1010 * pn533_send_cmd_direct_async
1011 *
1012 * The function sends a piority cmd directly to the chip omiting the cmd
1013 * queue. It's intended to be used by chaining mechanism of received responses
1014 * where the host has to request every single chunk of data before scheduling
1015 * next cmd from the queue.
1016 */
pn533_send_cmd_direct_async(struct pn533 * dev,u8 cmd_code,struct sk_buff * req,pn533_send_async_complete_t complete_cb,void * complete_cb_context)1017 static int pn533_send_cmd_direct_async(struct pn533 *dev, u8 cmd_code,
1018 struct sk_buff *req,
1019 pn533_send_async_complete_t complete_cb,
1020 void *complete_cb_context)
1021 {
1022 struct sk_buff *resp;
1023 struct pn533_cmd *cmd;
1024 int rc;
1025 int resp_len = dev->ops->rx_header_len +
1026 dev->ops->max_payload_len +
1027 dev->ops->rx_tail_len;
1028
1029 resp = alloc_skb(resp_len, GFP_KERNEL);
1030 if (!resp)
1031 return -ENOMEM;
1032
1033 cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
1034 if (!cmd) {
1035 dev_kfree_skb(resp);
1036 return -ENOMEM;
1037 }
1038
1039 cmd->code = cmd_code;
1040 cmd->req = req;
1041 cmd->resp = resp;
1042 cmd->resp_len = resp_len;
1043 cmd->complete_cb = complete_cb;
1044 cmd->complete_cb_context = complete_cb_context;
1045
1046 pn533_build_cmd_frame(dev, cmd_code, req);
1047
1048 rc = __pn533_send_frame_async(dev, req, resp, resp_len);
1049 if (rc < 0) {
1050 dev_kfree_skb(resp);
1051 kfree(cmd);
1052 } else {
1053 dev->cmd = cmd;
1054 }
1055
1056 return rc;
1057 }
1058
pn533_wq_cmd_complete(struct work_struct * work)1059 static void pn533_wq_cmd_complete(struct work_struct *work)
1060 {
1061 struct pn533 *dev = container_of(work, struct pn533, cmd_complete_work);
1062 int rc;
1063
1064 rc = pn533_send_async_complete(dev);
1065 if (rc != -EINPROGRESS)
1066 queue_work(dev->wq, &dev->cmd_work);
1067 }
1068
pn533_wq_cmd(struct work_struct * work)1069 static void pn533_wq_cmd(struct work_struct *work)
1070 {
1071 struct pn533 *dev = container_of(work, struct pn533, cmd_work);
1072 struct pn533_cmd *cmd;
1073 int rc;
1074
1075 mutex_lock(&dev->cmd_lock);
1076
1077 if (list_empty(&dev->cmd_queue)) {
1078 dev->cmd_pending = 0;
1079 mutex_unlock(&dev->cmd_lock);
1080 return;
1081 }
1082
1083 cmd = list_first_entry(&dev->cmd_queue, struct pn533_cmd, queue);
1084
1085 list_del(&cmd->queue);
1086
1087 mutex_unlock(&dev->cmd_lock);
1088
1089 rc = __pn533_send_frame_async(dev, cmd->req, cmd->resp, cmd->resp_len);
1090 if (rc < 0) {
1091 dev_kfree_skb(cmd->req);
1092 dev_kfree_skb(cmd->resp);
1093 kfree(cmd);
1094 return;
1095 }
1096
1097 dev->cmd = cmd;
1098 }
1099
1100 struct pn533_sync_cmd_response {
1101 struct sk_buff *resp;
1102 struct completion done;
1103 };
1104
pn533_send_sync_complete(struct pn533 * dev,void * _arg,struct sk_buff * resp)1105 static int pn533_send_sync_complete(struct pn533 *dev, void *_arg,
1106 struct sk_buff *resp)
1107 {
1108 struct pn533_sync_cmd_response *arg = _arg;
1109
1110 arg->resp = resp;
1111 complete(&arg->done);
1112
1113 return 0;
1114 }
1115
1116 /* pn533_send_cmd_sync
1117 *
1118 * Please note the req parameter is freed inside the function to
1119 * limit a number of return value interpretations by the caller.
1120 *
1121 * 1. negative in case of error during TX path -> req should be freed
1122 *
1123 * 2. negative in case of error during RX path -> req should not be freed
1124 * as it's been already freed at the begining of RX path by
1125 * async_complete_cb.
1126 *
1127 * 3. valid pointer in case of succesfult RX path
1128 *
1129 * A caller has to check a return value with IS_ERR macro. If the test pass,
1130 * the returned pointer is valid.
1131 *
1132 * */
pn533_send_cmd_sync(struct pn533 * dev,u8 cmd_code,struct sk_buff * req)1133 static struct sk_buff *pn533_send_cmd_sync(struct pn533 *dev, u8 cmd_code,
1134 struct sk_buff *req)
1135 {
1136 int rc;
1137 struct pn533_sync_cmd_response arg;
1138
1139 init_completion(&arg.done);
1140
1141 rc = pn533_send_cmd_async(dev, cmd_code, req,
1142 pn533_send_sync_complete, &arg);
1143 if (rc) {
1144 dev_kfree_skb(req);
1145 return ERR_PTR(rc);
1146 }
1147
1148 wait_for_completion(&arg.done);
1149
1150 return arg.resp;
1151 }
1152
pn533_send_complete(struct urb * urb)1153 static void pn533_send_complete(struct urb *urb)
1154 {
1155 struct pn533 *dev = urb->context;
1156
1157 switch (urb->status) {
1158 case 0:
1159 break; /* success */
1160 case -ECONNRESET:
1161 case -ENOENT:
1162 dev_dbg(&dev->interface->dev,
1163 "The urb has been stopped (status %d)\n",
1164 urb->status);
1165 break;
1166 case -ESHUTDOWN:
1167 default:
1168 nfc_err(&dev->interface->dev, "Urb failure (status %d)\n",
1169 urb->status);
1170 }
1171 }
1172
pn533_abort_cmd(struct pn533 * dev,gfp_t flags)1173 static void pn533_abort_cmd(struct pn533 *dev, gfp_t flags)
1174 {
1175 /* ACR122U does not support any command which aborts last
1176 * issued command i.e. as ACK for standard PN533. Additionally,
1177 * it behaves stange, sending broken or incorrect responses,
1178 * when we cancel urb before the chip will send response.
1179 */
1180 if (dev->device_type == PN533_DEVICE_ACR122U)
1181 return;
1182
1183 /* An ack will cancel the last issued command */
1184 pn533_send_ack(dev, flags);
1185
1186 /* cancel the urb request */
1187 usb_kill_urb(dev->in_urb);
1188 }
1189
pn533_alloc_skb(struct pn533 * dev,unsigned int size)1190 static struct sk_buff *pn533_alloc_skb(struct pn533 *dev, unsigned int size)
1191 {
1192 struct sk_buff *skb;
1193
1194 skb = alloc_skb(dev->ops->tx_header_len +
1195 size +
1196 dev->ops->tx_tail_len, GFP_KERNEL);
1197
1198 if (skb)
1199 skb_reserve(skb, dev->ops->tx_header_len);
1200
1201 return skb;
1202 }
1203
1204 struct pn533_target_type_a {
1205 __be16 sens_res;
1206 u8 sel_res;
1207 u8 nfcid_len;
1208 u8 nfcid_data[];
1209 } __packed;
1210
1211
1212 #define PN533_TYPE_A_SENS_RES_NFCID1(x) ((u8)((be16_to_cpu(x) & 0x00C0) >> 6))
1213 #define PN533_TYPE_A_SENS_RES_SSD(x) ((u8)((be16_to_cpu(x) & 0x001F) >> 0))
1214 #define PN533_TYPE_A_SENS_RES_PLATCONF(x) ((u8)((be16_to_cpu(x) & 0x0F00) >> 8))
1215
1216 #define PN533_TYPE_A_SENS_RES_SSD_JEWEL 0x00
1217 #define PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL 0x0C
1218
1219 #define PN533_TYPE_A_SEL_PROT(x) (((x) & 0x60) >> 5)
1220 #define PN533_TYPE_A_SEL_CASCADE(x) (((x) & 0x04) >> 2)
1221
1222 #define PN533_TYPE_A_SEL_PROT_MIFARE 0
1223 #define PN533_TYPE_A_SEL_PROT_ISO14443 1
1224 #define PN533_TYPE_A_SEL_PROT_DEP 2
1225 #define PN533_TYPE_A_SEL_PROT_ISO14443_DEP 3
1226
pn533_target_type_a_is_valid(struct pn533_target_type_a * type_a,int target_data_len)1227 static bool pn533_target_type_a_is_valid(struct pn533_target_type_a *type_a,
1228 int target_data_len)
1229 {
1230 u8 ssd;
1231 u8 platconf;
1232
1233 if (target_data_len < sizeof(struct pn533_target_type_a))
1234 return false;
1235
1236 /* The lenght check of nfcid[] and ats[] are not being performed because
1237 the values are not being used */
1238
1239 /* Requirement 4.6.3.3 from NFC Forum Digital Spec */
1240 ssd = PN533_TYPE_A_SENS_RES_SSD(type_a->sens_res);
1241 platconf = PN533_TYPE_A_SENS_RES_PLATCONF(type_a->sens_res);
1242
1243 if ((ssd == PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
1244 platconf != PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL) ||
1245 (ssd != PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
1246 platconf == PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL))
1247 return false;
1248
1249 /* Requirements 4.8.2.1, 4.8.2.3, 4.8.2.5 and 4.8.2.7 from NFC Forum */
1250 if (PN533_TYPE_A_SEL_CASCADE(type_a->sel_res) != 0)
1251 return false;
1252
1253 if (type_a->nfcid_len > NFC_NFCID1_MAXSIZE)
1254 return false;
1255
1256 return true;
1257 }
1258
pn533_target_found_type_a(struct nfc_target * nfc_tgt,u8 * tgt_data,int tgt_data_len)1259 static int pn533_target_found_type_a(struct nfc_target *nfc_tgt, u8 *tgt_data,
1260 int tgt_data_len)
1261 {
1262 struct pn533_target_type_a *tgt_type_a;
1263
1264 tgt_type_a = (struct pn533_target_type_a *)tgt_data;
1265
1266 if (!pn533_target_type_a_is_valid(tgt_type_a, tgt_data_len))
1267 return -EPROTO;
1268
1269 switch (PN533_TYPE_A_SEL_PROT(tgt_type_a->sel_res)) {
