xref: /linux/net/nfc/nci/core.c (revision 800c5eb7b5eba6cb2a32738d763fd59f0fbcdde4)
1 /*
2  *  The NFC Controller Interface is the communication protocol between an
3  *  NFC Controller (NFCC) and a Device Host (DH).
4  *
5  *  Copyright (C) 2011 Texas Instruments, Inc.
6  *
7  *  Written by Ilan Elias <ilane@ti.com>
8  *
9  *  Acknowledgements:
10  *  This file is based on hci_core.c, which was written
11  *  by Maxim Krasnyansky.
12  *
13  *  This program is free software; you can redistribute it and/or modify
14  *  it under the terms of the GNU General Public License version 2
15  *  as published by the Free Software Foundation
16  *
17  *  This program is distributed in the hope that it will be useful,
18  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
19  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
20  *  GNU General Public License for more details.
21  *
22  *  You should have received a copy of the GNU General Public License
23  *  along with this program; if not, write to the Free Software
24  *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
25  *
26  */
27 
28 #define pr_fmt(fmt) KBUILD_MODNAME ": %s: " fmt, __func__
29 
30 #include <linux/types.h>
31 #include <linux/workqueue.h>
32 #include <linux/completion.h>
33 #include <linux/export.h>
34 #include <linux/sched.h>
35 #include <linux/bitops.h>
36 #include <linux/skbuff.h>
37 
38 #include "../nfc.h"
39 #include <net/nfc/nci.h>
40 #include <net/nfc/nci_core.h>
41 #include <linux/nfc.h>
42 
43 static void nci_cmd_work(struct work_struct *work);
44 static void nci_rx_work(struct work_struct *work);
45 static void nci_tx_work(struct work_struct *work);
46 
47 /* ---- NCI requests ---- */
48 
49 void nci_req_complete(struct nci_dev *ndev, int result)
50 {
51 	if (ndev->req_status == NCI_REQ_PEND) {
52 		ndev->req_result = result;
53 		ndev->req_status = NCI_REQ_DONE;
54 		complete(&ndev->req_completion);
55 	}
56 }
57 
58 static void nci_req_cancel(struct nci_dev *ndev, int err)
59 {
60 	if (ndev->req_status == NCI_REQ_PEND) {
61 		ndev->req_result = err;
62 		ndev->req_status = NCI_REQ_CANCELED;
63 		complete(&ndev->req_completion);
64 	}
65 }
66 
67 /* Execute request and wait for completion. */
68 static int __nci_request(struct nci_dev *ndev,
69 	void (*req)(struct nci_dev *ndev, unsigned long opt),
70 	unsigned long opt,
71 	__u32 timeout)
72 {
73 	int rc = 0;
74 	long completion_rc;
75 
76 	ndev->req_status = NCI_REQ_PEND;
77 
78 	init_completion(&ndev->req_completion);
79 	req(ndev, opt);
80 	completion_rc = wait_for_completion_interruptible_timeout(
81 							&ndev->req_completion,
82 							timeout);
83 
84 	pr_debug("wait_for_completion return %ld\n", completion_rc);
85 
86 	if (completion_rc > 0) {
87 		switch (ndev->req_status) {
88 		case NCI_REQ_DONE:
89 			rc = nci_to_errno(ndev->req_result);
90 			break;
91 
92 		case NCI_REQ_CANCELED:
93 			rc = -ndev->req_result;
94 			break;
95 
96 		default:
97 			rc = -ETIMEDOUT;
98 			break;
99 		}
100 	} else {
101 		pr_err("wait_for_completion_interruptible_timeout failed %ld\n",
