13 files changed, 209 insertions, 108 deletions

diff --git a/net/nfc/core.c b/net/nfc/core.c
index 3192c3f589ee..9f6ce011d35d 100644
--- a/net/nfc/core.c
+++ b/net/nfc/core.c
@@ -97,7 +97,7 @@ int nfc_dev_down(struct nfc_dev *dev)
                 goto error;
         }
 
-        if (dev->polling || dev->activated_target_idx != NFC_TARGET_IDX_NONE) {
+        if (dev->polling || dev->active_target) {
                 rc = -EBUSY;
                 goto error;
         }
@@ -183,11 +183,27 @@ error:
         return rc;
 }
 
+static struct nfc_target *nfc_find_target(struct nfc_dev *dev, u32 target_idx)
+{
+        int i;
+
+        if (dev->n_targets == 0)
+                return NULL;
+
+        for (i = 0; i < dev->n_targets ; i++) {
+                if (dev->targets[i].idx == target_idx)
+                        return &dev->targets[i];
+        }
+
+        return NULL;
+}
+
 int nfc_dep_link_up(struct nfc_dev *dev, int target_index, u8 comm_mode)
 {
         int rc = 0;
         u8 *gb;
         size_t gb_len;
+        struct nfc_target *target;
 
         pr_debug("dev_name=%s comm %d\n", dev_name(&dev->dev), comm_mode);
 
@@ -212,9 +228,15 @@ int nfc_dep_link_up(struct nfc_dev *dev, int target_index, u8 comm_mode)
                 goto error;
         }
 
-        rc = dev->ops->dep_link_up(dev, target_index, comm_mode, gb, gb_len);
+        target = nfc_find_target(dev, target_index);
+        if (target == NULL) {
+                rc = -ENOTCONN;
+                goto error;
+        }
+
+        rc = dev->ops->dep_link_up(dev, target, comm_mode, gb, gb_len);
         if (!rc)
-                dev->activated_target_idx = target_index;
+                dev->active_target = target;
 
 error:
         device_unlock(&dev->dev);
@@ -250,7 +272,7 @@ int nfc_dep_link_down(struct nfc_dev *dev)
         rc = dev->ops->dep_link_down(dev);
         if (!rc) {
                 dev->dep_link_up = false;
-                dev->activated_target_idx = NFC_TARGET_IDX_NONE;
+                dev->active_target = NULL;
                 nfc_llcp_mac_is_down(dev);
                 nfc_genl_dep_link_down_event(dev);
         }
@@ -282,6 +304,7 @@ EXPORT_SYMBOL(nfc_dep_link_is_up);
 int nfc_activate_target(struct nfc_dev *dev, u32 target_idx, u32 protocol)
 {
         int rc;
+        struct nfc_target *target;
 
         pr_debug("dev_name=%s target_idx=%u protocol=%u\n",
                  dev_name(&dev->dev), target_idx, protocol);
@@ -293,9 +316,20 @@ int nfc_activate_target(struct nfc_dev *dev, u32 target_idx, u32 protocol)
                 goto error;
         }
 
-        rc = dev->ops->activate_target(dev, target_idx, protocol);
+        if (dev->active_target) {
+                rc = -EBUSY;
+                goto error;
+        }
+
+        target = nfc_find_target(dev, target_idx);
+        if (target == NULL) {
+                rc = -ENOTCONN;
+                goto error;
+        }
+
+        rc = dev->ops->activate_target(dev, target, protocol);
         if (!rc) {
-                dev->activated_target_idx = target_idx;
+                dev->active_target = target;
 
                 if (dev->ops->check_presence)
                         mod_timer(&dev->check_pres_timer, jiffies +
@@ -327,11 +361,21 @@ int nfc_deactivate_target(struct nfc_dev *dev, u32 target_idx)
                 goto error;
         }
 
+        if (dev->active_target == NULL) {
+                rc = -ENOTCONN;
+                goto error;
+        }
+
+        if (dev->active_target->idx != target_idx) {
+                rc = -ENOTCONN;
+                goto error;
+        }
+
         if (dev->ops->check_presence)
                 del_timer_sync(&dev->check_pres_timer);
 
