1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Driver for NXP PN533 NFC Chip - USB transport layer
4 *
5 * Copyright (C) 2011 Instituto Nokia de Tecnologia
6 * Copyright (C) 2012-2013 Tieto Poland
7 */
8
9 #include <linux/device.h>
10 #include <linux/kernel.h>
11 #include <linux/module.h>
12 #include <linux/slab.h>
13 #include <linux/usb.h>
14 #include <linux/nfc.h>
15 #include <linux/netdevice.h>
16 #include <net/nfc/nfc.h>
17 #include "pn533.h"
18
19 #define VERSION "0.1"
20
21 #define PN533_VENDOR_ID 0x4CC
22 #define PN533_PRODUCT_ID 0x2533
23
24 #define SCM_VENDOR_ID 0x4E6
25 #define SCL3711_PRODUCT_ID 0x5591
26
27 #define SONY_VENDOR_ID 0x054c
28 #define PASORI_PRODUCT_ID 0x02e1
29
30 #define ACS_VENDOR_ID 0x072f
31 #define ACR122U_PRODUCT_ID 0x2200
32
33 static const struct usb_device_id pn533_usb_table[] = {
34 { USB_DEVICE(PN533_VENDOR_ID, PN533_PRODUCT_ID),
35 .driver_info = PN533_DEVICE_STD },
36 { USB_DEVICE(SCM_VENDOR_ID, SCL3711_PRODUCT_ID),
37 .driver_info = PN533_DEVICE_STD },
38 { USB_DEVICE(SONY_VENDOR_ID, PASORI_PRODUCT_ID),
39 .driver_info = PN533_DEVICE_PASORI },
40 { USB_DEVICE(ACS_VENDOR_ID, ACR122U_PRODUCT_ID),
41 .driver_info = PN533_DEVICE_ACR122U },
42 { }
43 };
44 MODULE_DEVICE_TABLE(usb, pn533_usb_table);
45
46 struct pn533_usb_phy {
47 struct usb_device *udev;
48 struct usb_interface *interface;
49
50 struct urb *out_urb;
51 struct urb *in_urb;
52
53 struct urb *ack_urb;
54 u8 *ack_buffer;
55
56 struct pn533 *priv;
57 };
58
pn533_recv_response(struct urb * urb)59 static void pn533_recv_response(struct urb *urb)
60 {
61 struct pn533_usb_phy *phy = urb->context;
62 struct sk_buff *skb = NULL;
63
64 if (!urb->status) {
65 skb = alloc_skb(urb->actual_length, GFP_ATOMIC);
66 if (!skb) {
67 nfc_err(&phy->udev->dev, "failed to alloc memory\n");
68 } else {
69 skb_put_data(skb, urb->transfer_buffer,
70 urb->actual_length);
71 }
72 }
73
74 pn533_recv_frame(phy->priv, skb, urb->status);
75 }
76
pn533_submit_urb_for_response(struct pn533_usb_phy * phy,gfp_t flags)77 static int pn533_submit_urb_for_response(struct pn533_usb_phy *phy, gfp_t flags)
78 {
79 phy->in_urb->complete = pn533_recv_response;
80
81 return usb_submit_urb(phy->in_urb, flags);
82 }
83
pn533_recv_ack(struct urb * urb)84 static void pn533_recv_ack(struct urb *urb)
85 {
86 struct pn533_usb_phy *phy = urb->context;
87 struct pn533 *priv = phy->priv;
88 struct pn533_cmd *cmd = priv->cmd;
89 struct pn533_std_frame *in_frame;
90 int rc;
91
92 cmd->status = urb->status;
93
94 switch (urb->status) {
95 case 0:
96 break; /* success */
97 case -ECONNRESET:
98 case -ENOENT:
99 dev_dbg(&phy->udev->dev,
100 "The urb has been stopped (status %d)\n",
101 urb->status);
102 goto sched_wq;
103 case -ESHUTDOWN:
104 default:
105 nfc_err(&phy->udev->dev,
106 "Urb failure (status %d)\n", urb->status);
107 goto sched_wq;
108 }
109
110 in_frame = phy->in_urb->transfer_buffer;
111
112 if (!pn533_rx_frame_is_ack(in_frame)) {
113 nfc_err(&phy->udev->dev, "Received an invalid ack\n");