102 		       completion_rc);
103 
104 		rc = ((completion_rc == 0) ? (-ETIMEDOUT) : (completion_rc));
105 	}
106 
107 	ndev->req_status = ndev->req_result = 0;
108 
109 	return rc;
110 }
111 
112 static inline int nci_request(struct nci_dev *ndev,
113 		void (*req)(struct nci_dev *ndev, unsigned long opt),
114 		unsigned long opt, __u32 timeout)
115 {
116 	int rc;
117 
118 	if (!test_bit(NCI_UP, &ndev->flags))
119 		return -ENETDOWN;
120 
121 	/* Serialize all requests */
122 	mutex_lock(&ndev->req_lock);
123 	rc = __nci_request(ndev, req, opt, timeout);
124 	mutex_unlock(&ndev->req_lock);
125 
126 	return rc;
127 }
128 
129 static void nci_reset_req(struct nci_dev *ndev, unsigned long opt)
130 {
131 	struct nci_core_reset_cmd cmd;
132 
133 	cmd.reset_type = NCI_RESET_TYPE_RESET_CONFIG;
134 	nci_send_cmd(ndev, NCI_OP_CORE_RESET_CMD, 1, &cmd);
135 }
136 
137 static void nci_init_req(struct nci_dev *ndev, unsigned long opt)
138 {
139 	nci_send_cmd(ndev, NCI_OP_CORE_INIT_CMD, 0, NULL);
140 }
141 
142 static void nci_init_complete_req(struct nci_dev *ndev, unsigned long opt)
143 {
144 	struct nci_rf_disc_map_cmd cmd;
145 	struct disc_map_config *cfg = cmd.mapping_configs;
146 	__u8 *num = &cmd.num_mapping_configs;
147 	int i;
148 
149 	/* set rf mapping configurations */
150 	*num = 0;
151 
152 	/* by default mapping is set to NCI_RF_INTERFACE_FRAME */
153 	for (i = 0; i < ndev->num_supported_rf_interfaces; i++) {
154 		if (ndev->supported_rf_interfaces[i] ==
155 			NCI_RF_INTERFACE_ISO_DEP) {
156 			cfg[*num].rf_protocol = NCI_RF_PROTOCOL_ISO_DEP;
157 			cfg[*num].mode = NCI_DISC_MAP_MODE_POLL |
158 				NCI_DISC_MAP_MODE_LISTEN;
159 			cfg[*num].rf_interface = NCI_RF_INTERFACE_ISO_DEP;
160 			(*num)++;
161 		} else if (ndev->supported_rf_interfaces[i] ==
162 			NCI_RF_INTERFACE_NFC_DEP) {
163 			cfg[*num].rf_protocol = NCI_RF_PROTOCOL_NFC_DEP;
164 			cfg[*num].mode = NCI_DISC_MAP_MODE_POLL |
165 				NCI_DISC_MAP_MODE_LISTEN;
166 			cfg[*num].rf_interface = NCI_RF_INTERFACE_NFC_DEP;
167 			(*num)++;
168 		}
169 
170 		if (*num == NCI_MAX_NUM_MAPPING_CONFIGS)
171 			break;
172 	}
173 
174 	nci_send_cmd(ndev, NCI_OP_RF_DISCOVER_MAP_CMD,
175 		(1 + ((*num)*sizeof(struct disc_map_config))),
176 		&cmd);
177 }
178 
179 static void nci_rf_discover_req(struct nci_dev *ndev, unsigned long opt)
180 {
181 	struct nci_rf_disc_cmd cmd;
182 	__u32 protocols = opt;
183 
184 	cmd.num_disc_configs = 0;
185 
186 	if ((cmd.num_disc_configs < NCI_MAX_NUM_RF_CONFIGS) &&
187 		(protocols & NFC_PROTO_JEWEL_MASK
188 		|| protocols & NFC_PROTO_MIFARE_MASK
189 		|| protocols & NFC_PROTO_ISO14443_MASK
190 		|| protocols & NFC_PROTO_NFC_DEP_MASK)) {
191 		cmd.disc_configs[cmd.num_disc_configs].rf_tech_and_mode =
192 		NCI_NFC_A_PASSIVE_POLL_MODE;
193 		cmd.disc_configs[cmd.num_disc_configs].frequency = 1;
194 		cmd.num_disc_configs++;
195 	}
196 
197 	if ((cmd.num_disc_configs < NCI_MAX_NUM_RF_CONFIGS) &&
198 		(protocols & NFC_PROTO_ISO14443_MASK)) {
199 		cmd.disc_configs[cmd.num_disc_configs].rf_tech_and_mode =
200 		NCI_NFC_B_PASSIVE_POLL_MODE;