1270 case PN533_TYPE_A_SEL_PROT_MIFARE:
1271 nfc_tgt->supported_protocols = NFC_PROTO_MIFARE_MASK;
1272 break;
1273 case PN533_TYPE_A_SEL_PROT_ISO14443:
1274 nfc_tgt->supported_protocols = NFC_PROTO_ISO14443_MASK;
1275 break;
1276 case PN533_TYPE_A_SEL_PROT_DEP:
1277 nfc_tgt->supported_protocols = NFC_PROTO_NFC_DEP_MASK;
1278 break;
1279 case PN533_TYPE_A_SEL_PROT_ISO14443_DEP:
1280 nfc_tgt->supported_protocols = NFC_PROTO_ISO14443_MASK |
1281 NFC_PROTO_NFC_DEP_MASK;
1282 break;
1283 }
1284
1285 nfc_tgt->sens_res = be16_to_cpu(tgt_type_a->sens_res);
1286 nfc_tgt->sel_res = tgt_type_a->sel_res;
1287 nfc_tgt->nfcid1_len = tgt_type_a->nfcid_len;
1288 memcpy(nfc_tgt->nfcid1, tgt_type_a->nfcid_data, nfc_tgt->nfcid1_len);
1289
1290 return 0;
1291 }
1292
1293 struct pn533_target_felica {
1294 u8 pol_res;
1295 u8 opcode;
1296 u8 nfcid2[NFC_NFCID2_MAXSIZE];
1297 u8 pad[8];
1298 /* optional */
1299 u8 syst_code[];
1300 } __packed;
1301
1302 #define PN533_FELICA_SENSF_NFCID2_DEP_B1 0x01
1303 #define PN533_FELICA_SENSF_NFCID2_DEP_B2 0xFE
1304
pn533_target_felica_is_valid(struct pn533_target_felica * felica,int target_data_len)1305 static bool pn533_target_felica_is_valid(struct pn533_target_felica *felica,
1306 int target_data_len)
1307 {
1308 if (target_data_len < sizeof(struct pn533_target_felica))
1309 return false;
1310
1311 if (felica->opcode != PN533_FELICA_OPC_SENSF_RES)
1312 return false;
1313
1314 return true;
1315 }
1316
pn533_target_found_felica(struct nfc_target * nfc_tgt,u8 * tgt_data,int tgt_data_len)1317 static int pn533_target_found_felica(struct nfc_target *nfc_tgt, u8 *tgt_data,
1318 int tgt_data_len)
1319 {
1320 struct pn533_target_felica *tgt_felica;
1321
1322 tgt_felica = (struct pn533_target_felica *)tgt_data;
1323
1324 if (!pn533_target_felica_is_valid(tgt_felica, tgt_data_len))
1325 return -EPROTO;
1326
1327 if ((tgt_felica->nfcid2[0] == PN533_FELICA_SENSF_NFCID2_DEP_B1) &&
1328 (tgt_felica->nfcid2[1] == PN533_FELICA_SENSF_NFCID2_DEP_B2))
1329 nfc_tgt->supported_protocols = NFC_PROTO_NFC_DEP_MASK;
1330 else
1331 nfc_tgt->supported_protocols = NFC_PROTO_FELICA_MASK;
1332
1333 memcpy(nfc_tgt->sensf_res, &tgt_felica->opcode, 9);
1334 nfc_tgt->sensf_res_len = 9;
1335
1336 memcpy(nfc_tgt->nfcid2, tgt_felica->nfcid2, NFC_NFCID2_MAXSIZE);
1337 nfc_tgt->nfcid2_len = NFC_NFCID2_MAXSIZE;
1338
1339 return 0;
1340 }
1341
1342 struct pn533_target_jewel {
1343 __be16 sens_res;
1344 u8 jewelid[4];
1345 } __packed;
1346
pn533_target_jewel_is_valid(struct pn533_target_jewel * jewel,int target_data_len)1347 static bool pn533_target_jewel_is_valid(struct pn533_target_jewel *jewel,
1348 int target_data_len)
1349 {
1350 u8 ssd;
1351 u8 platconf;
1352
1353 if (target_data_len < sizeof(struct pn533_target_jewel))
1354 return false;
1355
1356 /* Requirement 4.6.3.3 from NFC Forum Digital Spec */
1357 ssd = PN533_TYPE_A_SENS_RES_SSD(jewel->sens_res);
1358 platconf = PN533_TYPE_A_SENS_RES_PLATCONF(jewel->sens_res);
1359
1360 if ((ssd == PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
1361 platconf != PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL) ||
1362 (ssd != PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
1363 platconf == PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL))
1364 return false;
1365
1366 return true;
1367 }
1368
pn533_target_found_jewel(struct nfc_target * nfc_tgt,u8 * tgt_data,int tgt_data_len)1369 static int pn533_target_found_jewel(struct nfc_target *nfc_tgt, u8 *tgt_data,
1370 int tgt_data_len)
1371 {
1372 struct pn533_target_jewel *tgt_jewel;
1373
1374 tgt_jewel = (struct pn533_target_jewel *)tgt_data;
1375
1376 if (!pn533_target_jewel_is_valid(tgt_jewel, tgt_data_len))
1377 return -EPROTO;
1378
1379 nfc_tgt->supported_protocols = NFC_PROTO_JEWEL_MASK;
1380 nfc_tgt->sens_res = be16_to_cpu(tgt_jewel->sens_res);
1381 nfc_tgt->nfcid1_len = 4;
1382 memcpy(nfc_tgt->nfcid1, tgt_jewel->jewelid, nfc_tgt->nfcid1_len);
1383
1384 return 0;
1385 }
1386
1387 struct pn533_type_b_prot_info {
1388 u8 bitrate;
1389 u8 fsci_type;
1390 u8 fwi_adc_fo;
1391 } __packed;
1392
1393 #define PN533_TYPE_B_PROT_FCSI(x) (((x) & 0xF0) >> 4)
1394 #define PN533_TYPE_B_PROT_TYPE(x) (((x) & 0x0F) >> 0)
1395 #define PN533_TYPE_B_PROT_TYPE_RFU_MASK 0x8
1396
1397 struct pn533_type_b_sens_res {
1398 u8 opcode;
1399 u8 nfcid[4];
1400 u8 appdata[4];
1401 struct pn533_type_b_prot_info prot_info;
1402 } __packed;
1403
1404 #define PN533_TYPE_B_OPC_SENSB_RES 0x50
1405
1406 struct pn533_target_type_b {
1407 struct pn533_type_b_sens_res sensb_res;
1408 u8 attrib_res_len;
1409 u8 attrib_res[];
1410 } __packed;
1411
pn533_target_type_b_is_valid(struct pn533_target_type_b * type_b,int target_data_len)1412 static bool pn533_target_type_b_is_valid(struct pn533_target_type_b *type_b,
1413 int target_data_len)
1414 {
1415 if (target_data_len < sizeof(struct pn533_target_type_b))
1416 return false;
1417
1418 if (type_b->sensb_res.opcode != PN533_TYPE_B_OPC_SENSB_RES)
1419 return false;
1420
1421 if (PN533_TYPE_B_PROT_TYPE(type_b->sensb_res.prot_info.fsci_type) &
1422 PN533_TYPE_B_PROT_TYPE_RFU_MASK)
1423 return false;
1424
1425 return true;
1426 }
1427
pn533_target_found_type_b(struct nfc_target * nfc_tgt,u8 * tgt_data,int tgt_data_len)1428 static int pn533_target_found_type_b(struct nfc_target *nfc_tgt, u8 *tgt_data,
1429 int tgt_data_len)
1430 {
1431 struct pn533_target_type_b *tgt_type_b;
1432
1433 tgt_type_b = (struct pn533_target_type_b *)tgt_data;
1434
1435 if (!pn533_target_type_b_is_valid(tgt_type_b, tgt_data_len))
1436 return -EPROTO;
1437
1438 nfc_tgt->supported_protocols = NFC_PROTO_ISO14443_B_MASK;
1439
1440 return 0;
1441 }
1442
pn533_target_found(struct pn533 * dev,u8 tg,u8 * tgdata,int tgdata_len)1443 static int pn533_target_found(struct pn533 *dev, u8 tg, u8 *tgdata,
1444 int tgdata_len)
1445 {
1446 struct nfc_target nfc_tgt;
1447 int rc;
1448
1449 dev_dbg(&dev->interface->dev, "%s: modulation=%d\n",
1450 __func__, dev->poll_mod_curr);
1451
1452 if (tg != 1)
1453 return -EPROTO;
1454
1455 memset(&nfc_tgt, 0, sizeof(struct nfc_target));
1456
1457 switch (dev->poll_mod_curr) {
1458 case PN533_POLL_MOD_106KBPS_A:
1459 rc = pn533_target_found_type_a(&nfc_tgt, tgdata, tgdata_len);
1460 break;
1461 case PN533_POLL_MOD_212KBPS_FELICA:
1462 case PN533_POLL_MOD_424KBPS_FELICA:
1463 rc = pn533_target_found_felica(&nfc_tgt, tgdata, tgdata_len);
1464 break;
1465 case PN533_POLL_MOD_106KBPS_JEWEL:
1466 rc = pn533_target_found_jewel(&nfc_tgt, tgdata, tgdata_len);
1467 break;
1468 case PN533_POLL_MOD_847KBPS_B:
1469 rc = pn533_target_found_type_b(&nfc_tgt, tgdata, tgdata_len);
1470 break;
1471 default:
1472 nfc_err(&dev->interface->dev,
1473 "Unknown current poll modulation\n");
1474 return -EPROTO;
1475 }
1476
1477 if (rc)
1478 return rc;
1479
1480 if (!(nfc_tgt.supported_protocols & dev->poll_protocols)) {
1481 dev_dbg(&dev->interface->dev,
1482 "The Tg found doesn't have the desired protocol\n");
1483 return -EAGAIN;
1484 }
1485
1486 dev_dbg(&dev->interface->dev,
1487 "Target found - supported protocols: 0x%x\n",
1488 nfc_tgt.supported_protocols);
1489
1490 dev->tgt_available_prots = nfc_tgt.supported_protocols;
1491
1492 nfc_targets_found(dev->nfc_dev, &nfc_tgt, 1);
1493
1494 return 0;
1495 }
1496
pn533_poll_next_mod(struct pn533 * dev)1497 static inline void pn533_poll_next_mod(struct pn533 *dev)
1498 {
1499 dev->poll_mod_curr = (dev->poll_mod_curr + 1) % dev->poll_mod_count;
1500 }
1501
pn533_poll_reset_mod_list(struct pn533 * dev)1502 static void pn533_poll_reset_mod_list(struct pn533 *dev)
1503 {
1504 dev->poll_mod_count = 0;
1505 }
1506
pn533_poll_add_mod(struct pn533 * dev,u8 mod_index)1507 static void pn533_poll_add_mod(struct pn533 *dev, u8 mod_index)
1508 {
1509 dev->poll_mod_active[dev->poll_mod_count] =
1510 (struct pn533_poll_modulations *)&poll_mod[mod_index];
1511 dev->poll_mod_count++;
1512 }
1513
pn533_poll_create_mod_list(struct pn533 * dev,u32 im_protocols,u32 tm_protocols)1514 static void pn533_poll_create_mod_list(struct pn533 *dev,
1515 u32 im_protocols, u32 tm_protocols)
1516 {
1517 pn533_poll_reset_mod_list(dev);
1518
1519 if ((im_protocols & NFC_PROTO_MIFARE_MASK) ||
1520 (im_protocols & NFC_PROTO_ISO14443_MASK) ||
1521 (im_protocols & NFC_PROTO_NFC_DEP_MASK))