-        dev->ops->deactivate_target(dev, target_idx);
-        dev->activated_target_idx = NFC_TARGET_IDX_NONE;
+        dev->ops->deactivate_target(dev, dev->active_target);
+        dev->active_target = NULL;
 
 error:
         device_unlock(&dev->dev);
@@ -365,13 +409,13 @@ int nfc_data_exchange(struct nfc_dev *dev, u32 target_idx, struct sk_buff *skb,
                 goto error;
         }
 
-        if (dev->activated_target_idx == NFC_TARGET_IDX_NONE) {
+        if (dev->active_target == NULL) {
                 rc = -ENOTCONN;
                 kfree_skb(skb);
                 goto error;
         }
 
-        if (target_idx != dev->activated_target_idx) {
+        if (dev->active_target->idx != target_idx) {
                 rc = -EADDRNOTAVAIL;
                 kfree_skb(skb);
                 goto error;
@@ -380,7 +424,8 @@ int nfc_data_exchange(struct nfc_dev *dev, u32 target_idx, struct sk_buff *skb,
         if (dev->ops->check_presence)
                 del_timer_sync(&dev->check_pres_timer);
 
-        rc = dev->ops->data_exchange(dev, target_idx, skb, cb, cb_context);
+        rc = dev->ops->data_exchange(dev, dev->active_target, skb, cb,
+                                     cb_context);
 
         if (!rc && dev->ops->check_presence)
                 mod_timer(&dev->check_pres_timer, jiffies +
@@ -456,6 +501,9 @@ EXPORT_SYMBOL(nfc_alloc_recv_skb);
  * The device driver must call this function when one or many nfc targets
  * are found. After calling this function, the device driver must stop
  * polling for targets.
+ * IMPORTANT: this function must not be called from an atomic context.
+ * In addition, it must also not be called from a context that would prevent
+ * the NFC Core to call other nfc ops entry point concurrently.
  */
 int nfc_targets_found(struct nfc_dev *dev,
                       struct nfc_target *targets, int n_targets)
@@ -469,7 +517,7 @@ int nfc_targets_found(struct nfc_dev *dev,
         for (i = 0; i < n_targets; i++)
                 targets[i].idx = dev->target_next_idx++;
 
-        spin_lock_bh(&dev->targets_lock);
+        device_lock(&dev->dev);
 
         dev->targets_generation++;
 
@@ -479,12 +527,12 @@ int nfc_targets_found(struct nfc_dev *dev,
 
         if (!dev->targets) {
                 dev->n_targets = 0;
-                spin_unlock_bh(&dev->targets_lock);
+                device_unlock(&dev->dev);
                 return -ENOMEM;
         }
 
         dev->n_targets = n_targets;
-        spin_unlock_bh(&dev->targets_lock);
+        device_unlock(&dev->dev);
 
         nfc_genl_targets_found(dev);
 
@@ -492,6 +540,18 @@ int nfc_targets_found(struct nfc_dev *dev,
 }
 EXPORT_SYMBOL(nfc_targets_found);
 
+/**
+ * nfc_target_lost - inform that an activated target went out of field
+ *
+ * @dev: The nfc device that had the activated target in field
+ * @target_idx: the nfc index of the target
+ *
+ * The device driver must call this function when the activated target
+ * goes out of the field.
+ * IMPORTANT: this function must not be called from an atomic context.
+ * In addition, it must also not be called from a context that would prevent
+ * the NFC Core to call other nfc ops entry point concurrently.
+ */
 int nfc_target_lost(struct nfc_dev *dev, u32 target_idx)
 {
         struct nfc_target *tg;
@@ -499,7 +559,7 @@ int nfc_target_lost(struct nfc_dev *dev, u32 target_idx)
 
         pr_debug("dev_name %s n_target %d\n", dev_name(&dev->dev), target_idx);
 