114 cmd->status = -EIO;
115 goto sched_wq;
116 }
117
118 rc = pn533_submit_urb_for_response(phy, GFP_ATOMIC);
119 if (rc) {
120 nfc_err(&phy->udev->dev,
121 "usb_submit_urb failed with result %d\n", rc);
122 cmd->status = rc;
123 goto sched_wq;
124 }
125
126 return;
127
128 sched_wq:
129 queue_work(priv->wq, &priv->cmd_complete_work);
130 }
131
pn533_submit_urb_for_ack(struct pn533_usb_phy * phy,gfp_t flags)132 static int pn533_submit_urb_for_ack(struct pn533_usb_phy *phy, gfp_t flags)
133 {
134 phy->in_urb->complete = pn533_recv_ack;
135
136 return usb_submit_urb(phy->in_urb, flags);
137 }
138
pn533_usb_send_ack(struct pn533 * dev,gfp_t flags)139 static int pn533_usb_send_ack(struct pn533 *dev, gfp_t flags)
140 {
141 struct pn533_usb_phy *phy = dev->phy;
142 static const u8 ack[6] = {0x00, 0x00, 0xff, 0x00, 0xff, 0x00};
143 /* spec 7.1.1.3: Preamble, SoPC (2), ACK Code (2), Postamble */
144
145 if (!phy->ack_buffer) {
146 phy->ack_buffer = kmemdup(ack, sizeof(ack), flags);
147 if (!phy->ack_buffer)
148 return -ENOMEM;
149 }
150
151 phy->ack_urb->transfer_buffer = phy->ack_buffer;
152 phy->ack_urb->transfer_buffer_length = sizeof(ack);
153 return usb_submit_urb(phy->ack_urb, flags);
154 }
155
156 struct pn533_out_arg {
157 struct pn533_usb_phy *phy;
158 struct completion done;
159 };
160
pn533_usb_send_frame(struct pn533 * dev,struct sk_buff * out)161 static int pn533_usb_send_frame(struct pn533 *dev,
162 struct sk_buff *out)
163 {
164 struct pn533_usb_phy *phy = dev->phy;
165 struct pn533_out_arg arg;
166 void *cntx;
167 int rc;
168
169 if (phy->priv == NULL)
170 phy->priv = dev;
171
172 phy->out_urb->transfer_buffer = out->data;
173 phy->out_urb->transfer_buffer_length = out->len;
174
175 print_hex_dump_debug("PN533 TX: ", DUMP_PREFIX_NONE, 16, 1,
176 out->data, out->len, false);
177
178 arg.phy = phy;
179 init_completion(&arg.done);
180 cntx = phy->out_urb->context;
181 phy->out_urb->context = &arg;
182
183 rc = usb_submit_urb(phy->out_urb, GFP_KERNEL);
184 if (rc)
185 return rc;
186
187 wait_for_completion(&arg.done);
188 phy->out_urb->context = cntx;
189
190 if (dev->protocol_type == PN533_PROTO_REQ_RESP) {
191 /* request for response for sent packet directly */
192 rc = pn533_submit_urb_for_response(phy, GFP_KERNEL);
193 if (rc)
194 goto error;
195 } else if (dev->protocol_type == PN533_PROTO_REQ_ACK_RESP) {
196 /* request for ACK if that's the case */
197 rc = pn533_submit_urb_for_ack(phy, GFP_KERNEL);
198 if (rc)
199 goto error;
200 }
201
202 return 0;
203
204 error:
205 usb_unlink_urb(phy->out_urb);
206 return rc;
207 }
208
pn533_usb_abort_cmd(struct pn533 * dev,gfp_t flags)209 static void pn533_usb_abort_cmd(struct pn533 *dev, gfp_t flags)
210 {
211 struct pn533_usb_phy *phy = dev->phy;
212
213 /* ACR122U does not support any command which aborts last
214 * issued command i.e. as ACK for standard PN533. Additionally,
215 * it behaves stange, sending broken or incorrect responses,
216 * when we cancel urb before the chip will send response.
