When pn533_recv_frame is called from within abort_command
context the current  dev->cmd is not guaranteed to be set.

Additionally on receiving an error status we can omit frame
checking and simply schedule the workqueue.
Signed-off-by: NMichael Thalmeier <michael.thalmeier@hale.at>
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

We need to reset the poll modulation list before calling
nfc_targets_found because otherwise userspace could run
before the modulation list is cleared and then get a "Cannot
activate target while polling" error upon calling activate_target.
Signed-off-by: NMichael Thalmeier <michael.thalmeier@hale.at>
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

Correctly call nfc_set_parent_dev before nfc_register_device.
Otherwise the driver will OOPS when being removed.
Signed-off-by: NMichael Thalmeier <michael.thalmeier@hale.at>
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

This adds the I2C phy interface for the pn533 driver.
This way the driver can be used to interact with I2C
connected pn532 devices.
Signed-off-by: NMichael Thalmeier <michael.thalmeier@hale.at>
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

The driver now has all core stuff isolated in one file, and all
the hardware link specifics in another. Writing a pn533 driver
on top of another hardware link is now just a matter of adding a
new file for that new hardware specifics.

The first user of this separation will be the i2c based pn532
driver that reuses pn533 core implementation on top of an i2c
layer.
Signed-off-by: NMichael Thalmeier <michael.thalmeier@hale.at>
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

A deadlock can occur when the NFC raw socket is closed while
the driver is processing a command.

Following is the call graph of the affected situation:

send data via raw_sock:
-------------
rawsock_tx_work
  sock_hold => socket refcnt++
  nfc_data_exchange => cb = rawsock_data_exchange_complete

    ops->im_transceive = pn533_transceive => arg->cb = db
                               = rawsock_data_exchange_complete

      pn533_send_data_async => cb = pn533_data_exchange_complete

        __pn533_send_async => cmd->complete_cb = cb
                              = pn533_data_exchange_complete

          if_ops->send_frame_async

response:
--------
pn533_recv_response
  queue_work(priv->wq, &priv->cmd_complete_work)

pn533_wq_cmd_complete

  pn533_send_async_complete

    cmd->complete_cb() = pn533_data_exchange_complete()

      arg->cb() = rawsock_data_exchange_complete()

        sock_put => socket refcnt-- => If the corresponding
                    socket gets closed in the meantime socket
                    will be destructed

          sk_free

            __sk_free

              sk->sk_destruct = rawsock_destruct

                nfc_deactivate_target

                  ops->deactivate_target = pn533_deactivate_target

                    pn533_send_cmd_sync

                      pn533_send_cmd_async

                        __pn533_send_async

                          list_add_tail(&cmd->queue,&dev->cmd_queue)
                                  => add to command list because
                                     a command is currently
                                     processed

                        wait_for_completion
                                   => the workqueue thread waits
                                      here because it is the one
                                      processing the commands
                                         => deadlock

To fix the deadlock pn533_deactivate_target is changed to
issue the PN533_CMD_IN_RELEASE command in async mode. This
way nothing blocks and the release command is executed after
the current command.
Signed-off-by: NMichael Thalmeier <michael.thalmeier@hale.at>
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

Currently it is not possible to only poll for passive targets
with the pn533 driver. To change this ATR_REQ is only sent when
NFC_PROTO_NFC_DEP is explicitly requested in poll_protocols.
As most implementations (e.g. neard) poll for all protocols
that are reported to be supported by the adapter, this should
not have much of an effect on current implementations.
Signed-off-by: NMichael Thalmeier <michael.thalmeier@hale.at>
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

In order to manage in a better way the nci poll mode state machine,
add mode parameter to deactivate_target functions.
This way we can manage different target state.
mode parameter make sense only in nci core.
Signed-off-by: NChristophe Ricard <christophe-h.ricard@st.com>
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

Add missing terminating newlines to nfc_info and nfc_err
to avoid possible interleaving from other messages.

Miscellanea:

o typo fix of "unknonwn" in message
o remove unnecessary OOM messages as there's a generic dump_stack()
o realign arguments
Signed-off-by: NJoe Perches <joe@perches.com>
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

Return a negative error code on failure.

A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)

// <smpl>
@@
identifier ret; expression e1,e2;
@@
(
if (\(ret < 0\|ret != 0\))
 { ... return ret; }
|
ret = 0
)
... when != ret = e1
    when != &ret
*if(...)
{
  ... when != ret = e2
      when forall
 return ret;
}
// </smpl>
Signed-off-by: NJulia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

Signed-off-by: NAxel Lin <axel.lin@ingics.com>
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

Some ACR122 firmwares seem to send 0 length data frames. Before using
that length as a data index, we check that it's not 0. If it is we
report the frame as being invalid.
Reported-by: NArthur Taylor <arthur@advancedtelematic.com>
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

Several files refer to an old address for the Free Software Foundation
in the file header comment.  Resolve by replacing the address with
the URL <http://www.gnu.org/licenses/> so that we do not have to keep
updating the header comments anytime the address changes.