-        spin_lock_bh(&dev->targets_lock);
+        device_lock(&dev->dev);
 
         for (i = 0; i < dev->n_targets; i++) {
                 tg = &dev->targets[i];
@@ -508,13 +568,13 @@ int nfc_target_lost(struct nfc_dev *dev, u32 target_idx)
         }
 
         if (i == dev->n_targets) {
-                spin_unlock_bh(&dev->targets_lock);
+                device_unlock(&dev->dev);
                 return -EINVAL;
         }
 
         dev->targets_generation++;
         dev->n_targets--;
-        dev->activated_target_idx = NFC_TARGET_IDX_NONE;
+        dev->active_target = NULL;
 
         if (dev->n_targets) {
                 memcpy(&dev->targets[i], &dev->targets[i + 1],
@@ -524,7 +584,7 @@ int nfc_target_lost(struct nfc_dev *dev, u32 target_idx)
                 dev->targets = NULL;
         }
 
-        spin_unlock_bh(&dev->targets_lock);
+        device_unlock(&dev->dev);
 
         nfc_genl_target_lost(dev, target_idx);
 
@@ -556,15 +616,16 @@ static void nfc_check_pres_work(struct work_struct *work)
 
         device_lock(&dev->dev);
 
-        if (dev->activated_target_idx != NFC_TARGET_IDX_NONE &&
-            timer_pending(&dev->check_pres_timer) == 0) {
-                rc = dev->ops->check_presence(dev, dev->activated_target_idx);
+        if (dev->active_target && timer_pending(&dev->check_pres_timer) == 0) {
+                rc = dev->ops->check_presence(dev, dev->active_target);
                 if (!rc) {
                         mod_timer(&dev->check_pres_timer, jiffies +
                                   msecs_to_jiffies(NFC_CHECK_PRES_FREQ_MS));
                 } else {
-                        nfc_target_lost(dev, dev->activated_target_idx);
-                        dev->activated_target_idx = NFC_TARGET_IDX_NONE;
+                        u32 active_target_idx = dev->active_target->idx;
+                        device_unlock(&dev->dev);
+                        nfc_target_lost(dev, active_target_idx);
+                        return;
                 }
         }
 
@@ -637,14 +698,12 @@ struct nfc_dev *nfc_allocate_device(struct nfc_ops *ops,
         dev->tx_headroom = tx_headroom;
         dev->tx_tailroom = tx_tailroom;
 
-        spin_lock_init(&dev->targets_lock);
         nfc_genl_data_init(&dev->genl_data);
 
+
         /* first generation must not be 0 */
         dev->targets_generation = 1;
 
-        dev->activated_target_idx = NFC_TARGET_IDX_NONE;
-
         if (ops->check_presence) {
                 char name[32];
                 init_timer(&dev->check_pres_timer);
@@ -662,7 +721,6 @@ struct nfc_dev *nfc_allocate_device(struct nfc_ops *ops,
                 }
         }
 
-
         return dev;
 }
 EXPORT_SYMBOL(nfc_allocate_device);
diff --git a/net/nfc/hci/Kconfig b/net/nfc/hci/Kconfig
index 17213a6362b4..fd67f51d18e9 100644
--- a/net/nfc/hci/Kconfig
+++ b/net/nfc/hci/Kconfig
@@ -9,6 +9,7 @@ config NFC_HCI
 
 config NFC_SHDLC
         depends on NFC_HCI
+        select CRC_CCITT
         bool "SHDLC link layer for HCI based NFC drivers"
         default n
         ---help---
diff --git a/net/nfc/hci/core.c b/net/nfc/hci/core.c
index 86fd00d5a099..e1a640d2b588 100644
--- a/net/nfc/hci/core.c
+++ b/net/nfc/hci/core.c
@@ -235,13 +235,6 @@ static int nfc_hci_target_discovered(struct nfc_hci_dev *hdev, u8 gate)
         targets->hci_reader_gate = gate;
 
         r = nfc_targets_found(hdev->ndev, targets, 1);
-        if (r < 0)
-                goto exit;
-
-        kfree(hdev->targets);
-        hdev->targets = targets;
-        targets = NULL;
-        hdev->target_count = 1;
 