201 		cmd.disc_configs[cmd.num_disc_configs].frequency = 1;
202 		cmd.num_disc_configs++;
203 	}
204 
205 	if ((cmd.num_disc_configs < NCI_MAX_NUM_RF_CONFIGS) &&
206 		(protocols & NFC_PROTO_FELICA_MASK
207 		|| protocols & NFC_PROTO_NFC_DEP_MASK)) {
208 		cmd.disc_configs[cmd.num_disc_configs].rf_tech_and_mode =
209 		NCI_NFC_F_PASSIVE_POLL_MODE;
210 		cmd.disc_configs[cmd.num_disc_configs].frequency = 1;
211 		cmd.num_disc_configs++;
212 	}
213 
214 	nci_send_cmd(ndev, NCI_OP_RF_DISCOVER_CMD,
215 		(1 + (cmd.num_disc_configs*sizeof(struct disc_config))),
216 		&cmd);
217 }
218 
219 struct nci_rf_discover_select_param {
220 	__u8	rf_discovery_id;
221 	__u8	rf_protocol;
222 };
223 
224 static void nci_rf_discover_select_req(struct nci_dev *ndev, unsigned long opt)
225 {
226 	struct nci_rf_discover_select_param *param =
227 				(struct nci_rf_discover_select_param *)opt;
228 	struct nci_rf_discover_select_cmd cmd;
229 
230 	cmd.rf_discovery_id = param->rf_discovery_id;
231 	cmd.rf_protocol = param->rf_protocol;
232 
233 	switch (cmd.rf_protocol) {
234 	case NCI_RF_PROTOCOL_ISO_DEP:
235 		cmd.rf_interface = NCI_RF_INTERFACE_ISO_DEP;
236 		break;
237 
238 	case NCI_RF_PROTOCOL_NFC_DEP:
239 		cmd.rf_interface = NCI_RF_INTERFACE_NFC_DEP;
240 		break;
241 
242 	default:
243 		cmd.rf_interface = NCI_RF_INTERFACE_FRAME;
244 		break;
245 	}
246 
247 	nci_send_cmd(ndev, NCI_OP_RF_DISCOVER_SELECT_CMD,
248 			sizeof(struct nci_rf_discover_select_cmd),
249 			&cmd);
250 }
251 
252 static void nci_rf_deactivate_req(struct nci_dev *ndev, unsigned long opt)
253 {
254 	struct nci_rf_deactivate_cmd cmd;
255 
256 	cmd.type = NCI_DEACTIVATE_TYPE_IDLE_MODE;
257 
258 	nci_send_cmd(ndev, NCI_OP_RF_DEACTIVATE_CMD,
259 			sizeof(struct nci_rf_deactivate_cmd),
260 			&cmd);
261 }
262 
263 static int nci_open_device(struct nci_dev *ndev)
264 {
265 	int rc = 0;
266 
267 	mutex_lock(&ndev->req_lock);
268 
269 	if (test_bit(NCI_UP, &ndev->flags)) {
270 		rc = -EALREADY;
271 		goto done;
272 	}
273 
274 	if (ndev->ops->open(ndev)) {
275 		rc = -EIO;
276 		goto done;
277 	}
278 
279 	atomic_set(&ndev->cmd_cnt, 1);
280 
281 	set_bit(NCI_INIT, &ndev->flags);
282 
283 	rc = __nci_request(ndev, nci_reset_req, 0,
284 				msecs_to_jiffies(NCI_RESET_TIMEOUT));
285 
286 	if (!rc) {
287 		rc = __nci_request(ndev, nci_init_req, 0,
288 				msecs_to_jiffies(NCI_INIT_TIMEOUT));
289 	}
290 
291 	if (!rc) {
292 		rc = __nci_request(ndev, nci_init_complete_req, 0,
293 				msecs_to_jiffies(NCI_INIT_TIMEOUT));
294 	}
295 
296 	clear_bit(NCI_INIT, &ndev->flags);
297 
298 	if (!rc) {
299 		set_bit(NCI_UP, &ndev->flags);
300 		nci_clear_target_list(ndev);
301 		atomic_set(&ndev->state, NCI_IDLE);
302 	} else {
303 		/* Init failed, cleanup */
304 		skb_queue_purge(&ndev->cmd_q);
305 		skb_queue_purge(&ndev->rx_q);
306 		skb_queue_purge(&ndev->tx_q);
307 
308 		ndev->ops->close(ndev);
309 		ndev->flags = 0;
310 	}
311 
312 done:
313 	mutex_unlock(&ndev->req_lock);
314 	return rc;
315 }
316 
317 static int nci_close_device(struct nci_dev *ndev)
318 {