1522 pn533_poll_add_mod(dev, PN533_POLL_MOD_106KBPS_A);
1523
1524 if (im_protocols & NFC_PROTO_FELICA_MASK ||
1525 im_protocols & NFC_PROTO_NFC_DEP_MASK) {
1526 pn533_poll_add_mod(dev, PN533_POLL_MOD_212KBPS_FELICA);
1527 pn533_poll_add_mod(dev, PN533_POLL_MOD_424KBPS_FELICA);
1528 }
1529
1530 if (im_protocols & NFC_PROTO_JEWEL_MASK)
1531 pn533_poll_add_mod(dev, PN533_POLL_MOD_106KBPS_JEWEL);
1532
1533 if (im_protocols & NFC_PROTO_ISO14443_B_MASK)
1534 pn533_poll_add_mod(dev, PN533_POLL_MOD_847KBPS_B);
1535
1536 if (tm_protocols)
1537 pn533_poll_add_mod(dev, PN533_LISTEN_MOD);
1538 }
1539
pn533_start_poll_complete(struct pn533 * dev,struct sk_buff * resp)1540 static int pn533_start_poll_complete(struct pn533 *dev, struct sk_buff *resp)
1541 {
1542 u8 nbtg, tg, *tgdata;
1543 int rc, tgdata_len;
1544
1545 /* Toggle the DEP polling */
1546 dev->poll_dep = 1;
1547
1548 nbtg = resp->data[0];
1549 tg = resp->data[1];
1550 tgdata = &resp->data[2];
1551 tgdata_len = resp->len - 2; /* nbtg + tg */
1552
1553 if (nbtg) {
1554 rc = pn533_target_found(dev, tg, tgdata, tgdata_len);
1555
1556 /* We must stop the poll after a valid target found */
1557 if (rc == 0) {
1558 pn533_poll_reset_mod_list(dev);
1559 return 0;
1560 }
1561 }
1562
1563 return -EAGAIN;
1564 }
1565
pn533_alloc_poll_tg_frame(struct pn533 * dev)1566 static struct sk_buff *pn533_alloc_poll_tg_frame(struct pn533 *dev)
1567 {
1568 struct sk_buff *skb;
1569 u8 *felica, *nfcid3, *gb;
1570
1571 u8 *gbytes = dev->gb;
1572 size_t gbytes_len = dev->gb_len;
1573
1574 u8 felica_params[18] = {0x1, 0xfe, /* DEP */
1575 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, /* random */
1576 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
1577 0xff, 0xff}; /* System code */
1578
1579 u8 mifare_params[6] = {0x1, 0x1, /* SENS_RES */
1580 0x0, 0x0, 0x0,
1581 0x40}; /* SEL_RES for DEP */
1582
1583 unsigned int skb_len = 36 + /* mode (1), mifare (6),
1584 felica (18), nfcid3 (10), gb_len (1) */
1585 gbytes_len +
1586 1; /* len Tk*/
1587
1588 skb = pn533_alloc_skb(dev, skb_len);
1589 if (!skb)
1590 return NULL;
1591
1592 /* DEP support only */
1593 *skb_put(skb, 1) = PN533_INIT_TARGET_DEP;
1594
1595 /* MIFARE params */
1596 memcpy(skb_put(skb, 6), mifare_params, 6);
1597
1598 /* Felica params */
1599 felica = skb_put(skb, 18);
1600 memcpy(felica, felica_params, 18);
1601 get_random_bytes(felica + 2, 6);
1602
1603 /* NFCID3 */
1604 nfcid3 = skb_put(skb, 10);
1605 memset(nfcid3, 0, 10);
1606 memcpy(nfcid3, felica, 8);
1607
1608 /* General bytes */
1609 *skb_put(skb, 1) = gbytes_len;
1610
1611 gb = skb_put(skb, gbytes_len);
1612 memcpy(gb, gbytes, gbytes_len);
1613
1614 /* Len Tk */
1615 *skb_put(skb, 1) = 0;
1616
1617 return skb;
1618 }
1619
1620 #define PN533_CMD_DATAEXCH_HEAD_LEN 1
1621 #define PN533_CMD_DATAEXCH_DATA_MAXLEN 262
1622 static void pn533_wq_tm_mi_recv(struct work_struct *work);
1623 static struct sk_buff *pn533_build_response(struct pn533 *dev);
1624
pn533_tm_get_data_complete(struct pn533 * dev,void * arg,struct sk_buff * resp)1625 static int pn533_tm_get_data_complete(struct pn533 *dev, void *arg,
1626 struct sk_buff *resp)
1627 {
1628 struct sk_buff *skb;
1629 u8 status, ret, mi;
1630 int rc;
1631
1632 dev_dbg(&dev->interface->dev, "%s\n", __func__);
1633
1634 if (IS_ERR(resp)) {
1635 skb_queue_purge(&dev->resp_q);
1636 return PTR_ERR(resp);
1637 }
1638
1639 status = resp->data[0];
1640
1641 ret = status & PN533_CMD_RET_MASK;
1642 mi = status & PN533_CMD_MI_MASK;
1643
1644 skb_pull(resp, sizeof(status));
1645
1646 if (ret != PN533_CMD_RET_SUCCESS) {
1647 rc = -EIO;
1648 goto error;
1649 }
1650
1651 skb_queue_tail(&dev->resp_q, resp);
1652
1653 if (mi) {
1654 queue_work(dev->wq, &dev->mi_tm_rx_work);
1655 return -EINPROGRESS;
1656 }
1657
1658 skb = pn533_build_response(dev);
1659 if (!skb) {
1660 rc = -EIO;
1661 goto error;
1662 }
1663
1664 return nfc_tm_data_received(dev->nfc_dev, skb);
1665
1666 error:
1667 nfc_tm_deactivated(dev->nfc_dev);
1668 dev->tgt_mode = 0;
1669 skb_queue_purge(&dev->resp_q);
1670 dev_kfree_skb(resp);
1671
1672 return rc;
1673 }
1674
pn533_wq_tm_mi_recv(struct work_struct * work)1675 static void pn533_wq_tm_mi_recv(struct work_struct *work)
1676 {
1677 struct pn533 *dev = container_of(work, struct pn533, mi_tm_rx_work);
1678 struct sk_buff *skb;
1679 int rc;
1680
1681 dev_dbg(&dev->interface->dev, "%s\n", __func__);
1682
1683 skb = pn533_alloc_skb(dev, 0);
1684 if (!skb)
1685 return;
1686
1687 rc = pn533_send_cmd_direct_async(dev,
1688 PN533_CMD_TG_GET_DATA,
1689 skb,
1690 pn533_tm_get_data_complete,
1691 NULL);
1692
1693 if (rc < 0)
1694 dev_kfree_skb(skb);
1695
1696 return;
1697 }
1698
1699 static int pn533_tm_send_complete(struct pn533 *dev, void *arg,
1700 struct sk_buff *resp);
pn533_wq_tm_mi_send(struct work_struct * work)1701 static void pn533_wq_tm_mi_send(struct work_struct *work)
1702 {
1703 struct pn533 *dev = container_of(work, struct pn533, mi_tm_tx_work);
1704 struct sk_buff *skb;
1705 int rc;
1706
1707 dev_dbg(&dev->interface->dev, "%s\n", __func__);
1708
1709 /* Grab the first skb in the queue */
1710 skb = skb_dequeue(&dev->fragment_skb);
1711 if (skb == NULL) { /* No more data */
1712 /* Reset the queue for future use */
1713 skb_queue_head_init(&dev->fragment_skb);
1714 goto error;
1715 }
1716
1717 /* last entry - remove MI bit */
1718 if (skb_queue_len(&dev->fragment_skb) == 0) {
1719 rc = pn533_send_cmd_direct_async(dev, PN533_CMD_TG_SET_DATA,
1720 skb, pn533_tm_send_complete, NULL);
1721 } else
1722 rc = pn533_send_cmd_direct_async(dev,
1723 PN533_CMD_TG_SET_META_DATA,
1724 skb, pn533_tm_send_complete, NULL);
1725
1726 if (rc == 0) /* success */
1727 return;
1728
1729 dev_err(&dev->interface->dev,
1730 "Error %d when trying to perform set meta data_exchange", rc);
1731
1732 dev_kfree_skb(skb);
1733
1734 error:
1735 pn533_send_ack(dev, GFP_KERNEL);
1736 queue_work(dev->wq, &dev->cmd_work);
1737 }
1738
pn533_wq_tg_get_data(struct work_struct * work)1739 static void pn533_wq_tg_get_data(struct work_struct *work)
1740 {
1741 struct pn533 *dev = container_of(work, struct pn533, tg_work);
1742 struct sk_buff *skb;
1743 int rc;
1744
1745 dev_dbg(&dev->interface->dev, "%s\n", __func__);
1746
1747 skb = pn533_alloc_skb(dev, 0);
1748 if (!skb)
1749 return;
1750
1751 rc = pn533_send_data_async(dev, PN533_CMD_TG_GET_DATA, skb,
1752 pn533_tm_get_data_complete, NULL);
1753
1754 if (rc < 0)
1755 dev_kfree_skb(skb);
1756
1757 return;
1758 }
1759
1760 #define ATR_REQ_GB_OFFSET 17
pn533_init_target_complete(struct pn533 * dev,struct sk_buff * resp)1761 static int pn533_init_target_complete(struct pn533 *dev, struct sk_buff *resp)
1762 {
1763 u8 mode, *cmd, comm_mode = NFC_COMM_PASSIVE, *gb;
1764 size_t gb_len;
1765 int rc;
1766
1767 dev_dbg(&dev->interface->dev, "%s\n", __func__);
1768
1769 if (resp->len < ATR_REQ_GB_OFFSET + 1)
1770 return -EINVAL;
1771
1772 mode = resp->data[0];
1773 cmd = &resp->data[1];
1774
1775 dev_dbg(&dev->interface->dev, "Target mode 0x%x len %d\n",
1776 mode, resp->len);
1777
1778 if ((mode & PN533_INIT_TARGET_RESP_FRAME_MASK) ==
1779 PN533_INIT_TARGET_RESP_ACTIVE)
1780 comm_mode = NFC_COMM_ACTIVE;
1781
1782 if ((mode & PN533_INIT_TARGET_RESP_DEP) == 0) /* Only DEP supported */
1783 return -EOPNOTSUPP;
1784
1785 gb = cmd + ATR_REQ_GB_OFFSET;
1786 gb_len = resp->len - (ATR_REQ_GB_OFFSET + 1);
1787
1788 rc = nfc_tm_activated(dev->nfc_dev, NFC_PROTO_NFC_DEP_MASK,
1789 comm_mode, gb, gb_len);
1790 if (rc < 0) {
1791 nfc_err(&dev->interface->dev,
1792 "Error when signaling target activation\n");
1793 return rc;
1794 }
1795
1796 dev->tgt_mode = 1;
1797 queue_work(dev->wq, &dev->tg_work);
1798
1799 return 0;
1800 }
1801
pn533_listen_mode_timer(unsigned long data)1802 static void pn533_listen_mode_timer(unsigned long data)
1803 {
1804 struct pn533 *dev = (struct pn533 *)data;
1805
1806 dev_dbg(&dev->interface->dev, "Listen mode timeout\n");
1807
1808 dev->cancel_listen = 1;
1809
1810 pn533_poll_next_mod(dev);
1811
1812 queue_delayed_work(dev->wq, &dev->poll_work,
1813 msecs_to_jiffies(PN533_POLL_INTERVAL));
1814 }
1815
pn533_rf_complete(struct pn533 * dev,void * arg,struct sk_buff * resp)1816 static int pn533_rf_complete(struct pn533 *dev, void *arg,