 exit:
         kfree(targets);
@@ -258,11 +251,6 @@ void nfc_hci_event_received(struct nfc_hci_dev *hdev, u8 pipe, u8 event,
 
         switch (event) {
         case NFC_HCI_EVT_TARGET_DISCOVERED:
-                if (hdev->poll_started == false) {
-                        r = -EPROTO;
-                        goto exit;
-                }
-
                 if (skb->len < 1) {     /* no status data? */
                         r = -EPROTO;
                         goto exit;
@@ -496,74 +484,42 @@ static int hci_dev_down(struct nfc_dev *nfc_dev)
 static int hci_start_poll(struct nfc_dev *nfc_dev, u32 protocols)
 {
         struct nfc_hci_dev *hdev = nfc_get_drvdata(nfc_dev);
-        int r;
 
         if (hdev->ops->start_poll)
-                r = hdev->ops->start_poll(hdev, protocols);
+                return hdev->ops->start_poll(hdev, protocols);
         else
-                r = nfc_hci_send_event(hdev, NFC_HCI_RF_READER_A_GATE,
+                return nfc_hci_send_event(hdev, NFC_HCI_RF_READER_A_GATE,
                                        NFC_HCI_EVT_READER_REQUESTED, NULL, 0);
-        if (r == 0)
-                hdev->poll_started = true;
-
-        return r;
 }
 
 static void hci_stop_poll(struct nfc_dev *nfc_dev)
 {
         struct nfc_hci_dev *hdev = nfc_get_drvdata(nfc_dev);
 
-        if (hdev->poll_started) {
-                nfc_hci_send_event(hdev, NFC_HCI_RF_READER_A_GATE,
-                                   NFC_HCI_EVT_END_OPERATION, NULL, 0);
-                hdev->poll_started = false;
-        }
-}
-
-static struct nfc_target *hci_find_target(struct nfc_hci_dev *hdev,
-                                          u32 target_idx)
-{
-        int i;
-        if (hdev->poll_started == false || hdev->targets == NULL)
-                return NULL;
-
-        for (i = 0; i < hdev->target_count; i++) {
-                if (hdev->targets[i].idx == target_idx)
-                        return &hdev->targets[i];
-        }
-
-        return NULL;
+        nfc_hci_send_event(hdev, NFC_HCI_RF_READER_A_GATE,
+                           NFC_HCI_EVT_END_OPERATION, NULL, 0);
 }
 
-static int hci_activate_target(struct nfc_dev *nfc_dev, u32 target_idx,
-                               u32 protocol)
+static int hci_activate_target(struct nfc_dev *nfc_dev,
+                               struct nfc_target *target, u32 protocol)
 {
-        struct nfc_hci_dev *hdev = nfc_get_drvdata(nfc_dev);
-
-        if (hci_find_target(hdev, target_idx) == NULL)
-                return -ENOMEDIUM;
-
         return 0;
 }
 
-static void hci_deactivate_target(struct nfc_dev *nfc_dev, u32 target_idx)
+static void hci_deactivate_target(struct nfc_dev *nfc_dev,
+                                  struct nfc_target *target)
 {
 }
 
-static int hci_data_exchange(struct nfc_dev *nfc_dev, u32 target_idx,
+static int hci_data_exchange(struct nfc_dev *nfc_dev, struct nfc_target *target,
                              struct sk_buff *skb, data_exchange_cb_t cb,
                              void *cb_context)
 {
         struct nfc_hci_dev *hdev = nfc_get_drvdata(nfc_dev);
         int r;
-        struct nfc_target *target;
         struct sk_buff *res_skb = NULL;
 
-        pr_debug("target_idx=%d\n", target_idx);
-
-        target = hci_find_target(hdev, target_idx);
-        if (target == NULL)
-                return -ENOMEDIUM;
+        pr_debug("target_idx=%d\n", target->idx);
 
         switch (target->hci_reader_gate) {
         case NFC_HCI_RF_READER_A_GATE:
@@ -605,7 +561,18 @@ static int hci_data_exchange(struct nfc_dev *nfc_dev, u32 target_idx,
         return 0;
 }
 