319 	nci_req_cancel(ndev, ENODEV);
320 	mutex_lock(&ndev->req_lock);
321 
322 	if (!test_and_clear_bit(NCI_UP, &ndev->flags)) {
323 		del_timer_sync(&ndev->cmd_timer);
324 		del_timer_sync(&ndev->data_timer);
325 		mutex_unlock(&ndev->req_lock);
326 		return 0;
327 	}
328 
329 	/* Drop RX and TX queues */
330 	skb_queue_purge(&ndev->rx_q);
331 	skb_queue_purge(&ndev->tx_q);
332 
333 	/* Flush RX and TX wq */
334 	flush_workqueue(ndev->rx_wq);
335 	flush_workqueue(ndev->tx_wq);
336 
337 	/* Reset device */
338 	skb_queue_purge(&ndev->cmd_q);
339 	atomic_set(&ndev->cmd_cnt, 1);
340 
341 	set_bit(NCI_INIT, &ndev->flags);
342 	__nci_request(ndev, nci_reset_req, 0,
343 				msecs_to_jiffies(NCI_RESET_TIMEOUT));
344 	clear_bit(NCI_INIT, &ndev->flags);
345 
346 	/* Flush cmd wq */
347 	flush_workqueue(ndev->cmd_wq);
348 
349 	/* After this point our queues are empty
350 	 * and no works are scheduled. */
351 	ndev->ops->close(ndev);
352 
353 	/* Clear flags */
354 	ndev->flags = 0;
355 
356 	mutex_unlock(&ndev->req_lock);
357 
358 	return 0;
359 }
360 
361 /* NCI command timer function */
362 static void nci_cmd_timer(unsigned long arg)
363 {
364 	struct nci_dev *ndev = (void *) arg;
365 
366 	atomic_set(&ndev->cmd_cnt, 1);
367 	queue_work(ndev->cmd_wq, &ndev->cmd_work);
368 }
369 
370 /* NCI data exchange timer function */
371 static void nci_data_timer(unsigned long arg)
372 {
373 	struct nci_dev *ndev = (void *) arg;
374 
375 	set_bit(NCI_DATA_EXCHANGE_TO, &ndev->flags);
376 	queue_work(ndev->rx_wq, &ndev->rx_work);
377 }
378 
379 static int nci_dev_up(struct nfc_dev *nfc_dev)
380 {
381 	struct nci_dev *ndev = nfc_get_drvdata(nfc_dev);
382 
383 	return nci_open_device(ndev);
384 }
385 
386 static int nci_dev_down(struct nfc_dev *nfc_dev)
387 {
388 	struct nci_dev *ndev = nfc_get_drvdata(nfc_dev);
389 
390 	return nci_close_device(ndev);
391 }
392 
393 static int nci_start_poll(struct nfc_dev *nfc_dev, __u32 protocols)
394 {
395 	struct nci_dev *ndev = nfc_get_drvdata(nfc_dev);
396 	int rc;
397 
398 	if ((atomic_read(&ndev->state) == NCI_DISCOVERY) ||
399 		(atomic_read(&ndev->state) == NCI_W4_ALL_DISCOVERIES)) {
400 		pr_err("unable to start poll, since poll is already active\n");
401 		return -EBUSY;
402 	}
403 
404 	if (ndev->target_active_prot) {
405 		pr_err("there is an active target\n");
406 		return -EBUSY;
407 	}
408 
409 	if ((atomic_read(&ndev->state) == NCI_W4_HOST_SELECT) ||
410 		(atomic_read(&ndev->state) == NCI_POLL_ACTIVE)) {
411 		pr_debug("target active or w4 select, implicitly deactivate\n");
412 
413 		rc = nci_request(ndev, nci_rf_deactivate_req, 0,
414 			msecs_to_jiffies(NCI_RF_DEACTIVATE_TIMEOUT));
415 		if (rc)
416 			return -EBUSY;
417 	}
418 
419 	rc = nci_request(ndev, nci_rf_discover_req, protocols,
420 		msecs_to_jiffies(NCI_RF_DISC_TIMEOUT));
421 
422 	if (!rc)
423 		ndev->poll_prots = protocols;
424 
425 	return rc;
426 }
427 
428 static void nci_stop_poll(struct nfc_dev *nfc_dev)
429 {
430 	struct nci_dev *ndev = nfc_get_drvdata(nfc_dev);
431 
432 	if ((atomic_read(&ndev->state) != NCI_DISCOVERY) &&