217 */
218 if (dev->device_type == PN533_DEVICE_ACR122U)
219 return;
220
221 /* An ack will cancel the last issued command */
222 pn533_usb_send_ack(dev, flags);
223
224 /* cancel the urb request */
225 usb_kill_urb(phy->in_urb);
226 }
227
228 /* ACR122 specific structs and functions */
229
230 /* ACS ACR122 pn533 frame definitions */
231 #define PN533_ACR122_TX_FRAME_HEADER_LEN (sizeof(struct pn533_acr122_tx_frame) \
232 + 2)
233 #define PN533_ACR122_TX_FRAME_TAIL_LEN 0
234 #define PN533_ACR122_RX_FRAME_HEADER_LEN (sizeof(struct pn533_acr122_rx_frame) \
235 + 2)
236 #define PN533_ACR122_RX_FRAME_TAIL_LEN 2
237 #define PN533_ACR122_FRAME_MAX_PAYLOAD_LEN PN533_STD_FRAME_MAX_PAYLOAD_LEN
238
239 /* CCID messages types */
240 #define PN533_ACR122_PC_TO_RDR_ICCPOWERON 0x62
241 #define PN533_ACR122_PC_TO_RDR_ESCAPE 0x6B
242
243 #define PN533_ACR122_RDR_TO_PC_ESCAPE 0x83
244
245
246 struct pn533_acr122_ccid_hdr {
247 u8 type;
248 u32 datalen;
249 u8 slot;
250 u8 seq;
251
252 /*
253 * 3 msg specific bytes or status, error and 1 specific
254 * byte for reposnse msg
255 */
256 u8 params[3];
257 } __packed;
258
259 struct pn533_acr122_apdu_hdr {
260 u8 class;
261 u8 ins;
262 u8 p1;
263 u8 p2;
264 } __packed;
265
266 struct pn533_acr122_tx_frame {
267 struct pn533_acr122_ccid_hdr ccid;
268 struct pn533_acr122_apdu_hdr apdu;
269 u8 datalen;
270 u8 data[]; /* pn533 frame: TFI ... */
271 } __packed;
272
273 struct pn533_acr122_rx_frame {
274 struct pn533_acr122_ccid_hdr ccid;
275 u8 data[]; /* pn533 frame : TFI ... */
276 } __packed;
277
pn533_acr122_tx_frame_init(void * _frame,u8 cmd_code)278 static void pn533_acr122_tx_frame_init(void *_frame, u8 cmd_code)
279 {
280 struct pn533_acr122_tx_frame *frame = _frame;
281
282 frame->ccid.type = PN533_ACR122_PC_TO_RDR_ESCAPE;
283 /* sizeof(apdu_hdr) + sizeof(datalen) */
284 frame->ccid.datalen = sizeof(frame->apdu) + 1;
285 frame->ccid.slot = 0;
286 frame->ccid.seq = 0;
287 frame->ccid.params[0] = 0;
288 frame->ccid.params[1] = 0;
289 frame->ccid.params[2] = 0;
290
291 frame->data[0] = PN533_STD_FRAME_DIR_OUT;
292 frame->data[1] = cmd_code;
293 frame->datalen = 2; /* data[0] + data[1] */
294
295 frame->apdu.class = 0xFF;
296 frame->apdu.ins = 0;
297 frame->apdu.p1 = 0;
298 frame->apdu.p2 = 0;
299 }
300
pn533_acr122_tx_frame_finish(void * _frame)301 static void pn533_acr122_tx_frame_finish(void *_frame)
302 {
303 struct pn533_acr122_tx_frame *frame = _frame;
304
305 frame->ccid.datalen += frame->datalen;
306 }
307
pn533_acr122_tx_update_payload_len(void * _frame,int len)308 static void pn533_acr122_tx_update_payload_len(void *_frame, int len)
309 {
310 struct pn533_acr122_tx_frame *frame = _frame;
311
312 frame->datalen += len;
313 }
314
pn533_acr122_is_rx_frame_valid(void * _frame,struct pn533 * dev)315 static bool pn533_acr122_is_rx_frame_valid(void *_frame, struct pn533 *dev)
316 {
317 struct pn533_acr122_rx_frame *frame = _frame;
318
319 if (frame->ccid.type != 0x83)
320 return false;