1817 struct sk_buff *resp)
1818 {
1819 int rc = 0;
1820
1821 dev_dbg(&dev->interface->dev, "%s\n", __func__);
1822
1823 if (IS_ERR(resp)) {
1824 rc = PTR_ERR(resp);
1825
1826 nfc_err(&dev->interface->dev, "RF setting error %d\n", rc);
1827
1828 return rc;
1829 }
1830
1831 queue_delayed_work(dev->wq, &dev->poll_work,
1832 msecs_to_jiffies(PN533_POLL_INTERVAL));
1833
1834 dev_kfree_skb(resp);
1835 return rc;
1836 }
1837
pn533_wq_rf(struct work_struct * work)1838 static void pn533_wq_rf(struct work_struct *work)
1839 {
1840 struct pn533 *dev = container_of(work, struct pn533, rf_work);
1841 struct sk_buff *skb;
1842 int rc;
1843
1844 dev_dbg(&dev->interface->dev, "%s\n", __func__);
1845
1846 skb = pn533_alloc_skb(dev, 2);
1847 if (!skb)
1848 return;
1849
1850 *skb_put(skb, 1) = PN533_CFGITEM_RF_FIELD;
1851 *skb_put(skb, 1) = PN533_CFGITEM_RF_FIELD_AUTO_RFCA;
1852
1853 rc = pn533_send_cmd_async(dev, PN533_CMD_RF_CONFIGURATION, skb,
1854 pn533_rf_complete, NULL);
1855 if (rc < 0) {
1856 dev_kfree_skb(skb);
1857 nfc_err(&dev->interface->dev, "RF setting error %d\n", rc);
1858 }
1859
1860 return;
1861 }
1862
pn533_poll_dep_complete(struct pn533 * dev,void * arg,struct sk_buff * resp)1863 static int pn533_poll_dep_complete(struct pn533 *dev, void *arg,
1864 struct sk_buff *resp)
1865 {
1866 struct pn533_cmd_jump_dep_response *rsp;
1867 struct nfc_target nfc_target;
1868 u8 target_gt_len;
1869 int rc;
1870
1871 if (IS_ERR(resp))
1872 return PTR_ERR(resp);
1873
1874 rsp = (struct pn533_cmd_jump_dep_response *)resp->data;
1875
1876 rc = rsp->status & PN533_CMD_RET_MASK;
1877 if (rc != PN533_CMD_RET_SUCCESS) {
1878 /* Not target found, turn radio off */
1879 queue_work(dev->wq, &dev->rf_work);
1880
1881 dev_kfree_skb(resp);
1882 return 0;
1883 }
1884
1885 dev_dbg(&dev->interface->dev, "Creating new target");
1886
1887 nfc_target.supported_protocols = NFC_PROTO_NFC_DEP_MASK;
1888 nfc_target.nfcid1_len = 10;
1889 memcpy(nfc_target.nfcid1, rsp->nfcid3t, nfc_target.nfcid1_len);
1890 rc = nfc_targets_found(dev->nfc_dev, &nfc_target, 1);
1891 if (rc)
1892 goto error;
1893
1894 dev->tgt_available_prots = 0;
1895 dev->tgt_active_prot = NFC_PROTO_NFC_DEP;
1896
1897 /* ATR_RES general bytes are located at offset 17 */
1898 target_gt_len = resp->len - 17;
1899 rc = nfc_set_remote_general_bytes(dev->nfc_dev,
1900 rsp->gt, target_gt_len);
1901 if (!rc) {
1902 rc = nfc_dep_link_is_up(dev->nfc_dev,
1903 dev->nfc_dev->targets[0].idx,
1904 0, NFC_RF_INITIATOR);
1905
1906 if (!rc)
1907 pn533_poll_reset_mod_list(dev);
1908 }
1909 error:
1910 dev_kfree_skb(resp);
1911 return rc;
1912 }
1913
1914 #define PASSIVE_DATA_LEN 5
pn533_poll_dep(struct nfc_dev * nfc_dev)1915 static int pn533_poll_dep(struct nfc_dev *nfc_dev)
1916 {
1917 struct pn533 *dev = nfc_get_drvdata(nfc_dev);
1918 struct sk_buff *skb;
1919 int rc, skb_len;
1920 u8 *next, nfcid3[NFC_NFCID3_MAXSIZE];
1921 u8 passive_data[PASSIVE_DATA_LEN] = {0x00, 0xff, 0xff, 0x00, 0x3};
1922
1923 dev_dbg(&dev->interface->dev, "%s", __func__);
1924
1925 if (!dev->gb) {
1926 dev->gb = nfc_get_local_general_bytes(nfc_dev, &dev->gb_len);
1927
1928 if (!dev->gb || !dev->gb_len) {
1929 dev->poll_dep = 0;
1930 queue_work(dev->wq, &dev->rf_work);
1931 }
1932 }
1933
1934 skb_len = 3 + dev->gb_len; /* ActPass + BR + Next */
1935 skb_len += PASSIVE_DATA_LEN;
1936
1937 /* NFCID3 */
1938 skb_len += NFC_NFCID3_MAXSIZE;
1939 nfcid3[0] = 0x1;
1940 nfcid3[1] = 0xfe;
1941 get_random_bytes(nfcid3 + 2, 6);
1942
1943 skb = pn533_alloc_skb(dev, skb_len);
1944 if (!skb)
1945 return -ENOMEM;
1946
1947 *skb_put(skb, 1) = 0x01; /* Active */
1948 *skb_put(skb, 1) = 0x02; /* 424 kbps */
1949
1950 next = skb_put(skb, 1); /* Next */
1951 *next = 0;
1952
1953 /* Copy passive data */
1954 memcpy(skb_put(skb, PASSIVE_DATA_LEN), passive_data, PASSIVE_DATA_LEN);
1955 *next |= 1;
1956
1957 /* Copy NFCID3 (which is NFCID2 from SENSF_RES) */
1958 memcpy(skb_put(skb, NFC_NFCID3_MAXSIZE), nfcid3,
1959 NFC_NFCID3_MAXSIZE);
1960 *next |= 2;
1961
1962 memcpy(skb_put(skb, dev->gb_len), dev->gb, dev->gb_len);
1963 *next |= 4; /* We have some Gi */
1964
1965 rc = pn533_send_cmd_async(dev, PN533_CMD_IN_JUMP_FOR_DEP, skb,
1966 pn533_poll_dep_complete, NULL);
1967
1968 if (rc < 0)
1969 dev_kfree_skb(skb);
1970
1971 return rc;
1972 }
1973
pn533_poll_complete(struct pn533 * dev,void * arg,struct sk_buff * resp)1974 static int pn533_poll_complete(struct pn533 *dev, void *arg,
1975 struct sk_buff *resp)
1976 {
1977 struct pn533_poll_modulations *cur_mod;
1978 int rc;
1979
1980 dev_dbg(&dev->interface->dev, "%s\n", __func__);
1981
1982 if (IS_ERR(resp)) {
1983 rc = PTR_ERR(resp);
1984
1985 nfc_err(&dev->interface->dev, "%s Poll complete error %d\n",
1986 __func__, rc);
1987
1988 if (rc == -ENOENT) {
1989 if (dev->poll_mod_count != 0)
1990 return rc;
1991 else
1992 goto stop_poll;
1993 } else if (rc < 0) {
1994 nfc_err(&dev->interface->dev,
1995 "Error %d when running poll\n", rc);
1996 goto stop_poll;
1997 }
1998 }
1999
2000 cur_mod = dev->poll_mod_active[dev->poll_mod_curr];
2001
2002 if (cur_mod->len == 0) { /* Target mode */
2003 del_timer(&dev->listen_timer);
2004 rc = pn533_init_target_complete(dev, resp);
2005 goto done;
2006 }
2007
2008 /* Initiator mode */
2009 rc = pn533_start_poll_complete(dev, resp);
2010 if (!rc)
2011 goto done;
2012
2013 if (!dev->poll_mod_count) {
2014 dev_dbg(&dev->interface->dev, "Polling has been stopped\n");
2015 goto done;
2016 }
2017
2018 pn533_poll_next_mod(dev);
2019 /* Not target found, turn radio off */
2020 queue_work(dev->wq, &dev->rf_work);
2021
2022 done:
2023 dev_kfree_skb(resp);
2024 return rc;
2025
2026 stop_poll:
2027 nfc_err(&dev->interface->dev, "Polling operation has been stopped\n");
2028
2029 pn533_poll_reset_mod_list(dev);
2030 dev->poll_protocols = 0;
2031 return rc;
2032 }
2033
pn533_alloc_poll_in_frame(struct pn533 * dev,struct pn533_poll_modulations * mod)2034 static struct sk_buff *pn533_alloc_poll_in_frame(struct pn533 *dev,
2035 struct pn533_poll_modulations *mod)
2036 {
2037 struct sk_buff *skb;
2038
2039 skb = pn533_alloc_skb(dev, mod->len);
2040 if (!skb)
2041 return NULL;
2042
2043 memcpy(skb_put(skb, mod->len), &mod->data, mod->len);
2044
2045 return skb;
2046 }
2047
pn533_send_poll_frame(struct pn533 * dev)2048 static int pn533_send_poll_frame(struct pn533 *dev)
2049 {
2050 struct pn533_poll_modulations *mod;
2051 struct sk_buff *skb;
2052 int rc;
2053 u8 cmd_code;
2054
2055 mod = dev->poll_mod_active[dev->poll_mod_curr];
2056
2057 dev_dbg(&dev->interface->dev, "%s mod len %d\n",
2058 __func__, mod->len);
2059
2060 if (dev->poll_dep) {
2061 dev->poll_dep = 0;
2062 return pn533_poll_dep(dev->nfc_dev);
2063 }
2064
2065 if (mod->len == 0) { /* Listen mode */
2066 cmd_code = PN533_CMD_TG_INIT_AS_TARGET;
2067 skb = pn533_alloc_poll_tg_frame(dev);
2068 } else { /* Polling mode */
2069 cmd_code = PN533_CMD_IN_LIST_PASSIVE_TARGET;
2070 skb = pn533_alloc_poll_in_frame(dev, mod);
2071 }
2072
2073 if (!skb) {
2074 nfc_err(&dev->interface->dev, "Failed to allocate skb\n");
2075 return -ENOMEM;
2076 }
2077
2078 rc = pn533_send_cmd_async(dev, cmd_code, skb, pn533_poll_complete,
2079 NULL);
2080 if (rc < 0) {
2081 dev_kfree_skb(skb);
2082 nfc_err(&dev->interface->dev, "Polling loop error %d\n", rc);
2083 }
2084
2085 return rc;
2086 }
2087
pn533_wq_poll(struct work_struct * work)2088 static void pn533_wq_poll(struct work_struct *work)
2089 {
2090 struct pn533 *dev = container_of(work, struct pn533, poll_work.work);
2091 struct pn533_poll_modulations *cur_mod;
2092 int rc;
2093
2094 cur_mod = dev->poll_mod_active[dev->poll_mod_curr];
2095
2096 dev_dbg(&dev->interface->dev,
2097 "%s cancel_listen %d modulation len %d\n",
2098 __func__, dev->cancel_listen, cur_mod->len);
2099
2100 if (dev->cancel_listen == 1) {
2101 dev->cancel_listen = 0;
2102 pn533_abort_cmd(dev, GFP_ATOMIC);
2103 }
2104
2105 rc = pn533_send_poll_frame(dev);
2106 if (rc)
2107 return;
2108
2109 if (cur_mod->len == 0 && dev->poll_mod_count > 1)
2110 mod_timer(&dev->listen_timer, jiffies + PN533_LISTEN_TIME * HZ);
2111
2112 return;
2113 }
2114
pn533_start_poll(struct nfc_dev * nfc_dev,u32 im_protocols,u32 tm_protocols)2115 static int pn533_start_poll(struct nfc_dev *nfc_dev,