433 		(atomic_read(&ndev->state) != NCI_W4_ALL_DISCOVERIES)) {
434 		pr_err("unable to stop poll, since poll is not active\n");
435 		return;
436 	}
437 
438 	nci_request(ndev, nci_rf_deactivate_req, 0,
439 		msecs_to_jiffies(NCI_RF_DEACTIVATE_TIMEOUT));
440 }
441 
442 static int nci_activate_target(struct nfc_dev *nfc_dev, __u32 target_idx,
443 				__u32 protocol)
444 {
445 	struct nci_dev *ndev = nfc_get_drvdata(nfc_dev);
446 	struct nci_rf_discover_select_param param;
447 	struct nfc_target *target = NULL;
448 	int i;
449 	int rc = 0;
450 
451 	pr_debug("target_idx %d, protocol 0x%x\n", target_idx, protocol);
452 
453 	if ((atomic_read(&ndev->state) != NCI_W4_HOST_SELECT) &&
454 		(atomic_read(&ndev->state) != NCI_POLL_ACTIVE)) {
455 		pr_err("there is no available target to activate\n");
456 		return -EINVAL;
457 	}
458 
459 	if (ndev->target_active_prot) {
460 		pr_err("there is already an active target\n");
461 		return -EBUSY;
462 	}
463 
464 	for (i = 0; i < ndev->n_targets; i++) {
465 		if (ndev->targets[i].idx == target_idx) {
466 			target = &ndev->targets[i];
467 			break;
468 		}
469 	}
470 
471 	if (!target) {
472 		pr_err("unable to find the selected target\n");
473 		return -EINVAL;
474 	}
475 
476 	if (!(target->supported_protocols & (1 << protocol))) {
477 		pr_err("target does not support the requested protocol 0x%x\n",
478 		       protocol);
479 		return -EINVAL;
480 	}
481 
482 	if (atomic_read(&ndev->state) == NCI_W4_HOST_SELECT) {
483 		param.rf_discovery_id = target->idx;
484 
485 		if (protocol == NFC_PROTO_JEWEL)
486 			param.rf_protocol = NCI_RF_PROTOCOL_T1T;
487 		else if (protocol == NFC_PROTO_MIFARE)
488 			param.rf_protocol = NCI_RF_PROTOCOL_T2T;
489 		else if (protocol == NFC_PROTO_FELICA)
490 			param.rf_protocol = NCI_RF_PROTOCOL_T3T;
491 		else if (protocol == NFC_PROTO_ISO14443)
492 			param.rf_protocol = NCI_RF_PROTOCOL_ISO_DEP;
493 		else
494 			param.rf_protocol = NCI_RF_PROTOCOL_NFC_DEP;
495 
496 		rc = nci_request(ndev, nci_rf_discover_select_req,
497 				(unsigned long)&param,
498 				msecs_to_jiffies(NCI_RF_DISC_SELECT_TIMEOUT));
499 	}
500 
501 	if (!rc)
502 		ndev->target_active_prot = protocol;
503 
504 	return rc;
505 }
506 
507 static void nci_deactivate_target(struct nfc_dev *nfc_dev, __u32 target_idx)
508 {
509 	struct nci_dev *ndev = nfc_get_drvdata(nfc_dev);
510 
511 	pr_debug("target_idx %d\n", target_idx);
512 
513 	if (!ndev->target_active_prot) {
514 		pr_err("unable to deactivate target, no active target\n");
515 		return;
516 	}
517 
518 	ndev->target_active_prot = 0;
519 
520 	if (atomic_read(&ndev->state) == NCI_POLL_ACTIVE) {
521 		nci_request(ndev, nci_rf_deactivate_req, 0,
522 			msecs_to_jiffies(NCI_RF_DEACTIVATE_TIMEOUT));
523 	}
524 }
525 
526 static int nci_data_exchange(struct nfc_dev *nfc_dev, __u32 target_idx,
527 						struct sk_buff *skb,
528 						data_exchange_cb_t cb,
529 						void *cb_context)
530 {
531 	struct nci_dev *ndev = nfc_get_drvdata(nfc_dev);
532 	int rc;
533 
534 	pr_debug("target_idx %d, len %d\n", target_idx, skb->len);
535 
