Some devices turn radio on whenever they're asked to start a poll.
To prevent that from happening, we just don't call into the driver
start_poll hook when the NFC device is down.
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

Add missing usb_put_dev on failure path in pn533_probe().

Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Marina Makienko <makienko@ispras.ru>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

According to the LLCP specs, we must terminate the LLCP link when receiving
a DISC with both ssap and dsap set to 0.
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

local_cleanup is always called with device set to false as it means the
local LLCP is going away. So no need to pass this switch as an argument.
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

When the MAC goes down, connected and connection less sockets should be
notified, but raw sockets should be kept alive.
They will get notified only when the physical devices goes away.
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

Major features added in 0.2 version:

* frame ops added to support wider set of devices
* support of ACS ACR122U
Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

pn533_abort_cmd() aborts last command sent to the controller
and cancels already requested urb.

As ACR122U does not support any mechanism (as ACK for standard
PN533) which aborts last command this cannot be issued for this
device. Otherwise, acr122u will behave in an unstable way.
Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

ACS ACR122U is an USB NFC reader, PC/SC and CCID compilant, based
on NXP PN532 chip.

Internally, it's build of MCU, PN532 and an antenna. MCU makes the
device CCID and PC/SC compilant and provide USB connection.

In this achitecture, a host cannot talk directly to PN532 and must
rely on MCU. Luckily, MCU exposes pseud-APDU through PC/SC Escape
mechanism which let the host to transmit standard PN532 commands
directly to PN532 chip with some limitations.

The frame roughly looks like:

    CCID header    |          APDU header           |    PN532 header
(pc_to_rdr_escape) |  (pseudo apdu Direct Tramsmit) | (len, TFI, cmd, params)

Accordign to limitations, ACR122U does't provide any mechanism to
abort last issued command.
Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

As not all devices require ACK confirmation of every request sent to the
controller, differentiate two protocol types.

First one, request-ack-response and the second one request-response type.
Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

Rename 'wq_in_error' field to more relevant 'status'
and move it to cmd context struct.
Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

Reorder code to avoid functions declaration.
Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

In all cases (send_cmd_async, send_data_async and send_sync)
pn533_send_async_complete() handles all responses internally,
so there is no need to pass this as a callback.

Cmd context is passed to __pn533_send_frame_async in all the
cases as well. It's already kept in struct pn533 which is
available all the time the device is attached. So we can make
use of it instead.

Therefore, cmd_complete and cmd_complete_arg are no needed any more.
Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

We must free 'cmd_complete_mi_arg' and not 'cmd_complete_arg'
when getting send error handling fragmented response.
Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

'cmd->code' looks better then 'cmd->cmd_code'
Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

Keep cmd context in pn533 struct instead of only cmd code.
The context already includes cmd_code.
Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

Use struct pn533_cmd instead of pn533_send_async_complete_arg
to track the context of the issued cmd.

This way pn533_send_async_complete_arg struct is no needed
anymore. Just move issuer complete callback to pn533_cmd struct.
Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

In case of error from __pn533_send_frame_async() while sending
next cmd from the queue (cmd_wq), cmd->req, cmd->resp and
cmd->arg pointers won't be freed.
Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

Define explicitely it is Pasori specific reset command.
Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

Remove duplicated authors info from the header as well.
Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

Depends on timing division by zero can happen when user stops
polling.

pn533_stop_poll() resets modulation counter on stop_poll, but
meanwhile we get response for last poll request and try, despite
of stop poll request, to schedule next modulation for polling.

Log message:
[345.922515] pn533 1-1.3:1.0: pn533_stop_poll
[345.928314] pn533 1-1.3:1.0: pn533_send_ack
[345.932769] pn533 1-1.3:1.0: Received a frame.
[345.937438] PN533 RX: 00 00 ff 03 fd d5 4b 00 e0 00
[345.942840] pn533 1-1.3:1.0: pn533_poll_complete
[345.947753] pn533 1-1.3:1.0: pn533_start_poll_complete
[345.953186] Division by zero in kernel.
[345.957244] [<c001b38c>] (unwind_backtrace+0x0/0xf0)
[345.965698] [<c0260e78>] (Ldiv0+0x8/0x10)
[345.974060] [<c0260e60>] (__aeabi_idivmod+0x8/0x18)
[345.983978] [<c02e0064>] (pn533_poll_complete+0x3c0/0x500)
[345.994903] [<c02df690>] (pn533_send_async_complete+0x7c/0xc0)
[346.005828] [<c02e028c>] (pn533_wq_cmd_complete+0x1c/0x34)
[346.016113] [<c005d134>] (process_one_work+0x1ac/0x57c)
[346.025848] [<c005d85c>] (worker_thread+0x168/0x42c)
[346.034576] [<c00620c0>] (kthread+0xa4/0xb0)
Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

For better debugging as the codes are defined in hex in the spec.
Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

Useful for LLCP validation tests.
Signed-off-by: Thierry Escande <thierry.escande@linux.intel.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

This resets remote parameters in both local and socket llcp structures when the
link goes down. That way, nfc_llcp_getsockopt won't return values corresponding
to the previous link parameters.
Signed-off-by: Thierry Escande <thierry.escande@linux.intel.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

If remote_miu value is not set in the socket (i.e. connection-less socket) the
value stored in the local is used.
Signed-off-by: Thierry Escande <thierry.escande@linux.intel.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

This adds support for AGF PDUs. For each PDU contained in the AGF, a new sk_buff
is allocated and dispatched to its corresponding handler.
Signed-off-by: Thierry Escande <thierry.escande@linux.intel.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

LLCP Validation test #2 (Connection-less information transfer) send a
service data unit of zero octets length. This is now handled correctly.
Signed-off-by: Olivier Guiter <olivier.guiter@linux.intel.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

If a socket option has not been set by the user, fall back to the LLCP
local ones.
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

The MIUX must be transmitted in big endian and as such we have to convert
it properly.
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

Those can be very verbose and we only want them when debugging pn533.
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

There is better to use kstrto* instead of simple_strtoul. In this case it
applies a bit stricter rules for input as well.
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

In routine _rtl8188e_read_power_value_fromprom(), there are loops initializing
index_cck_base and index_bw40_base from the PROM. As the result of a typo, the
second loop is ended one element too soon.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Inside one FIFO slot queue, EDMA chipsets have the same link pointer
re-read race condition as older chipsets, so the same buffer holding
logic needs to be used in order to avoid use-after-free bugs.
Unlike on older chips, it can be skipped for the end of the queue.
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

If AR_CRCErr, AR_PHYErr, AR_DecryptCRCErr or AR_MichaelErr is indicated
in the rx status word, but AR_RxFrameOK is also set, the descriptor
contents are typically invalid. This can show up as a warning about
invalid MCS rates in a frame. Even with those checks in place, a
descriptor with invalid MCS rates can still sometimes make it through to
the driver (mostly on older hardware like AR91xx).

Detect such errors in the last descriptor of a frame and discard the
whole frame if present.
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

As the comment in ath_get_next_rx_buf indicates, if a descriptor with
the done bit set follows one with the done bit cleared, both descriptors
should be discarded, however the driver is not doing that yet.

To fix this, use the rs->rs_more flag as an indicator that the following
frame should be discarded. This also helps with the split buffer case:
if the first part of the frame is discarded, the following parts need to
be discarded as well, since they contain no valid header or usable data.
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Instead of leaving the buffer without skb and breaking out of the loop
(which could leak the rx buffer), use the common error path.
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

It is equivalent to ieee80211_hdrlen
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Banks 0-3,7 are neither modified at run time, nor SREV dependent.
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>