321
322 if (frame->ccid.datalen < 2 ||
323 frame->ccid.datalen > PN533_ACR122_FRAME_MAX_PAYLOAD_LEN +
324 PN533_ACR122_RX_FRAME_TAIL_LEN)
325 return false;
326
327 if (frame->data[frame->ccid.datalen - 2] == 0x63)
328 return false;
329
330 return true;
331 }
332
pn533_acr122_rx_frame_size(void * frame)333 static int pn533_acr122_rx_frame_size(void *frame)
334 {
335 struct pn533_acr122_rx_frame *f = frame;
336
337 /* f->ccid.datalen already includes tail length */
338 return sizeof(struct pn533_acr122_rx_frame) + f->ccid.datalen;
339 }
340
pn533_acr122_get_cmd_code(void * frame)341 static u8 pn533_acr122_get_cmd_code(void *frame)
342 {
343 struct pn533_acr122_rx_frame *f = frame;
344
345 return PN533_FRAME_CMD(f);
346 }
347
348 static struct pn533_frame_ops pn533_acr122_frame_ops = {
349 .tx_frame_init = pn533_acr122_tx_frame_init,
350 .tx_frame_finish = pn533_acr122_tx_frame_finish,
351 .tx_update_payload_len = pn533_acr122_tx_update_payload_len,
352 .tx_header_len = PN533_ACR122_TX_FRAME_HEADER_LEN,
353 .tx_tail_len = PN533_ACR122_TX_FRAME_TAIL_LEN,
354
355 .rx_is_frame_valid = pn533_acr122_is_rx_frame_valid,
356 .rx_header_len = PN533_ACR122_RX_FRAME_HEADER_LEN,
357 .rx_tail_len = PN533_ACR122_RX_FRAME_TAIL_LEN,
358 .rx_frame_size = pn533_acr122_rx_frame_size,
359
360 .max_payload_len = PN533_ACR122_FRAME_MAX_PAYLOAD_LEN,
361 .get_cmd_code = pn533_acr122_get_cmd_code,
362 };
363
364 struct pn533_acr122_poweron_rdr_arg {
365 int rc;
366 struct completion done;
367 };
368
pn533_acr122_poweron_rdr_resp(struct urb * urb)369 static void pn533_acr122_poweron_rdr_resp(struct urb *urb)
370 {
371 struct pn533_acr122_poweron_rdr_arg *arg = urb->context;
372
373 print_hex_dump_debug("ACR122 RX: ", DUMP_PREFIX_NONE, 16, 1,
374 urb->transfer_buffer, urb->transfer_buffer_length,
375 false);
376
377 arg->rc = urb->status;
378 complete(&arg->done);
379 }
380
pn533_acr122_poweron_rdr(struct pn533_usb_phy * phy)381 static int pn533_acr122_poweron_rdr(struct pn533_usb_phy *phy)
382 {
383 /* Power on th reader (CCID cmd) */
384 u8 cmd[10] = {PN533_ACR122_PC_TO_RDR_ICCPOWERON,
385 0, 0, 0, 0, 0, 0, 3, 0, 0};
386 char *buffer;
387 int transferred;
388 int rc;
389 void *cntx;
390 struct pn533_acr122_poweron_rdr_arg arg;
391
392 buffer = kmemdup(cmd, sizeof(cmd), GFP_KERNEL);
393 if (!buffer)
394 return -ENOMEM;
395
396 init_completion(&arg.done);
397 cntx = phy->in_urb->context; /* backup context */
398
399 phy->in_urb->complete = pn533_acr122_poweron_rdr_resp;
400 phy->in_urb->context = &arg;
401
402 print_hex_dump_debug("ACR122 TX: ", DUMP_PREFIX_NONE, 16, 1,
403 cmd, sizeof(cmd), false);
404
405 rc = usb_bulk_msg(phy->udev, phy->out_urb->pipe, buffer, sizeof(cmd),
406 &transferred, 5000);
407 kfree(buffer);
408 if (rc || (transferred != sizeof(cmd))) {
409 nfc_err(&phy->udev->dev,
410 "Reader power on cmd error %d\n", rc);
411 return rc ?: -EINVAL;
412 }
413
414 rc = usb_submit_urb(phy->in_urb, GFP_KERNEL);
415 if (rc) {