536 	if (!ndev->target_active_prot) {
537 		pr_err("unable to exchange data, no active target\n");
538 		return -EINVAL;
539 	}
540 
541 	if (test_and_set_bit(NCI_DATA_EXCHANGE, &ndev->flags))
542 		return -EBUSY;
543 
544 	/* store cb and context to be used on receiving data */
545 	ndev->data_exchange_cb = cb;
546 	ndev->data_exchange_cb_context = cb_context;
547 
548 	rc = nci_send_data(ndev, NCI_STATIC_RF_CONN_ID, skb);
549 	if (rc)
550 		clear_bit(NCI_DATA_EXCHANGE, &ndev->flags);
551 
552 	return rc;
553 }
554 
555 static struct nfc_ops nci_nfc_ops = {
556 	.dev_up = nci_dev_up,
557 	.dev_down = nci_dev_down,
558 	.start_poll = nci_start_poll,
559 	.stop_poll = nci_stop_poll,
560 	.activate_target = nci_activate_target,
561 	.deactivate_target = nci_deactivate_target,
562 	.data_exchange = nci_data_exchange,
563 };
564 
565 /* ---- Interface to NCI drivers ---- */
566 
567 /**
568  * nci_allocate_device - allocate a new nci device
569  *
570  * @ops: device operations
571  * @supported_protocols: NFC protocols supported by the device
572  */
573 struct nci_dev *nci_allocate_device(struct nci_ops *ops,
574 					__u32 supported_protocols,
575 					int tx_headroom,
576 					int tx_tailroom)
577 {
578 	struct nci_dev *ndev;
579 
580 	pr_debug("supported_protocols 0x%x\n", supported_protocols);
581 
582 	if (!ops->open || !ops->close || !ops->send)
583 		return NULL;
584 
585 	if (!supported_protocols)
586 		return NULL;
587 
588 	ndev = kzalloc(sizeof(struct nci_dev), GFP_KERNEL);
589 	if (!ndev)
590 		return NULL;
591 
592 	ndev->ops = ops;
593 	ndev->tx_headroom = tx_headroom;
594 	ndev->tx_tailroom = tx_tailroom;
595 
596 	ndev->nfc_dev = nfc_allocate_device(&nci_nfc_ops,
597 						supported_protocols,
598 						tx_headroom + NCI_DATA_HDR_SIZE,
599 						tx_tailroom);
600 	if (!ndev->nfc_dev)
601 		goto free_exit;
602 
603 	nfc_set_drvdata(ndev->nfc_dev, ndev);
604 
605 	return ndev;
606 
607 free_exit:
608 	kfree(ndev);
609 	return NULL;
610 }
611 EXPORT_SYMBOL(nci_allocate_device);
612 
613 /**
614  * nci_free_device - deallocate nci device
615  *
616  * @ndev: The nci device to deallocate
617  */
618 void nci_free_device(struct nci_dev *ndev)
619 {
620 	nfc_free_device(ndev->nfc_dev);
621 	kfree(ndev);
622 }
623 EXPORT_SYMBOL(nci_free_device);
624 
625 /**
626  * nci_register_device - register a nci device in the nfc subsystem
627  *
628  * @dev: The nci device to register
629  */
630 int nci_register_device(struct nci_dev *ndev)
631 {
632 	int rc;
633 	struct device *dev = &ndev->nfc_dev->dev;
634 	char name[32];
635 
636 	rc = nfc_register_device(ndev->nfc_dev);
637 	if (rc)
638 		goto exit;
639 
640 	ndev->flags = 0;
641 
642 	INIT_WORK(&ndev->cmd_work, nci_cmd_work);
643 	snprintf(name, sizeof(name), "%s_nci_cmd_wq", dev_name(dev));
644 	ndev->cmd_wq = create_singlethread_workqueue(name);
645 	if (!ndev->cmd_wq) {
646 		rc = -ENOMEM;
647 		goto unreg_exit;
648 	}
649 
650 	INIT_WORK(&ndev->rx_work, nci_rx_work);
651 	snprintf(name, sizeof(name), "%s_nci_rx_wq", dev_name(dev));
652 	ndev->rx_wq = create_singlethread_workqueue(name);