2116 u32 im_protocols, u32 tm_protocols)
2117 {
2118 struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2119 struct pn533_poll_modulations *cur_mod;
2120 u8 rand_mod;
2121 int rc;
2122
2123 dev_dbg(&dev->interface->dev,
2124 "%s: im protocols 0x%x tm protocols 0x%x\n",
2125 __func__, im_protocols, tm_protocols);
2126
2127 if (dev->tgt_active_prot) {
2128 nfc_err(&dev->interface->dev,
2129 "Cannot poll with a target already activated\n");
2130 return -EBUSY;
2131 }
2132
2133 if (dev->tgt_mode) {
2134 nfc_err(&dev->interface->dev,
2135 "Cannot poll while already being activated\n");
2136 return -EBUSY;
2137 }
2138
2139 if (tm_protocols) {
2140 dev->gb = nfc_get_local_general_bytes(nfc_dev, &dev->gb_len);
2141 if (dev->gb == NULL)
2142 tm_protocols = 0;
2143 }
2144
2145 pn533_poll_create_mod_list(dev, im_protocols, tm_protocols);
2146 dev->poll_protocols = im_protocols;
2147 dev->listen_protocols = tm_protocols;
2148
2149 /* Do not always start polling from the same modulation */
2150 get_random_bytes(&rand_mod, sizeof(rand_mod));
2151 rand_mod %= dev->poll_mod_count;
2152 dev->poll_mod_curr = rand_mod;
2153
2154 cur_mod = dev->poll_mod_active[dev->poll_mod_curr];
2155
2156 rc = pn533_send_poll_frame(dev);
2157
2158 /* Start listen timer */
2159 if (!rc && cur_mod->len == 0 && dev->poll_mod_count > 1)
2160 mod_timer(&dev->listen_timer, jiffies + PN533_LISTEN_TIME * HZ);
2161
2162 return rc;
2163 }
2164
pn533_stop_poll(struct nfc_dev * nfc_dev)2165 static void pn533_stop_poll(struct nfc_dev *nfc_dev)
2166 {
2167 struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2168
2169 del_timer(&dev->listen_timer);
2170
2171 if (!dev->poll_mod_count) {
2172 dev_dbg(&dev->interface->dev,
2173 "Polling operation was not running\n");
2174 return;
2175 }
2176
2177 pn533_abort_cmd(dev, GFP_KERNEL);
2178 flush_delayed_work(&dev->poll_work);
2179 pn533_poll_reset_mod_list(dev);
2180 }
2181
pn533_activate_target_nfcdep(struct pn533 * dev)2182 static int pn533_activate_target_nfcdep(struct pn533 *dev)
2183 {
2184 struct pn533_cmd_activate_response *rsp;
2185 u16 gt_len;
2186 int rc;
2187 struct sk_buff *skb;
2188 struct sk_buff *resp;
2189
2190 dev_dbg(&dev->interface->dev, "%s\n", __func__);
2191
2192 skb = pn533_alloc_skb(dev, sizeof(u8) * 2); /*TG + Next*/
2193 if (!skb)
2194 return -ENOMEM;
2195
2196 *skb_put(skb, sizeof(u8)) = 1; /* TG */
2197 *skb_put(skb, sizeof(u8)) = 0; /* Next */
2198
2199 resp = pn533_send_cmd_sync(dev, PN533_CMD_IN_ATR, skb);
2200 if (IS_ERR(resp))
2201 return PTR_ERR(resp);
2202
2203 rsp = (struct pn533_cmd_activate_response *)resp->data;
2204 rc = rsp->status & PN533_CMD_RET_MASK;
2205 if (rc != PN533_CMD_RET_SUCCESS) {
2206 nfc_err(&dev->interface->dev,
2207 "Target activation failed (error 0x%x)\n", rc);
2208 dev_kfree_skb(resp);
2209 return -EIO;
2210 }
2211
2212 /* ATR_RES general bytes are located at offset 16 */
2213 gt_len = resp->len - 16;
2214 rc = nfc_set_remote_general_bytes(dev->nfc_dev, rsp->gt, gt_len);
2215
2216 dev_kfree_skb(resp);
2217 return rc;
2218 }
2219
pn533_activate_target(struct nfc_dev * nfc_dev,struct nfc_target * target,u32 protocol)2220 static int pn533_activate_target(struct nfc_dev *nfc_dev,
2221 struct nfc_target *target, u32 protocol)
2222 {
2223 struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2224 int rc;
2225
2226 dev_dbg(&dev->interface->dev, "%s: protocol=%u\n", __func__, protocol);
2227
2228 if (dev->poll_mod_count) {
2229 nfc_err(&dev->interface->dev,
2230 "Cannot activate while polling\n");
2231 return -EBUSY;
2232 }
2233
2234 if (dev->tgt_active_prot) {
2235 nfc_err(&dev->interface->dev,
2236 "There is already an active target\n");
2237 return -EBUSY;
2238 }
2239
2240 if (!dev->tgt_available_prots) {
2241 nfc_err(&dev->interface->dev,
2242 "There is no available target to activate\n");
2243 return -EINVAL;
2244 }
2245
2246 if (!(dev->tgt_available_prots & (1 << protocol))) {
2247 nfc_err(&dev->interface->dev,
2248 "Target doesn't support requested proto %u\n",
2249 protocol);
2250 return -EINVAL;
2251 }
2252
2253 if (protocol == NFC_PROTO_NFC_DEP) {
2254 rc = pn533_activate_target_nfcdep(dev);
2255 if (rc) {
2256 nfc_err(&dev->interface->dev,
2257 "Activating target with DEP failed %d\n", rc);
2258 return rc;
2259 }
2260 }
2261
2262 dev->tgt_active_prot = protocol;
2263 dev->tgt_available_prots = 0;
2264
2265 return 0;
2266 }
2267
pn533_deactivate_target(struct nfc_dev * nfc_dev,struct nfc_target * target,u8 mode)2268 static void pn533_deactivate_target(struct nfc_dev *nfc_dev,
2269 struct nfc_target *target, u8 mode)
2270 {
2271 struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2272 struct sk_buff *skb;
2273 struct sk_buff *resp;
2274 int rc;
2275
2276 dev_dbg(&dev->interface->dev, "%s\n", __func__);
2277
2278 if (!dev->tgt_active_prot) {
2279 nfc_err(&dev->interface->dev, "There is no active target\n");
2280 return;
2281 }
2282
2283 dev->tgt_active_prot = 0;
2284 skb_queue_purge(&dev->resp_q);
2285
2286 skb = pn533_alloc_skb(dev, sizeof(u8));
2287 if (!skb)
2288 return;
2289
2290 *skb_put(skb, 1) = 1; /* TG*/
2291
2292 resp = pn533_send_cmd_sync(dev, PN533_CMD_IN_RELEASE, skb);
2293 if (IS_ERR(resp))
2294 return;
2295
2296 rc = resp->data[0] & PN533_CMD_RET_MASK;
2297 if (rc != PN533_CMD_RET_SUCCESS)
2298 nfc_err(&dev->interface->dev,
2299 "Error 0x%x when releasing the target\n", rc);
2300
2301 dev_kfree_skb(resp);
2302 return;
2303 }
2304
2305
pn533_in_dep_link_up_complete(struct pn533 * dev,void * arg,struct sk_buff * resp)2306 static int pn533_in_dep_link_up_complete(struct pn533 *dev, void *arg,
2307 struct sk_buff *resp)
2308 {
2309 struct pn533_cmd_jump_dep_response *rsp;
2310 u8 target_gt_len;
2311 int rc;
2312 u8 active = *(u8 *)arg;
2313
2314 kfree(arg);
2315
2316 if (IS_ERR(resp))
2317 return PTR_ERR(resp);
2318
2319 if (dev->tgt_available_prots &&
2320 !(dev->tgt_available_prots & (1 << NFC_PROTO_NFC_DEP))) {
2321 nfc_err(&dev->interface->dev,
2322 "The target does not support DEP\n");
2323 rc = -EINVAL;
2324 goto error;
2325 }
2326
2327 rsp = (struct pn533_cmd_jump_dep_response *)resp->data;
2328
2329 rc = rsp->status & PN533_CMD_RET_MASK;
2330 if (rc != PN533_CMD_RET_SUCCESS) {
2331 nfc_err(&dev->interface->dev,
2332 "Bringing DEP link up failed (error 0x%x)\n", rc);
2333 goto error;
2334 }
2335
2336 if (!dev->tgt_available_prots) {
2337 struct nfc_target nfc_target;
2338
2339 dev_dbg(&dev->interface->dev, "Creating new target\n");
2340
2341 nfc_target.supported_protocols = NFC_PROTO_NFC_DEP_MASK;
2342 nfc_target.nfcid1_len = 10;
2343 memcpy(nfc_target.nfcid1, rsp->nfcid3t, nfc_target.nfcid1_len);
2344 rc = nfc_targets_found(dev->nfc_dev, &nfc_target, 1);
2345 if (rc)
2346 goto error;
2347
2348 dev->tgt_available_prots = 0;
2349 }
2350
2351 dev->tgt_active_prot = NFC_PROTO_NFC_DEP;
2352
2353 /* ATR_RES general bytes are located at offset 17 */
2354 target_gt_len = resp->len - 17;
2355 rc = nfc_set_remote_general_bytes(dev->nfc_dev,
2356 rsp->gt, target_gt_len);
2357 if (rc == 0)
2358 rc = nfc_dep_link_is_up(dev->nfc_dev,
2359 dev->nfc_dev->targets[0].idx,
2360 !active, NFC_RF_INITIATOR);
2361
2362 error:
2363 dev_kfree_skb(resp);
2364 return rc;
2365 }
2366
2367 static int pn533_rf_field(struct nfc_dev *nfc_dev, u8 rf);
pn533_dep_link_up(struct nfc_dev * nfc_dev,struct nfc_target * target,u8 comm_mode,u8 * gb,size_t gb_len)2368 static int pn533_dep_link_up(struct nfc_dev *nfc_dev, struct nfc_target *target,
2369 u8 comm_mode, u8 *gb, size_t gb_len)
2370 {
2371 struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2372 struct sk_buff *skb;
2373 int rc, skb_len;
2374 u8 *next, *arg, nfcid3[NFC_NFCID3_MAXSIZE];
2375 u8 passive_data[PASSIVE_DATA_LEN] = {0x00, 0xff, 0xff, 0x00, 0x3};
2376
2377 dev_dbg(&dev->interface->dev, "%s\n", __func__);
2378
2379 if (dev->poll_mod_count) {
2380 nfc_err(&dev->interface->dev,
2381 "Cannot bring the DEP link up while polling\n");
2382 return -EBUSY;
2383 }
2384
2385 if (dev->tgt_active_prot) {
2386 nfc_err(&dev->interface->dev,
2387 "There is already an active target\n");
2388 return -EBUSY;
2389 }
2390
2391 skb_len = 3 + gb_len; /* ActPass + BR + Next */
2392 skb_len += PASSIVE_DATA_LEN;
2393
2394 /* NFCID3 */
2395 skb_len += NFC_NFCID3_MAXSIZE;