416 nfc_err(&phy->udev->dev,
417 "Can't submit reader poweron cmd response %d\n", rc);
418 return rc;
419 }
420
421 wait_for_completion(&arg.done);
422 phy->in_urb->context = cntx; /* restore context */
423
424 return arg.rc;
425 }
426
pn533_out_complete(struct urb * urb)427 static void pn533_out_complete(struct urb *urb)
428 {
429 struct pn533_out_arg *arg = urb->context;
430 struct pn533_usb_phy *phy = arg->phy;
431
432 switch (urb->status) {
433 case 0:
434 break; /* success */
435 case -ECONNRESET:
436 case -ENOENT:
437 dev_dbg(&phy->udev->dev,
438 "The urb has been stopped (status %d)\n",
439 urb->status);
440 break;
441 case -ESHUTDOWN:
442 default:
443 nfc_err(&phy->udev->dev,
444 "Urb failure (status %d)\n",
445 urb->status);
446 }
447
448 complete(&arg->done);
449 }
450
pn533_ack_complete(struct urb * urb)451 static void pn533_ack_complete(struct urb *urb)
452 {
453 struct pn533_usb_phy *phy = urb->context;
454
455 switch (urb->status) {
456 case 0:
457 break; /* success */
458 case -ECONNRESET:
459 case -ENOENT:
460 dev_dbg(&phy->udev->dev,
461 "The urb has been stopped (status %d)\n",
462 urb->status);
463 break;
464 case -ESHUTDOWN:
465 default:
466 nfc_err(&phy->udev->dev,
467 "Urb failure (status %d)\n",
468 urb->status);
469 }
470 }
471
472 static const struct pn533_phy_ops usb_phy_ops = {
473 .send_frame = pn533_usb_send_frame,
474 .send_ack = pn533_usb_send_ack,
475 .abort_cmd = pn533_usb_abort_cmd,
476 };
477
pn533_usb_probe(struct usb_interface * interface,const struct usb_device_id * id)478 static int pn533_usb_probe(struct usb_interface *interface,
479 const struct usb_device_id *id)
480 {
481 struct usb_endpoint_descriptor *ep_in, *ep_out;
482 struct pn533 *priv;
483 struct pn533_usb_phy *phy;
484 u32 protocols;
485 enum pn533_protocol_type protocol_type = PN533_PROTO_REQ_ACK_RESP;
486 struct pn533_frame_ops *fops = NULL;
487 unsigned char *in_buf;
488 int in_buf_len = PN533_EXT_FRAME_HEADER_LEN +
489 PN533_STD_FRAME_MAX_PAYLOAD_LEN +
490 PN533_STD_FRAME_TAIL_LEN;
491 int rc;
492
493 phy = devm_kzalloc(&interface->dev, sizeof(*phy), GFP_KERNEL);
494 if (!phy)
495 return -ENOMEM;
496
497 in_buf = kzalloc(in_buf_len, GFP_KERNEL);
498 if (!in_buf)
499 return -ENOMEM;
500
501 phy->udev = interface_to_usbdev(interface);
502 phy->interface = interface;
503
504 rc = usb_find_common_endpoints(interface->cur_altsetting, &ep_in,
505 &ep_out, NULL, NULL);
506 if (rc) {
507 nfc_err(&interface->dev,
508 "Could not find bulk-in or bulk-out endpoint\n");
509 goto error;
510 }
511
512 phy->in_urb = usb_alloc_urb(0, GFP_KERNEL);
513 phy->out_urb = usb_alloc_urb(0, GFP_KERNEL);
514 phy->ack_urb = usb_alloc_urb(0, GFP_KERNEL);
515
516 if (!phy->in_urb || !phy->out_urb || !phy->ack_urb) {
517 rc = -ENOMEM;
518 goto error;
519 }
520
521 usb_fill_bulk_urb(phy->in_urb, phy->udev,
522 usb_rcvbulkpipe(phy->udev, usb_endpoint_num(ep_in)),
523 in_buf, in_buf_len, NULL, phy);
524
525 usb_fill_bulk_urb(phy->out_urb, phy->udev,