653 	if (!ndev->rx_wq) {
654 		rc = -ENOMEM;
655 		goto destroy_cmd_wq_exit;
656 	}
657 
658 	INIT_WORK(&ndev->tx_work, nci_tx_work);
659 	snprintf(name, sizeof(name), "%s_nci_tx_wq", dev_name(dev));
660 	ndev->tx_wq = create_singlethread_workqueue(name);
661 	if (!ndev->tx_wq) {
662 		rc = -ENOMEM;
663 		goto destroy_rx_wq_exit;
664 	}
665 
666 	skb_queue_head_init(&ndev->cmd_q);
667 	skb_queue_head_init(&ndev->rx_q);
668 	skb_queue_head_init(&ndev->tx_q);
669 
670 	setup_timer(&ndev->cmd_timer, nci_cmd_timer,
671 			(unsigned long) ndev);
672 	setup_timer(&ndev->data_timer, nci_data_timer,
673 			(unsigned long) ndev);
674 
675 	mutex_init(&ndev->req_lock);
676 
677 	goto exit;
678 
679 destroy_rx_wq_exit:
680 	destroy_workqueue(ndev->rx_wq);
681 
682 destroy_cmd_wq_exit:
683 	destroy_workqueue(ndev->cmd_wq);
684 
685 unreg_exit:
686 	nfc_unregister_device(ndev->nfc_dev);
687 
688 exit:
689 	return rc;
690 }
691 EXPORT_SYMBOL(nci_register_device);
692 
693 /**
694  * nci_unregister_device - unregister a nci device in the nfc subsystem
695  *
696  * @dev: The nci device to unregister
697  */
698 void nci_unregister_device(struct nci_dev *ndev)
699 {
700 	nci_close_device(ndev);
701 
702 	destroy_workqueue(ndev->cmd_wq);
703 	destroy_workqueue(ndev->rx_wq);
704 	destroy_workqueue(ndev->tx_wq);
705 
706 	nfc_unregister_device(ndev->nfc_dev);
707 }
708 EXPORT_SYMBOL(nci_unregister_device);
709 
710 /**
711  * nci_recv_frame - receive frame from NCI drivers
712  *
713  * @skb: The sk_buff to receive
714  */
715 int nci_recv_frame(struct sk_buff *skb)
716 {
717 	struct nci_dev *ndev = (struct nci_dev *) skb->dev;
718 
719 	pr_debug("len %d\n", skb->len);
720 
721 	if (!ndev || (!test_bit(NCI_UP, &ndev->flags)
722 		&& !test_bit(NCI_INIT, &ndev->flags))) {
723 		kfree_skb(skb);
724 		return -ENXIO;
725 	}
726 
727 	/* Queue frame for rx worker thread */
728 	skb_queue_tail(&ndev->rx_q, skb);
729 	queue_work(ndev->rx_wq, &ndev->rx_work);
730 
731 	return 0;
732 }
733 EXPORT_SYMBOL(nci_recv_frame);
734 
735 static int nci_send_frame(struct sk_buff *skb)
736 {
737 	struct nci_dev *ndev = (struct nci_dev *) skb->dev;
738 
739 	pr_debug("len %d\n", skb->len);
740 
741 	if (!ndev) {
742 		kfree_skb(skb);
743 		return -ENODEV;
744 	}
745 
746 	/* Get rid of skb owner, prior to sending to the driver. */
747 	skb_orphan(skb);
748 
749 	return ndev->ops->send(skb);
750 }
751 
752 /* Send NCI command */
753 int nci_send_cmd(struct nci_dev *ndev, __u16 opcode, __u8 plen, void *payload)
754 {
755 	struct nci_ctrl_hdr *hdr;
756 	struct sk_buff *skb;
757 
758 	pr_debug("opcode 0x%x, plen %d\n", opcode, plen);
759 
760 	skb = nci_skb_alloc(ndev, (NCI_CTRL_HDR_SIZE + plen), GFP_KERNEL);
761 	if (!skb) {
762 		pr_err("no memory for command\n");
763 		return -ENOMEM;
764 	}
765 
766 	hdr = (struct nci_ctrl_hdr *) skb_put(skb, NCI_CTRL_HDR_SIZE);
767 	hdr->gid = nci_opcode_gid(opcode);
768 	hdr->oid = nci_opcode_oid(opcode);
769 	hdr->plen = plen;
770 
771 	nci_mt_set((__u8 *)hdr, NCI_MT_CMD_PKT);