2396 if (target && !target->nfcid2_len) {
2397 nfcid3[0] = 0x1;
2398 nfcid3[1] = 0xfe;
2399 get_random_bytes(nfcid3 + 2, 6);
2400 }
2401
2402 skb = pn533_alloc_skb(dev, skb_len);
2403 if (!skb)
2404 return -ENOMEM;
2405
2406 *skb_put(skb, 1) = !comm_mode; /* ActPass */
2407 *skb_put(skb, 1) = 0x02; /* 424 kbps */
2408
2409 next = skb_put(skb, 1); /* Next */
2410 *next = 0;
2411
2412 /* Copy passive data */
2413 memcpy(skb_put(skb, PASSIVE_DATA_LEN), passive_data, PASSIVE_DATA_LEN);
2414 *next |= 1;
2415
2416 /* Copy NFCID3 (which is NFCID2 from SENSF_RES) */
2417 if (target && target->nfcid2_len)
2418 memcpy(skb_put(skb, NFC_NFCID3_MAXSIZE), target->nfcid2,
2419 target->nfcid2_len);
2420 else
2421 memcpy(skb_put(skb, NFC_NFCID3_MAXSIZE), nfcid3,
2422 NFC_NFCID3_MAXSIZE);
2423 *next |= 2;
2424
2425 if (gb != NULL && gb_len > 0) {
2426 memcpy(skb_put(skb, gb_len), gb, gb_len);
2427 *next |= 4; /* We have some Gi */
2428 } else {
2429 *next = 0;
2430 }
2431
2432 arg = kmalloc(sizeof(*arg), GFP_KERNEL);
2433 if (!arg) {
2434 dev_kfree_skb(skb);
2435 return -ENOMEM;
2436 }
2437
2438 *arg = !comm_mode;
2439
2440 pn533_rf_field(dev->nfc_dev, 0);
2441
2442 rc = pn533_send_cmd_async(dev, PN533_CMD_IN_JUMP_FOR_DEP, skb,
2443 pn533_in_dep_link_up_complete, arg);
2444
2445 if (rc < 0) {
2446 dev_kfree_skb(skb);
2447 kfree(arg);
2448 }
2449
2450 return rc;
2451 }
2452
pn533_dep_link_down(struct nfc_dev * nfc_dev)2453 static int pn533_dep_link_down(struct nfc_dev *nfc_dev)
2454 {
2455 struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2456
2457 dev_dbg(&dev->interface->dev, "%s\n", __func__);
2458
2459 pn533_poll_reset_mod_list(dev);
2460
2461 if (dev->tgt_mode || dev->tgt_active_prot)
2462 pn533_abort_cmd(dev, GFP_KERNEL);
2463
2464 dev->tgt_active_prot = 0;
2465 dev->tgt_mode = 0;
2466
2467 skb_queue_purge(&dev->resp_q);
2468
2469 return 0;
2470 }
2471
2472 struct pn533_data_exchange_arg {
2473 data_exchange_cb_t cb;
2474 void *cb_context;
2475 };
2476
pn533_build_response(struct pn533 * dev)2477 static struct sk_buff *pn533_build_response(struct pn533 *dev)
2478 {
2479 struct sk_buff *skb, *tmp, *t;
2480 unsigned int skb_len = 0, tmp_len = 0;
2481
2482 dev_dbg(&dev->interface->dev, "%s\n", __func__);
2483
2484 if (skb_queue_empty(&dev->resp_q))
2485 return NULL;
2486
2487 if (skb_queue_len(&dev->resp_q) == 1) {
2488 skb = skb_dequeue(&dev->resp_q);
2489 goto out;
2490 }
2491
2492 skb_queue_walk_safe(&dev->resp_q, tmp, t)
2493 skb_len += tmp->len;
2494
2495 dev_dbg(&dev->interface->dev, "%s total length %d\n",
2496 __func__, skb_len);
2497
2498 skb = alloc_skb(skb_len, GFP_KERNEL);
2499 if (skb == NULL)
2500 goto out;
2501
2502 skb_put(skb, skb_len);
2503
2504 skb_queue_walk_safe(&dev->resp_q, tmp, t) {
2505 memcpy(skb->data + tmp_len, tmp->data, tmp->len);
2506 tmp_len += tmp->len;
2507 }
2508
2509 out:
2510 skb_queue_purge(&dev->resp_q);
2511
2512 return skb;
2513 }
2514
pn533_data_exchange_complete(struct pn533 * dev,void * _arg,struct sk_buff * resp)2515 static int pn533_data_exchange_complete(struct pn533 *dev, void *_arg,
2516 struct sk_buff *resp)
2517 {
2518 struct pn533_data_exchange_arg *arg = _arg;
2519 struct sk_buff *skb;
2520 int rc = 0;
2521 u8 status, ret, mi;
2522
2523 dev_dbg(&dev->interface->dev, "%s\n", __func__);
2524
2525 if (IS_ERR(resp)) {
2526 rc = PTR_ERR(resp);
2527 goto _error;
2528 }
2529
2530 status = resp->data[0];
2531 ret = status & PN533_CMD_RET_MASK;
2532 mi = status & PN533_CMD_MI_MASK;
2533
2534 skb_pull(resp, sizeof(status));
2535
2536 if (ret != PN533_CMD_RET_SUCCESS) {
2537 nfc_err(&dev->interface->dev,
2538 "Exchanging data failed (error 0x%x)\n", ret);
2539 rc = -EIO;
2540 goto error;
2541 }
2542
2543 skb_queue_tail(&dev->resp_q, resp);
2544
2545 if (mi) {
2546 dev->cmd_complete_mi_arg = arg;
2547 queue_work(dev->wq, &dev->mi_rx_work);
2548 return -EINPROGRESS;
2549 }
2550
2551 /* Prepare for the next round */
2552 if (skb_queue_len(&dev->fragment_skb) > 0) {
2553 dev->cmd_complete_dep_arg = arg;
2554 queue_work(dev->wq, &dev->mi_tx_work);
2555
2556 return -EINPROGRESS;
2557 }
2558
2559 skb = pn533_build_response(dev);
2560 if (!skb) {
2561 rc = -ENOMEM;
2562 goto error;
2563 }
2564
2565 arg->cb(arg->cb_context, skb, 0);
2566 kfree(arg);
2567 return 0;
2568
2569 error:
2570 dev_kfree_skb(resp);
2571 _error:
2572 skb_queue_purge(&dev->resp_q);
2573 arg->cb(arg->cb_context, NULL, rc);
2574 kfree(arg);
2575 return rc;
2576 }
2577
2578 /* Split the Tx skb into small chunks */
pn533_fill_fragment_skbs(struct pn533 * dev,struct sk_buff * skb)2579 static int pn533_fill_fragment_skbs(struct pn533 *dev, struct sk_buff *skb)
2580 {
2581 struct sk_buff *frag;
2582 int frag_size;
2583
2584 do {
2585 /* Remaining size */
2586 if (skb->len > PN533_CMD_DATAFRAME_MAXLEN)
2587 frag_size = PN533_CMD_DATAFRAME_MAXLEN;
2588 else
2589 frag_size = skb->len;
2590
2591 /* Allocate and reserve */
2592 frag = pn533_alloc_skb(dev, frag_size);
2593 if (!frag) {
2594 skb_queue_purge(&dev->fragment_skb);
2595 return -ENOMEM;
2596 }
2597
2598 if (!dev->tgt_mode) {
2599 /* Reserve the TG/MI byte */
2600 skb_reserve(frag, 1);
2601
2602 /* MI + TG */
2603 if (frag_size == PN533_CMD_DATAFRAME_MAXLEN)
2604 *skb_push(frag, sizeof(u8)) =
2605 (PN533_CMD_MI_MASK | 1);
2606 else
2607 *skb_push(frag, sizeof(u8)) = 1; /* TG */
2608 }
2609
2610 memcpy(skb_put(frag, frag_size), skb->data, frag_size);
2611
2612 /* Reduce the size of incoming buffer */
2613 skb_pull(skb, frag_size);
2614
2615 /* Add this to skb_queue */
2616 skb_queue_tail(&dev->fragment_skb, frag);
2617
2618 } while (skb->len > 0);
2619
2620 dev_kfree_skb(skb);
2621
2622 return skb_queue_len(&dev->fragment_skb);
2623 }
2624
pn533_transceive(struct nfc_dev * nfc_dev,struct nfc_target * target,struct sk_buff * skb,data_exchange_cb_t cb,void * cb_context)2625 static int pn533_transceive(struct nfc_dev *nfc_dev,
2626 struct nfc_target *target, struct sk_buff *skb,
2627 data_exchange_cb_t cb, void *cb_context)
2628 {
2629 struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2630 struct pn533_data_exchange_arg *arg = NULL;
2631 int rc;
2632
2633 dev_dbg(&dev->interface->dev, "%s\n", __func__);
2634
2635 if (!dev->tgt_active_prot) {
2636 nfc_err(&dev->interface->dev,
2637 "Can't exchange data if there is no active target\n");
2638 rc = -EINVAL;
2639 goto error;
2640 }
2641
2642 arg = kmalloc(sizeof(*arg), GFP_KERNEL);
2643 if (!arg) {
2644 rc = -ENOMEM;
2645 goto error;
2646 }
2647
2648 arg->cb = cb;
2649 arg->cb_context = cb_context;
2650
2651 switch (dev->device_type) {
2652 case PN533_DEVICE_PASORI:
2653 if (dev->tgt_active_prot == NFC_PROTO_FELICA) {
2654 rc = pn533_send_data_async(dev, PN533_CMD_IN_COMM_THRU,
2655 skb,
2656 pn533_data_exchange_complete,
2657 arg);
2658
2659 break;
2660 }
2661 default:
2662 /* jumbo frame ? */
2663 if (skb->len > PN533_CMD_DATAEXCH_DATA_MAXLEN) {
2664 rc = pn533_fill_fragment_skbs(dev, skb);
2665 if (rc < 0)
2666 goto error;
2667
2668 skb = skb_dequeue(&dev->fragment_skb);
2669 if (!skb) {
2670 rc = -EIO;
2671 goto error;
2672 }
2673 } else {
2674 *skb_push(skb, sizeof(u8)) = 1; /* TG */
2675 }
2676
2677 rc = pn533_send_data_async(dev, PN533_CMD_IN_DATA_EXCHANGE,
2678 skb, pn533_data_exchange_complete,
2679 arg);
2680
2681 break;
2682 }
2683
2684 if (rc < 0) /* rc from send_async */
2685 goto error;
2686
2687 return 0;
2688
2689 error:
2690 kfree(arg);
2691 dev_kfree_skb(skb);
2692 return rc;
2693 }
2694
pn533_tm_send_complete(struct pn533 * dev,void * arg,struct sk_buff * resp)2695 static int pn533_tm_send_complete(struct pn533 *dev, void *arg,
2696 struct sk_buff *resp)
2697 {
2698 u8 status;
2699
2700 dev_dbg(&dev->interface->dev, "%s\n", __func__);
2701
2702 if (IS_ERR(resp))
2703 return PTR_ERR(resp);
2704
2705 status = resp->data[0];
2706
2707 /* Prepare for the next round */
2708 if (skb_queue_len(&dev->fragment_skb) > 0) {
2709 queue_work(dev->wq, &dev->mi_tm_tx_work);
2710 return -EINPROGRESS;
2711 }
2712 dev_kfree_skb(resp);
2713
2714 if (status != 0) {
2715 nfc_tm_deactivated(dev->nfc_dev);
2716
2717 dev->tgt_mode = 0;
2718
2719 return 0;
2720 }
2721
2722 queue_work(dev->wq, &dev->tg_work);
2723
2724 return 0;
2725 }
2726