CC: linux-wireless@vger.kernel.org
CC: Lauro Ramos Venancio <lauro.venancio@openbossa.org>
CC: Aloisio Almeida Jr <aloisio.almeida@openbossa.org>
CC: Samuel Ortiz <sameo@linux.intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

In target mode, when we want to send frames larger than the max length
(PN533_CMD_DATAEXCH_DATA_MAXLEN), we have to split the frame in smaller
chunks and send them, using a specific working queue, with the TgSetMetaData
command. TgSetMetaData sets his own MI bit in the PFB.
The last chunk is sent using the TgSetData command.
Signed-off-by: NOlivier Guiter <olivier.guiter@linux.intel.com>
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

This code processes, for Target Mode, incoming fragmented frames.
If the MI bit is present, we start a working queue to grab and aggregate
all the parts (using TmGetData between each parts). On the last one, as
there's no more MI bit, we jump on the usual behavior.
Signed-off-by: NOlivier Guiter <olivier.guiter@linux.intel.com>
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

The fragmentation routine (used to split big frames) could be used in
target or initiator mode (TgSetMetaData vs InDataExchange), but the
MI/TG bytes are not needed in target mode (TgSetMetaData), so we
add a check on the mode
Signed-off-by: NOlivier Guiter <olivier.guiter@linux.intel.com>
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

Local symbols used only in this file are made static.
Signed-off-by: NSachin Kamat <sachin.kamat@linaro.org>
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

If we start the polling loop from a listening cycle, we need to start
the corresponding timer as well.
This bug showed up after commit dfccd0f5 as it was impossible to start
from a listening cycle before it.
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

In order to improve active devices detection, we send an ATR_REQ between
each passive detection cycle. Without this algorithm, Android 4.3 based
devices running the Broadcom stack are hardly detected.
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

Use standardized styles to minimize coding defects.

Always use nfc_<level> where feasible.
Add \n to formats where appropriate.
Typo "it it" correction.
Add #define pr_fmt where appropriate.
Remove function tracing logging messages.
Remove OOM messages.
Signed-off-by: NJoe Perches <joe@perches.com>
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

Use a more standard kernel style macro logging name.

Standardize the spacing of the "NFC: " prefix.
Add \n to uses, remove from macro.
Fix the defective uses that already had a \n.
Signed-off-by: NJoe Perches <joe@perches.com>
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

Use the generic kernel function instead of a home-grown
one that does the same thing.

Add \n to uses not at the macro.  Don't add \n where
the nfc_dev_dbg macro mistakenly had them already.
Signed-off-by: NJoe Perches <joe@perches.com>
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

By not always starting the polling loop from the same modulation, we
avoid entering infinite loops where devices exporting 2 targets (on 2
different modulations) get the same target activated over and over.
If this target is not readable (e.g. a wallet emulating a tag), we will
stay in an error loop for ever.
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

It seems that some pn533 firmwares go belly up when being asked to send
poll frames too frequently. Adding a 10ms delay between each of them
calm the chip down and prevent it from crashing.
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

The extended information frame are sent by PN533 to exchange frames
larger than 255 bytes. These extended frame are very close from the
standard ones except for the header size length. On each incoming
frame, we set the correct header length, and we do that only for the
standard pn533 chipsets as the acr122 does not seem to support extended
frames properly.
Signed-off-by: NOlivier Guiter <olivier.guiter@linux.intel.com>
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

On sending large frames (size > 262), we split it in multiple chunks and
send them asynchronously with MI bit.
Signed-off-by: NOlivier Guiter <olivier.guiter@linux.intel.com>
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

Extended Information frames are slightly different from standard frames
as they can (theorically) handle datas up tu 64kB. PN533 firmware only
supports packet data up to 265 (incl. TFI byte)
This kind of frame are used when the pn533 wants to exchange more than
255 bytes, and this patch handles the reception of such frames.
Signed-off-by: NOlivier Guiter <olivier.guiter@linux.intel.com>
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

The AUTO RFCA bit forbids the pn533 chipset to turn its radio on
whenever an external field is present.
Without this bit set, some devices seems to get over flood by the
pn533 rf field and thus become hardly detectable.
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

p2p devices must be able to support 424 kbps, so we should always select
that bitrate in initiator mode.
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

Some devices are getting confused when not being asked for their system
code with type F.
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

By turning the radio off after each failed polling try, we dramatically
improve the pn533 polling loop efficiency.
Without this fix, all Android phones running the broadcom NFC stack are
almost never detected.
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

By using the standard setting for the regular pn533 dongles, we no
longer wait for ever for an ATR_RES. Without this, a failing ATR_REQ
will put the hardware into a busy loop, constantly waiting for an
ATR_RES.
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

Instead of dumping ACR122 frames as errors, we use the print_hex_dump()
dynamic debug APIs.
We also print an accurate IC version, as the ACR122 is pn532 based.
Signed-off-by: NOlivier Guiter <olivier.guiter@linux.intel.com>
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

Supported secure elements are typically found during a discovery process
initiated when the NFC controller is up and running. For a given NFC
chipset there can be many configurations (embedded SE or not, with or
without a SIM card wired to the NFC controller SWP interface, etc...) and
thus driver code will never know before hand which SEs are available.
So we remove this field, it will be replaced by a real SE discovery
mechanism.
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

When using NFC-F we should copy the NFCID2 buffer that we got from
SENSF_RES through the ATR_REQ NFCID3 buffer. Not doing so violates
NFC Forum digital requirement #189.
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

LLCP validation requires TSN to be 0x03 for type F.
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

Fix to return -ENOMEM in the nfc device alloc error handling
case instead of 0, as done elsewhere in this function.
Signed-off-by: NWei Yongjun <yongjun_wei@trendmicro.com.cn>
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

Correct spelling typo in various part of drivers
Signed-off-by: NMasanari Iida <standby24x7@gmail.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

Add missing usb_put_dev on failure path in pn533_probe().

Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: NMarina Makienko <makienko@ispras.ru>
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>