772 	nci_pbf_set((__u8 *)hdr, NCI_PBF_LAST);
773 
774 	if (plen)
775 		memcpy(skb_put(skb, plen), payload, plen);
776 
777 	skb->dev = (void *) ndev;
778 
779 	skb_queue_tail(&ndev->cmd_q, skb);
780 	queue_work(ndev->cmd_wq, &ndev->cmd_work);
781 
782 	return 0;
783 }
784 
785 /* ---- NCI TX Data worker thread ---- */
786 
787 static void nci_tx_work(struct work_struct *work)
788 {
789 	struct nci_dev *ndev = container_of(work, struct nci_dev, tx_work);
790 	struct sk_buff *skb;
791 
792 	pr_debug("credits_cnt %d\n", atomic_read(&ndev->credits_cnt));
793 
794 	/* Send queued tx data */
795 	while (atomic_read(&ndev->credits_cnt)) {
796 		skb = skb_dequeue(&ndev->tx_q);
797 		if (!skb)
798 			return;
799 
800 		/* Check if data flow control is used */
801 		if (atomic_read(&ndev->credits_cnt) !=
802 				NCI_DATA_FLOW_CONTROL_NOT_USED)
803 			atomic_dec(&ndev->credits_cnt);
804 
805 		pr_debug("NCI TX: MT=data, PBF=%d, conn_id=%d, plen=%d\n",
806 			 nci_pbf(skb->data),
807 			 nci_conn_id(skb->data),
808 			 nci_plen(skb->data));
809 
810 		nci_send_frame(skb);
811 
812 		mod_timer(&ndev->data_timer,
813 			jiffies + msecs_to_jiffies(NCI_DATA_TIMEOUT));
814 	}
815 }
816 
817 /* ----- NCI RX worker thread (data & control) ----- */
818 
819 static void nci_rx_work(struct work_struct *work)
820 {
821 	struct nci_dev *ndev = container_of(work, struct nci_dev, rx_work);
822 	struct sk_buff *skb;
823 
824 	while ((skb = skb_dequeue(&ndev->rx_q))) {
825 		/* Process frame */
826 		switch (nci_mt(skb->data)) {
827 		case NCI_MT_RSP_PKT:
828 			nci_rsp_packet(ndev, skb);
829 			break;
830 
831 		case NCI_MT_NTF_PKT:
832 			nci_ntf_packet(ndev, skb);
833 			break;
834 
835 		case NCI_MT_DATA_PKT:
836 			nci_rx_data_packet(ndev, skb);
837 			break;
838 
839 		default:
840 			pr_err("unknown MT 0x%x\n", nci_mt(skb->data));
841 			kfree_skb(skb);
842 			break;
843 		}
844 	}
845 
846 	/* check if a data exchange timout has occurred */
847 	if (test_bit(NCI_DATA_EXCHANGE_TO, &ndev->flags)) {
848 		/* complete the data exchange transaction, if exists */
849 		if (test_bit(NCI_DATA_EXCHANGE, &ndev->flags))
850 			nci_data_exchange_complete(ndev, NULL, -ETIMEDOUT);
851 
852 		clear_bit(NCI_DATA_EXCHANGE_TO, &ndev->flags);
853 	}
854 }
855 
856 /* ----- NCI TX CMD worker thread ----- */
857 
858 static void nci_cmd_work(struct work_struct *work)
859 {
860 	struct nci_dev *ndev = container_of(work, struct nci_dev, cmd_work);
861 	struct sk_buff *skb;
862 
863 	pr_debug("cmd_cnt %d\n", atomic_read(&ndev->cmd_cnt));
864 
865 	/* Send queued command */
866 	if (atomic_read(&ndev->cmd_cnt)) {
867 		skb = skb_dequeue(&ndev->cmd_q);
868 		if (!skb)
869 			return;
870 
871 		atomic_dec(&ndev->cmd_cnt);
872 
873 		pr_debug("NCI TX: MT=cmd, PBF=%d, GID=0x%x, OID=0x%x, plen=%d\n",
874 			 nci_pbf(skb->data),
875 			 nci_opcode_gid(nci_opcode(skb->data)),
876 			 nci_opcode_oid(nci_opcode(skb->data)),
877 			 nci_plen(skb->data));
878 
879 		nci_send_frame(skb);
880 
881 		mod_timer(&ndev->cmd_timer,
882 			jiffies + msecs_to_jiffies(NCI_CMD_TIMEOUT));
883 	}
884 }
885