526 usb_sndbulkpipe(phy->udev, usb_endpoint_num(ep_out)),
527 NULL, 0, pn533_out_complete, phy);
528 usb_fill_bulk_urb(phy->ack_urb, phy->udev,
529 usb_sndbulkpipe(phy->udev, usb_endpoint_num(ep_out)),
530 NULL, 0, pn533_ack_complete, phy);
531
532 switch (id->driver_info) {
533 case PN533_DEVICE_STD:
534 protocols = PN533_ALL_PROTOCOLS;
535 break;
536
537 case PN533_DEVICE_PASORI:
538 protocols = PN533_NO_TYPE_B_PROTOCOLS;
539 break;
540
541 case PN533_DEVICE_ACR122U:
542 protocols = PN533_NO_TYPE_B_PROTOCOLS;
543 fops = &pn533_acr122_frame_ops;
544 protocol_type = PN533_PROTO_REQ_RESP;
545
546 rc = pn533_acr122_poweron_rdr(phy);
547 if (rc < 0) {
548 nfc_err(&interface->dev,
549 "Couldn't poweron the reader (error %d)\n", rc);
550 goto error;
551 }
552 break;
553
554 default:
555 nfc_err(&interface->dev, "Unknown device type %lu\n",
556 id->driver_info);
557 rc = -EINVAL;
558 goto error;
559 }
560
561 priv = pn53x_common_init(id->driver_info, protocol_type,
562 phy, &usb_phy_ops, fops,
563 &phy->udev->dev);
564
565 if (IS_ERR(priv)) {
566 rc = PTR_ERR(priv);
567 goto error;
568 }
569
570 phy->priv = priv;
571
572 rc = pn533_finalize_setup(priv);
573 if (rc)
574 goto err_clean;
575
576 usb_set_intfdata(interface, phy);
577 rc = pn53x_register_nfc(priv, protocols, &interface->dev);
578 if (rc)
579 goto err_clean;
580
581 return 0;
582
583 err_clean:
584 pn53x_common_clean(priv);
585 error:
586 usb_kill_urb(phy->in_urb);
587 usb_kill_urb(phy->out_urb);
588 usb_kill_urb(phy->ack_urb);
589
590 usb_free_urb(phy->in_urb);
591 usb_free_urb(phy->out_urb);
592 usb_free_urb(phy->ack_urb);
593 kfree(in_buf);
594 kfree(phy->ack_buffer);
595
596 return rc;
597 }
598
pn533_usb_disconnect(struct usb_interface * interface)599 static void pn533_usb_disconnect(struct usb_interface *interface)
600 {
601 struct pn533_usb_phy *phy = usb_get_intfdata(interface);
602
603 if (!phy)
604 return;
605
606 pn53x_unregister_nfc(phy->priv);
607 pn53x_common_clean(phy->priv);
608
609 usb_set_intfdata(interface, NULL);
610
611 usb_kill_urb(phy->in_urb);
612 usb_kill_urb(phy->out_urb);
613 usb_kill_urb(phy->ack_urb);
614
615 kfree(phy->in_urb->transfer_buffer);
616 usb_free_urb(phy->in_urb);
617 usb_free_urb(phy->out_urb);
618 usb_free_urb(phy->ack_urb);
619 kfree(phy->ack_buffer);
620
621 nfc_info(&interface->dev, "NXP PN533 NFC device disconnected\n");
622 }
623
624 static struct usb_driver pn533_usb_driver = {
625 .name = "pn533_usb",
626 .probe = pn533_usb_probe,
627 .disconnect = pn533_usb_disconnect,
628 .id_table = pn533_usb_table,
629 };
630
631 module_usb_driver(pn533_usb_driver);
632
633 MODULE_AUTHOR("Lauro Ramos Venancio <lauro.venancio@openbossa.org>");
634 MODULE_AUTHOR("Aloisio Almeida Jr <aloisio.almeida@openbossa.org>");
635 MODULE_AUTHOR("Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>");
636 MODULE_DESCRIPTION("PN533 USB driver ver " VERSION);
637 MODULE_VERSION(VERSION);
638 MODULE_LICENSE("GPL");
639