-struct nfc_ops hci_nfc_ops = {
+static int hci_check_presence(struct nfc_dev *nfc_dev,
+                              struct nfc_target *target)
+{
+        struct nfc_hci_dev *hdev = nfc_get_drvdata(nfc_dev);
+
+        if (hdev->ops->check_presence)
+                return hdev->ops->check_presence(hdev, target);
+
+        return 0;
+}
+
+static struct nfc_ops hci_nfc_ops = {
         .dev_up = hci_dev_up,
         .dev_down = hci_dev_down,
         .start_poll = hci_start_poll,
@@ -613,6 +580,7 @@ struct nfc_ops hci_nfc_ops = {
         .activate_target = hci_activate_target,
         .deactivate_target = hci_deactivate_target,
         .data_exchange = hci_data_exchange,
+        .check_presence = hci_check_presence,
 };
 
 struct nfc_hci_dev *nfc_hci_allocate_device(struct nfc_hci_ops *ops,
diff --git a/net/nfc/hci/shdlc.c b/net/nfc/hci/shdlc.c
index 923bdf7c26d6..5665dc6d893a 100644
--- a/net/nfc/hci/shdlc.c
+++ b/net/nfc/hci/shdlc.c
@@ -816,6 +816,17 @@ static int nfc_shdlc_data_exchange(struct nfc_hci_dev *hdev,
         return -EPERM;
 }
 
+static int nfc_shdlc_check_presence(struct nfc_hci_dev *hdev,
+                                    struct nfc_target *target)
+{
+        struct nfc_shdlc *shdlc = nfc_hci_get_clientdata(hdev);
+
+        if (shdlc->ops->check_presence)
+                return shdlc->ops->check_presence(shdlc, target);
+
+        return 0;
+}
+
 static struct nfc_hci_ops shdlc_ops = {
         .open = nfc_shdlc_open,
         .close = nfc_shdlc_close,
@@ -825,6 +836,7 @@ static struct nfc_hci_ops shdlc_ops = {
         .target_from_gate = nfc_shdlc_target_from_gate,
         .complete_target_discovered = nfc_shdlc_complete_target_discovered,
         .data_exchange = nfc_shdlc_data_exchange,
+        .check_presence = nfc_shdlc_check_presence,
 };
 
 struct nfc_shdlc *nfc_shdlc_allocate(struct nfc_shdlc_ops *ops,
diff --git a/net/nfc/llcp/commands.c b/net/nfc/llcp/commands.c
index 11a3b7d98dc5..bf8ae4f0b90c 100644
--- a/net/nfc/llcp/commands.c
+++ b/net/nfc/llcp/commands.c
@@ -488,7 +488,7 @@ int nfc_llcp_send_i_frame(struct nfc_llcp_sock *sock,
 
                 memcpy(skb_put(pdu, frag_len), msg_ptr, frag_len);
 
-                skb_queue_head(&sock->tx_queue, pdu);
+                skb_queue_tail(&sock->tx_queue, pdu);
 
                 lock_sock(sk);
 
@@ -502,7 +502,7 @@ int nfc_llcp_send_i_frame(struct nfc_llcp_sock *sock,
 
         kfree(msg_data);
 
-        return 0;
+        return len;
 }
 
 int nfc_llcp_send_rr(struct nfc_llcp_sock *sock)
diff --git a/net/nfc/llcp/llcp.c b/net/nfc/llcp/llcp.c
index 92988aa620dc..42994fac26d6 100644
--- a/net/nfc/llcp/llcp.c
+++ b/net/nfc/llcp/llcp.c
@@ -448,6 +448,8 @@ static struct nfc_llcp_sock *nfc_llcp_sock_get(struct nfc_llcp_local *local,
 {
         struct nfc_llcp_sock *sock, *llcp_sock, *n;
 
+        pr_debug("ssap dsap %d %d\n", ssap, dsap);
+
         if (ssap == 0 && dsap == 0)
                 return NULL;
 