pn533_tm_send(struct nfc_dev * nfc_dev,struct sk_buff * skb)2727 static int pn533_tm_send(struct nfc_dev *nfc_dev, struct sk_buff *skb)
2728 {
2729 struct pn533 *dev = nfc_get_drvdata(nfc_dev);
2730 int rc;
2731
2732 dev_dbg(&dev->interface->dev, "%s\n", __func__);
2733
2734 /* let's split in multiple chunks if size's too big */
2735 if (skb->len > PN533_CMD_DATAEXCH_DATA_MAXLEN) {
2736 rc = pn533_fill_fragment_skbs(dev, skb);
2737 if (rc < 0)
2738 goto error;
2739
2740 /* get the first skb */
2741 skb = skb_dequeue(&dev->fragment_skb);
2742 if (!skb) {
2743 rc = -EIO;
2744 goto error;
2745 }
2746
2747 rc = pn533_send_data_async(dev, PN533_CMD_TG_SET_META_DATA, skb,
2748 pn533_tm_send_complete, NULL);
2749 } else {
2750 /* Send th skb */
2751 rc = pn533_send_data_async(dev, PN533_CMD_TG_SET_DATA, skb,
2752 pn533_tm_send_complete, NULL);
2753 }
2754
2755 error:
2756 if (rc < 0) {
2757 dev_kfree_skb(skb);
2758 skb_queue_purge(&dev->fragment_skb);
2759 }
2760
2761 return rc;
2762 }
2763
pn533_wq_mi_recv(struct work_struct * work)2764 static void pn533_wq_mi_recv(struct work_struct *work)
2765 {
2766 struct pn533 *dev = container_of(work, struct pn533, mi_rx_work);
2767 struct sk_buff *skb;
2768 int rc;
2769
2770 dev_dbg(&dev->interface->dev, "%s\n", __func__);
2771
2772 skb = pn533_alloc_skb(dev, PN533_CMD_DATAEXCH_HEAD_LEN);
2773 if (!skb)
2774 goto error;
2775
2776 switch (dev->device_type) {
2777 case PN533_DEVICE_PASORI:
2778 if (dev->tgt_active_prot == NFC_PROTO_FELICA) {
2779 rc = pn533_send_cmd_direct_async(dev,
2780 PN533_CMD_IN_COMM_THRU,
2781 skb,
2782 pn533_data_exchange_complete,
2783 dev->cmd_complete_mi_arg);
2784
2785 break;
2786 }
2787 default:
2788 *skb_put(skb, sizeof(u8)) = 1; /*TG*/
2789
2790 rc = pn533_send_cmd_direct_async(dev,
2791 PN533_CMD_IN_DATA_EXCHANGE,
2792 skb,
2793 pn533_data_exchange_complete,
2794 dev->cmd_complete_mi_arg);
2795
2796 break;
2797 }
2798
2799 if (rc == 0) /* success */
2800 return;
2801
2802 nfc_err(&dev->interface->dev,
2803 "Error %d when trying to perform data_exchange\n", rc);
2804
2805 dev_kfree_skb(skb);
2806 kfree(dev->cmd_complete_mi_arg);
2807
2808 error:
2809 pn533_send_ack(dev, GFP_KERNEL);
2810 queue_work(dev->wq, &dev->cmd_work);
2811 }
2812
pn533_wq_mi_send(struct work_struct * work)2813 static void pn533_wq_mi_send(struct work_struct *work)
2814 {
2815 struct pn533 *dev = container_of(work, struct pn533, mi_tx_work);
2816 struct sk_buff *skb;
2817 int rc;
2818
2819 dev_dbg(&dev->interface->dev, "%s\n", __func__);
2820
2821 /* Grab the first skb in the queue */
2822 skb = skb_dequeue(&dev->fragment_skb);
2823
2824 if (skb == NULL) { /* No more data */
2825 /* Reset the queue for future use */
2826 skb_queue_head_init(&dev->fragment_skb);
2827 goto error;
2828 }
2829
2830 switch (dev->device_type) {
2831 case PN533_DEVICE_PASORI:
2832 if (dev->tgt_active_prot != NFC_PROTO_FELICA) {
2833 rc = -EIO;
2834 break;
2835 }
2836
2837 rc = pn533_send_cmd_direct_async(dev, PN533_CMD_IN_COMM_THRU,
2838 skb,
2839 pn533_data_exchange_complete,
2840 dev->cmd_complete_dep_arg);
2841
2842 break;
2843
2844 default:
2845 /* Still some fragments? */
2846 rc = pn533_send_cmd_direct_async(dev,PN533_CMD_IN_DATA_EXCHANGE,
2847 skb,
2848 pn533_data_exchange_complete,
2849 dev->cmd_complete_dep_arg);
2850
2851 break;
2852 }
2853
2854 if (rc == 0) /* success */
2855 return;
2856
2857 nfc_err(&dev->interface->dev,
2858 "Error %d when trying to perform data_exchange\n", rc);
2859
2860 dev_kfree_skb(skb);
2861 kfree(dev->cmd_complete_dep_arg);
2862
2863 error:
2864 pn533_send_ack(dev, GFP_KERNEL);
2865 queue_work(dev->wq, &dev->cmd_work);
2866 }
2867
pn533_set_configuration(struct pn533 * dev,u8 cfgitem,u8 * cfgdata,u8 cfgdata_len)2868 static int pn533_set_configuration(struct pn533 *dev, u8 cfgitem, u8 *cfgdata,
2869 u8 cfgdata_len)
2870 {
2871 struct sk_buff *skb;
2872 struct sk_buff *resp;
2873 int skb_len;
2874
2875 dev_dbg(&dev->interface->dev, "%s\n", __func__);
2876
2877 skb_len = sizeof(cfgitem) + cfgdata_len; /* cfgitem + cfgdata */
2878
2879 skb = pn533_alloc_skb(dev, skb_len);
2880 if (!skb)
2881 return -ENOMEM;
2882
2883 *skb_put(skb, sizeof(cfgitem)) = cfgitem;
2884 memcpy(skb_put(skb, cfgdata_len), cfgdata, cfgdata_len);
2885
2886 resp = pn533_send_cmd_sync(dev, PN533_CMD_RF_CONFIGURATION, skb);
2887 if (IS_ERR(resp))
2888 return PTR_ERR(resp);
2889
2890 dev_kfree_skb(resp);
2891 return 0;
2892 }
2893
pn533_get_firmware_version(struct pn533 * dev,struct pn533_fw_version * fv)2894 static int pn533_get_firmware_version(struct pn533 *dev,
2895 struct pn533_fw_version *fv)
2896 {
2897 struct sk_buff *skb;
2898 struct sk_buff *resp;
2899
2900 skb = pn533_alloc_skb(dev, 0);
2901 if (!skb)
2902 return -ENOMEM;
2903
2904 resp = pn533_send_cmd_sync(dev, PN533_CMD_GET_FIRMWARE_VERSION, skb);
2905 if (IS_ERR(resp))
2906 return PTR_ERR(resp);
2907
2908 fv->ic = resp->data[0];
2909 fv->ver = resp->data[1];
2910 fv->rev = resp->data[2];
2911 fv->support = resp->data[3];
2912
2913 dev_kfree_skb(resp);
2914 return 0;
2915 }
2916
pn533_pasori_fw_reset(struct pn533 * dev)2917 static int pn533_pasori_fw_reset(struct pn533 *dev)
2918 {
2919 struct sk_buff *skb;
2920 struct sk_buff *resp;
2921
2922 dev_dbg(&dev->interface->dev, "%s\n", __func__);
2923
2924 skb = pn533_alloc_skb(dev, sizeof(u8));
2925 if (!skb)
2926 return -ENOMEM;
2927
2928 *skb_put(skb, sizeof(u8)) = 0x1;
2929
2930 resp = pn533_send_cmd_sync(dev, 0x18, skb);
2931 if (IS_ERR(resp))
2932 return PTR_ERR(resp);
2933
2934 dev_kfree_skb(resp);
2935
2936 return 0;
2937 }
2938
2939 struct pn533_acr122_poweron_rdr_arg {
2940 int rc;
2941 struct completion done;
2942 };
2943
pn533_acr122_poweron_rdr_resp(struct urb * urb)2944 static void pn533_acr122_poweron_rdr_resp(struct urb *urb)
2945 {
2946 struct pn533_acr122_poweron_rdr_arg *arg = urb->context;
2947
2948 dev_dbg(&urb->dev->dev, "%s\n", __func__);
2949
2950 print_hex_dump_debug("ACR122 RX: ", DUMP_PREFIX_NONE, 16, 1,
2951 urb->transfer_buffer, urb->transfer_buffer_length,
2952 false);
2953
2954 arg->rc = urb->status;
2955 complete(&arg->done);
2956 }
2957
pn533_acr122_poweron_rdr(struct pn533 * dev)2958 static int pn533_acr122_poweron_rdr(struct pn533 *dev)
2959 {
2960 /* Power on th reader (CCID cmd) */
2961 u8 cmd[10] = {PN533_ACR122_PC_TO_RDR_ICCPOWERON,
2962 0, 0, 0, 0, 0, 0, 3, 0, 0};
2963 u8 buf[255];
2964 int rc;
2965 void *cntx;
2966 struct pn533_acr122_poweron_rdr_arg arg;
2967
2968 dev_dbg(&dev->interface->dev, "%s\n", __func__);
2969
2970 init_completion(&arg.done);
2971 cntx = dev->in_urb->context; /* backup context */
2972
2973 dev->in_urb->transfer_buffer = buf;
2974 dev->in_urb->transfer_buffer_length = 255;
2975 dev->in_urb->complete = pn533_acr122_poweron_rdr_resp;
2976 dev->in_urb->context = &arg;
2977
2978 dev->out_urb->transfer_buffer = cmd;
2979 dev->out_urb->transfer_buffer_length = sizeof(cmd);
2980
2981 print_hex_dump_debug("ACR122 TX: ", DUMP_PREFIX_NONE, 16, 1,
2982 cmd, sizeof(cmd), false);
2983
2984 rc = usb_submit_urb(dev->out_urb, GFP_KERNEL);
2985 if (rc) {
2986 nfc_err(&dev->interface->dev,
2987 "Reader power on cmd error %d\n", rc);
2988 return rc;
2989 }
2990
2991 rc = usb_submit_urb(dev->in_urb, GFP_KERNEL);
2992 if (rc) {
2993 nfc_err(&dev->interface->dev,
2994 "Can't submit reader poweron cmd response %d\n", rc);
2995 return rc;
2996 }
2997
2998 wait_for_completion(&arg.done);
2999 dev->in_urb->context = cntx; /* restore context */
3000
3001 return arg.rc;
3002 }
3003
pn533_rf_field(struct nfc_dev * nfc_dev,u8 rf)3004 static int pn533_rf_field(struct nfc_dev *nfc_dev, u8 rf)
3005 {
3006 struct pn533 *dev = nfc_get_drvdata(nfc_dev);
3007 u8 rf_field = !!rf;
3008 int rc;
3009
3010 rf_field |= PN533_CFGITEM_RF_FIELD_AUTO_RFCA;
3011
3012 rc = pn533_set_configuration(dev, PN533_CFGITEM_RF_FIELD,
3013 (u8 *)&rf_field, 1);
3014 if (rc) {
3015 nfc_err(&dev->interface->dev, "Error on setting RF field\n");
3016 return rc;
3017 }
3018
3019 return rc;
3020 }
3021
pn533_dev_up(struct nfc_dev * nfc_dev)3022 static int pn533_dev_up(struct nfc_dev *nfc_dev)
3023 {
3024 return pn533_rf_field(nfc_dev, 1);
3025 }
3026
pn533_dev_down(struct nfc_dev * nfc_dev)3027 static int pn533_dev_down(struct nfc_dev *nfc_dev)
3028 {