@@ -783,6 +785,7 @@ static void nfc_llcp_recv_disc(struct nfc_llcp_local *local,
 static void nfc_llcp_recv_cc(struct nfc_llcp_local *local, struct sk_buff *skb)
 {
         struct nfc_llcp_sock *llcp_sock;
+        struct sock *sk;
         u8 dsap, ssap;
 
         dsap = nfc_llcp_dsap(skb);
@@ -801,10 +804,14 @@ static void nfc_llcp_recv_cc(struct nfc_llcp_local *local, struct sk_buff *skb)
         }
 
         llcp_sock->dsap = ssap;
+        sk = &llcp_sock->sk;
 
         nfc_llcp_parse_tlv(local, &skb->data[LLCP_HEADER_SIZE],
                            skb->len - LLCP_HEADER_SIZE);
 
+        sk->sk_state = LLCP_CONNECTED;
+        sk->sk_state_change(sk);
+
         nfc_llcp_sock_put(llcp_sock);
 }
 
diff --git a/net/nfc/llcp/sock.c b/net/nfc/llcp/sock.c
index c13e02ebdef9..3f339b19d140 100644
--- a/net/nfc/llcp/sock.c
+++ b/net/nfc/llcp/sock.c
@@ -27,6 +27,42 @@
 #include "../nfc.h"
 #include "llcp.h"
 
+static int sock_wait_state(struct sock *sk, int state, unsigned long timeo)
+{
+        DECLARE_WAITQUEUE(wait, current);
+        int err = 0;
+
+        pr_debug("sk %p", sk);
+
+        add_wait_queue(sk_sleep(sk), &wait);
+        set_current_state(TASK_INTERRUPTIBLE);
+
+        while (sk->sk_state != state) {
+                if (!timeo) {
+                        err = -EINPROGRESS;
+                        break;
+                }
+
+                if (signal_pending(current)) {
+                        err = sock_intr_errno(timeo);
+                        break;
+                }
+
+                release_sock(sk);
+                timeo = schedule_timeout(timeo);
+                lock_sock(sk);
+                set_current_state(TASK_INTERRUPTIBLE);
+
+                err = sock_error(sk);
+                if (err)
+                        break;
+        }
+
+        __set_current_state(TASK_RUNNING);
+        remove_wait_queue(sk_sleep(sk), &wait);
+        return err;
+}
+
 static struct proto llcp_sock_proto = {
         .name     = "NFC_LLCP",
         .owner    = THIS_MODULE,
@@ -304,11 +340,24 @@ static unsigned int llcp_sock_poll(struct file *file, struct socket *sock,
                 mask |= POLLERR;
 
         if (!skb_queue_empty(&sk->sk_receive_queue))
-                mask |= POLLIN;
+                mask |= POLLIN | POLLRDNORM;
 
         if (sk->sk_state == LLCP_CLOSED)
                 mask |= POLLHUP;
 
+        if (sk->sk_shutdown & RCV_SHUTDOWN)
+                mask |= POLLRDHUP | POLLIN | POLLRDNORM;
+
+        if (sk->sk_shutdown == SHUTDOWN_MASK)
+                mask |= POLLHUP;
+
+        if (sock_writeable(sk))
+                mask |= POLLOUT | POLLWRNORM | POLLWRBAND;
+        else
+                set_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags);
+
+        pr_debug("mask 0x%x\n", mask);
+
         return mask;
 }
 
@@ -462,9 +511,13 @@ static int llcp_sock_connect(struct socket *sock, struct sockaddr *_addr,
         if (ret)
                 goto put_dev;
 
-        sk->sk_state = LLCP_CONNECTED;
+        ret = sock_wait_state(sk, LLCP_CONNECTED,
+                              sock_sndtimeo(sk, flags & O_NONBLOCK));
+        if (ret)
+                goto put_dev;
 
         release_sock(sk);
+
         return 0;
 
 put_dev:
diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c
index 8737c2089fdd..d560e6f13072 100644
--- a/net/nfc/nci/core.c
+++ b/net/nfc/nci/core.c
@@ -436,16 +436,16 @@ static void nci_stop_poll(struct nfc_dev *nfc_dev)
                     msecs_to_jiffies(NCI_RF_DEACTIVATE_TIMEOUT));
 }
 
-static int nci_activate_target(struct nfc_dev *nfc_dev, __u32 target_idx,
-                               __u32 protocol)
+static int nci_activate_target(struct nfc_dev *nfc_dev,
+                               struct nfc_target *target, __u32 protocol)
 {
         struct nci_dev *ndev = nfc_get_drvdata(nfc_dev);
         struct nci_rf_discover_select_param param;
-        struct nfc_target *target = NULL;
+        struct nfc_target *nci_target = NULL;
         int i;
         int rc = 0;
 
-        pr_debug("target_idx %d, protocol 0x%x\n", target_idx, protocol);
+        pr_debug("target_idx %d, protocol 0x%x\n", target->idx, protocol);
 
         if ((atomic_read(&ndev->state) != NCI_W4_HOST_SELECT) &&
             (atomic_read(&ndev->state) != NCI_POLL_ACTIVE)) {
@@ -459,25 +459,25 @@ static int nci_activate_target(struct nfc_dev *nfc_dev, __u32 target_idx,
         }
 
         for (i = 0; i < ndev->n_targets; i++) {
-                if (ndev->targets[i].idx == target_idx) {
-                        target = &ndev->targets[i];
+                if (ndev->targets[i].idx == target->idx) {
+                        nci_target = &ndev->targets[i];
                         break;
                 }
         }
 
-        if (!target) {
+        if (!nci_target) {
                 pr_err("unable to find the selected target\n");
                 return -EINVAL;
         }
 
-        if (!(target->supported_protocols & (1 << protocol))) {
+        if (!(nci_target->supported_protocols & (1 << protocol))) {
                 pr_err("target does not support the requested protocol 0x%x\n",
                        protocol);
                 return -EINVAL;
         }
 
         if (atomic_read(&ndev->state) == NCI_W4_HOST_SELECT) {
-                param.rf_discovery_id = target->logical_idx;
+                param.rf_discovery_id = nci_target->logical_idx;
 
                 if (protocol == NFC_PROTO_JEWEL)
                         param.rf_protocol = NCI_RF_PROTOCOL_T1T;
@@ -501,11 +501,12 @@ static int nci_activate_target(struct nfc_dev *nfc_dev, __u32 target_idx,
         return rc;
 }
 
-static void nci_deactivate_target(struct nfc_dev *nfc_dev, __u32 target_idx)
+static void nci_deactivate_target(struct nfc_dev *nfc_dev,
+                                  struct nfc_target *target)
 {
         struct nci_dev *ndev = nfc_get_drvdata(nfc_dev);
 
-        pr_debug("target_idx %d\n", target_idx);
+        pr_debug("target_idx %d\n", target->idx);
 
         if (!ndev->target_active_prot) {
                 pr_err("unable to deactivate target, no active target\n");
@@ -520,14 +521,14 @@ static void nci_deactivate_target(struct nfc_dev *nfc_dev, __u32 target_idx)
         }
 }
 
-static int nci_data_exchange(struct nfc_dev *nfc_dev, __u32 target_idx,
+static int nci_data_exchange(struct nfc_dev *nfc_dev, struct nfc_target *target,
                              struct sk_buff *skb,
                              data_exchange_cb_t cb, void *cb_context)
 {
         struct nci_dev *ndev = nfc_get_drvdata(nfc_dev);
         int rc;
 
-        pr_debug("target_idx %d, len %d\n", target_idx, skb->len);
+        pr_debug("target_idx %d, len %d\n", target->idx, skb->len);
 
         if (!ndev->target_active_prot) {
                 pr_err("unable to exchange data, no active target\n");
diff --git a/net/nfc/nci/data.c b/net/nfc/nci/data.c
index a0bc326308a5..76c48c5324f8 100644
--- a/net/nfc/nci/data.c
+++ b/net/nfc/nci/data.c
@@ -49,7 +49,7 @@ void nci_data_exchange_complete(struct nci_dev *ndev, struct sk_buff *skb,
 
         if (cb) {
                 ndev->data_exchange_cb = NULL;
-                ndev->data_exchange_cb_context = 0;
+                ndev->data_exchange_cb_context = NULL;
 