3029 return pn533_rf_field(nfc_dev, 0);
3030 }
3031
3032 static struct nfc_ops pn533_nfc_ops = {
3033 .dev_up = pn533_dev_up,
3034 .dev_down = pn533_dev_down,
3035 .dep_link_up = pn533_dep_link_up,
3036 .dep_link_down = pn533_dep_link_down,
3037 .start_poll = pn533_start_poll,
3038 .stop_poll = pn533_stop_poll,
3039 .activate_target = pn533_activate_target,
3040 .deactivate_target = pn533_deactivate_target,
3041 .im_transceive = pn533_transceive,
3042 .tm_send = pn533_tm_send,
3043 };
3044
pn533_setup(struct pn533 * dev)3045 static int pn533_setup(struct pn533 *dev)
3046 {
3047 struct pn533_config_max_retries max_retries;
3048 struct pn533_config_timing timing;
3049 u8 pasori_cfg[3] = {0x08, 0x01, 0x08};
3050 int rc;
3051
3052 switch (dev->device_type) {
3053 case PN533_DEVICE_STD:
3054 case PN533_DEVICE_PASORI:
3055 case PN533_DEVICE_ACR122U:
3056 max_retries.mx_rty_atr = 0x2;
3057 max_retries.mx_rty_psl = 0x1;
3058 max_retries.mx_rty_passive_act =
3059 PN533_CONFIG_MAX_RETRIES_NO_RETRY;
3060
3061 timing.rfu = PN533_CONFIG_TIMING_102;
3062 timing.atr_res_timeout = PN533_CONFIG_TIMING_102;
3063 timing.dep_timeout = PN533_CONFIG_TIMING_204;
3064
3065 break;
3066
3067 default:
3068 nfc_err(&dev->interface->dev, "Unknown device type %d\n",
3069 dev->device_type);
3070 return -EINVAL;
3071 }
3072
3073 rc = pn533_set_configuration(dev, PN533_CFGITEM_MAX_RETRIES,
3074 (u8 *)&max_retries, sizeof(max_retries));
3075 if (rc) {
3076 nfc_err(&dev->interface->dev,
3077 "Error on setting MAX_RETRIES config\n");
3078 return rc;
3079 }
3080
3081
3082 rc = pn533_set_configuration(dev, PN533_CFGITEM_TIMING,
3083 (u8 *)&timing, sizeof(timing));
3084 if (rc) {
3085 nfc_err(&dev->interface->dev, "Error on setting RF timings\n");
3086 return rc;
3087 }
3088
3089 switch (dev->device_type) {
3090 case PN533_DEVICE_STD:
3091 break;
3092
3093 case PN533_DEVICE_PASORI:
3094 pn533_pasori_fw_reset(dev);
3095
3096 rc = pn533_set_configuration(dev, PN533_CFGITEM_PASORI,
3097 pasori_cfg, 3);
3098 if (rc) {
3099 nfc_err(&dev->interface->dev,
3100 "Error while settings PASORI config\n");
3101 return rc;
3102 }
3103
3104 pn533_pasori_fw_reset(dev);
3105
3106 break;
3107 }
3108
3109 return 0;
3110 }
3111
pn533_probe(struct usb_interface * interface,const struct usb_device_id * id)3112 static int pn533_probe(struct usb_interface *interface,
3113 const struct usb_device_id *id)
3114 {
3115 struct pn533_fw_version fw_ver;
3116 struct pn533 *dev;
3117 struct usb_host_interface *iface_desc;
3118 struct usb_endpoint_descriptor *endpoint;
3119 int in_endpoint = 0;
3120 int out_endpoint = 0;
3121 int rc = -ENOMEM;
3122 int i;
3123 u32 protocols;
3124
3125 dev = kzalloc(sizeof(*dev), GFP_KERNEL);
3126 if (!dev)
3127 return -ENOMEM;
3128
3129 dev->udev = usb_get_dev(interface_to_usbdev(interface));
3130 dev->interface = interface;
3131 mutex_init(&dev->cmd_lock);
3132
3133 iface_desc = interface->cur_altsetting;
3134 for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
3135 endpoint = &iface_desc->endpoint[i].desc;
3136
3137 if (!in_endpoint && usb_endpoint_is_bulk_in(endpoint))
3138 in_endpoint = endpoint->bEndpointAddress;
3139
3140 if (!out_endpoint && usb_endpoint_is_bulk_out(endpoint))
3141 out_endpoint = endpoint->bEndpointAddress;
3142 }
3143
3144 if (!in_endpoint || !out_endpoint) {
3145 nfc_err(&interface->dev,
3146 "Could not find bulk-in or bulk-out endpoint\n");
3147 rc = -ENODEV;
3148 goto error;
3149 }
3150
3151 dev->in_urb = usb_alloc_urb(0, GFP_KERNEL);
3152 dev->out_urb = usb_alloc_urb(0, GFP_KERNEL);
3153
3154 if (!dev->in_urb || !dev->out_urb)
3155 goto error;
3156
3157 usb_fill_bulk_urb(dev->in_urb, dev->udev,
3158 usb_rcvbulkpipe(dev->udev, in_endpoint),
3159 NULL, 0, NULL, dev);
3160 usb_fill_bulk_urb(dev->out_urb, dev->udev,
3161 usb_sndbulkpipe(dev->udev, out_endpoint),
3162 NULL, 0, pn533_send_complete, dev);
3163
3164 INIT_WORK(&dev->cmd_work, pn533_wq_cmd);
3165 INIT_WORK(&dev->cmd_complete_work, pn533_wq_cmd_complete);
3166 INIT_WORK(&dev->mi_rx_work, pn533_wq_mi_recv);
3167 INIT_WORK(&dev->mi_tx_work, pn533_wq_mi_send);
3168 INIT_WORK(&dev->tg_work, pn533_wq_tg_get_data);
3169 INIT_WORK(&dev->mi_tm_rx_work, pn533_wq_tm_mi_recv);
3170 INIT_WORK(&dev->mi_tm_tx_work, pn533_wq_tm_mi_send);
3171 INIT_DELAYED_WORK(&dev->poll_work, pn533_wq_poll);
3172 INIT_WORK(&dev->rf_work, pn533_wq_rf);
3173 dev->wq = alloc_ordered_workqueue("pn533", 0);
3174 if (dev->wq == NULL)
3175 goto error;
3176
3177 init_timer(&dev->listen_timer);
3178 dev->listen_timer.data = (unsigned long) dev;
3179 dev->listen_timer.function = pn533_listen_mode_timer;
3180
3181 skb_queue_head_init(&dev->resp_q);
3182 skb_queue_head_init(&dev->fragment_skb);
3183
3184 INIT_LIST_HEAD(&dev->cmd_queue);
3185
3186 usb_set_intfdata(interface, dev);
3187
3188 dev->ops = &pn533_std_frame_ops;
3189
3190 dev->protocol_type = PN533_PROTO_REQ_ACK_RESP;
3191 dev->device_type = id->driver_info;
3192 switch (dev->device_type) {
3193 case PN533_DEVICE_STD:
3194 protocols = PN533_ALL_PROTOCOLS;
3195 break;
3196
3197 case PN533_DEVICE_PASORI:
3198 protocols = PN533_NO_TYPE_B_PROTOCOLS;
3199 break;
3200
3201 case PN533_DEVICE_ACR122U:
3202 protocols = PN533_NO_TYPE_B_PROTOCOLS;
3203 dev->ops = &pn533_acr122_frame_ops;
3204 dev->protocol_type = PN533_PROTO_REQ_RESP,
3205
3206 rc = pn533_acr122_poweron_rdr(dev);
3207 if (rc < 0) {
3208 nfc_err(&dev->interface->dev,
3209 "Couldn't poweron the reader (error %d)\n", rc);
3210 goto destroy_wq;
3211 }
3212 break;
3213
3214 default:
3215 nfc_err(&dev->interface->dev, "Unknown device type %d\n",
3216 dev->device_type);
3217 rc = -EINVAL;
3218 goto destroy_wq;
3219 }
3220
3221 memset(&fw_ver, 0, sizeof(fw_ver));
3222 rc = pn533_get_firmware_version(dev, &fw_ver);
3223 if (rc < 0)
3224 goto destroy_wq;
3225
3226 nfc_info(&dev->interface->dev,
3227 "NXP PN5%02X firmware ver %d.%d now attached\n",
3228 fw_ver.ic, fw_ver.ver, fw_ver.rev);
3229
3230
3231 dev->nfc_dev = nfc_allocate_device(&pn533_nfc_ops, protocols,
3232 dev->ops->tx_header_len +
3233 PN533_CMD_DATAEXCH_HEAD_LEN,
3234 dev->ops->tx_tail_len);
3235 if (!dev->nfc_dev) {
3236 rc = -ENOMEM;
3237 goto destroy_wq;
3238 }
3239
3240 nfc_set_parent_dev(dev->nfc_dev, &interface->dev);
3241 nfc_set_drvdata(dev->nfc_dev, dev);
3242
3243 rc = nfc_register_device(dev->nfc_dev);
3244 if (rc)
3245 goto free_nfc_dev;
3246
3247 rc = pn533_setup(dev);
3248 if (rc)
3249 goto unregister_nfc_dev;
3250
3251 return 0;
3252
3253 unregister_nfc_dev:
3254 nfc_unregister_device(dev->nfc_dev);
3255
3256 free_nfc_dev:
3257 nfc_free_device(dev->nfc_dev);
3258
3259 destroy_wq:
3260 destroy_workqueue(dev->wq);
3261 error:
3262 usb_free_urb(dev->in_urb);
3263 usb_free_urb(dev->out_urb);
3264 usb_put_dev(dev->udev);
3265 kfree(dev);
3266 return rc;
3267 }
3268
pn533_disconnect(struct usb_interface * interface)3269 static void pn533_disconnect(struct usb_interface *interface)
3270 {
3271 struct pn533 *dev;
3272 struct pn533_cmd *cmd, *n;
3273
3274 dev = usb_get_intfdata(interface);
3275 usb_set_intfdata(interface, NULL);
3276
3277 nfc_unregister_device(dev->nfc_dev);
3278 nfc_free_device(dev->nfc_dev);
3279
3280 usb_kill_urb(dev->in_urb);
3281 usb_kill_urb(dev->out_urb);
3282
3283 flush_delayed_work(&dev->poll_work);
3284 destroy_workqueue(dev->wq);
3285
3286 skb_queue_purge(&dev->resp_q);
3287
3288 del_timer(&dev->listen_timer);
3289
3290 list_for_each_entry_safe(cmd, n, &dev->cmd_queue, queue) {
3291 list_del(&cmd->queue);
3292 kfree(cmd);
3293 }
3294
3295 usb_free_urb(dev->in_urb);
3296 usb_free_urb(dev->out_urb);
3297 kfree(dev);
3298
3299 nfc_info(&interface->dev, "NXP PN533 NFC device disconnected\n");
3300 }
3301
3302 static struct usb_driver pn533_driver = {
3303 .name = "pn533",
3304 .probe = pn533_probe,
3305 .disconnect = pn533_disconnect,
3306 .id_table = pn533_table,
3307 };
3308
3309 module_usb_driver(pn533_driver);
3310
3311 MODULE_AUTHOR("Lauro Ramos Venancio <lauro.venancio@openbossa.org>");
3312 MODULE_AUTHOR("Aloisio Almeida Jr <aloisio.almeida@openbossa.org>");
3313 MODULE_AUTHOR("Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>");
3314 MODULE_DESCRIPTION("PN533 usb driver ver " VERSION);
3315 MODULE_VERSION(VERSION);
3316 MODULE_LICENSE("GPL");
3317