                 /* forward skb to nfc core */
                 cb(cb_context, skb, err);
@@ -200,10 +200,10 @@ static void nci_add_rx_data_frag(struct nci_dev *ndev,
                         pr_err("error adding room for accumulated rx data\n");
 
                         kfree_skb(skb);
-                        skb = 0;
+                        skb = NULL;
 
                         kfree_skb(ndev->rx_data_reassembly);
-                        ndev->rx_data_reassembly = 0;
+                        ndev->rx_data_reassembly = NULL;
 
                         err = -ENOMEM;
                         goto exit;
@@ -216,7 +216,7 @@ static void nci_add_rx_data_frag(struct nci_dev *ndev,
 
                 /* third, free old reassembly */
                 kfree_skb(ndev->rx_data_reassembly);
-                ndev->rx_data_reassembly = 0;
+                ndev->rx_data_reassembly = NULL;
         }
 
         if (pbf == NCI_PBF_CONT) {
diff --git a/net/nfc/nci/lib.c b/net/nfc/nci/lib.c
index 6a63e5eb483d..6b7fd26c68d9 100644
--- a/net/nfc/nci/lib.c
+++ b/net/nfc/nci/lib.c
@@ -31,6 +31,7 @@
 #include <linux/errno.h>
 
 #include <net/nfc/nci.h>
+#include <net/nfc/nci_core.h>
 
 /* NCI status codes to Unix errno mapping */
 int nci_to_errno(__u8 code)
diff --git a/net/nfc/nci/ntf.c b/net/nfc/nci/ntf.c
index 99e1632e6aac..cb2646179e5f 100644
--- a/net/nfc/nci/ntf.c
+++ b/net/nfc/nci/ntf.c
@@ -497,7 +497,7 @@ static void nci_rf_deactivate_ntf_packet(struct nci_dev *ndev,
         /* drop partial rx data packet */
         if (ndev->rx_data_reassembly) {
                 kfree_skb(ndev->rx_data_reassembly);
-                ndev->rx_data_reassembly = 0;
+                ndev->rx_data_reassembly = NULL;
         }
 
         /* complete the data exchange transaction, if exists */
diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c
index f1829f6ae9c5..581d419083aa 100644
--- a/net/nfc/netlink.c
+++ b/net/nfc/netlink.c
@@ -33,7 +33,7 @@ static struct genl_multicast_group nfc_genl_event_mcgrp = {
         .name = NFC_GENL_MCAST_EVENT_NAME,
 };
 
-struct genl_family nfc_genl_family = {
+static struct genl_family nfc_genl_family = {
         .id = GENL_ID_GENERATE,
         .hdrsize = 0,
         .name = NFC_GENL_NAME,
@@ -128,7 +128,7 @@ static int nfc_genl_dump_targets(struct sk_buff *skb,
                 cb->args[1] = (long) dev;
         }
 
-        spin_lock_bh(&dev->targets_lock);
+        device_lock(&dev->dev);
 
         cb->seq = dev->targets_generation;
 
@@ -141,7 +141,7 @@ static int nfc_genl_dump_targets(struct sk_buff *skb,
                 i++;
         }
 
-        spin_unlock_bh(&dev->targets_lock);
+        device_unlock(&dev->dev);
 
         cb->args[0] = i;
 
diff --git a/net/nfc/nfc.h b/net/nfc/nfc.h
index 7d589a81942e..3dd4232ae664 100644
--- a/net/nfc/nfc.h
+++ b/net/nfc/nfc.h
@@ -84,7 +84,7 @@ static inline int nfc_llcp_set_remote_gb(struct nfc_dev *dev,
         return 0;
 }
 
-static inline u8 *nfc_llcp_general_bytes(struct nfc_dev *dev, u8 *gb_len)
+static inline u8 *nfc_llcp_general_bytes(struct nfc_dev *dev, size_t *gb_len)
 {
         *gb_len = 0;
         return NULL;