yashsingh1/xdaforums huggingface dataset:
[NFC Hacking] kotzir:
Guys there are some opensource repositories on CyanogenMod for NFC:

android_vendor_nxp-nfc_opensource_Nfc

android_vendor_nxp-nfc_opensource_libnfc-nci

android_vendor_nxp-nfc_opensource_frameworks

Could they solve our issue on AOSP based ROMS?
[NFC Hacking] lorn10:
Sorry to bother, - I know this thread is old....

Well, that seems not entirely true, - xda member bleached has build (three years ago) CM 10.1 (with Kernel 2.6.38.6 and closed-source PN544 libraries) for the Galaxy Mini 2 S6500 with working NFC. Android Beam works nice, however no HCE support is avaiable. (https://xdaforums.com/showthread.php?t=2682511)

According to this MasterCard document (http://mastercard-mobilepartner.com/docs/NFC_FW_NXP_v2_7_150616.pdf) at least the PN544 C3 (PN65O) controller should be able with firmware 1.41 to handle both HCE and SE.

However, exist there really no way to upgrade a PN544 firmware? How can I check the chip and firmware version? The latest available firmware releases for the following two PN544 revisions are:

PN544 C2 ------------------> 110.16 or 108.12 (without "device registration/testing")

PN544 C3 (PN65O) --------> 1.41

These repositories are unfortunately not NXP PN544 related, - these applies to newer NXP NFC controllers.
[NFC Hacking] ADB100:
Any updates to this thread?

I know this is an old thread and hasn't been updated for a while but I would really like to get HCE working with my HTC One M8 running Lineage 14.1.

It appears the stock Android 6.0 ROM supports HCE but the drivers from the stock ROM are not compatible with AOSP. I have downloaded the kernel source code from htcdev.com for the HTC One M8 and the PN544 drivers were originally written by someone at Nokia and these drivers appear all over the place (pn544.c).

I have found what I think is a source of later Intel written PN544 drivers here - http://elixir.free-electrons.com/linux/v3.19.8/source/drivers/nfc/pn544

If you look through the folders the Nokia driver appears in version 2.6.38-rc1 and remains the same until 3.5-rc1 where a new Intel driver (pn544_hci.c) appears alongside the Nokia driver (pn544.c). It remains like this until version of 3.6.11 and then when 3.7 appears the Nokia driver is removed. When version 3.8 appears the PN544 driver then has its own folder, its name reverts to 'pn544.c' and it remains the Intel driver right up to the latest 4.13-rc1 version.

I am guessing this is all Linux Kernel stuff as the latest Linux Kernel is 4.13-rc1?

I am hoping this sparks some activity?

Andy
[NFC Hacking] krouma:
I found PDF (https://www.nxp.com/documents/application_note/AN11690.pdf) made by NXP and there is tutorial for PN54X chips how to install some bridge and then you can use NCI drivers. I am trying to get it working on my Xperia M but I have some errors now.
[NFC Hacking] ADB100:
Can't open that document - I get 'page not found'.

I think even if we manage to replace the drivers then the firmware would need to be version 1.41 - assuming its a PN544 C3 varient? There seems to be no way to upgrade the firmware that I have found so far?

Andy
[NFC Hacking] ru6ak:
Remove the parenthesis at the end of the link, and download the document
[NFC Hacking] krouma:
I edited URL (wrong position of bracket) and it's accessible now.

I don't know which version of firmware and variant of PN544 I have in my phone. How can I find it out?
[NFC Hacking] ADB100:
Cheers, just opened it. Looks interesting...

I have no idea how to find out the firmware version of the PN544 unfortunately...

Andy
[NFC Hacking] ADB100:
PN544 drivers on Google's Android GIT?

Even the drivers on Google's GIT are the newer Intel PN544 HCI drivers as opposed to the older Nokia written drivers?

https://android.googlesource.com/kernel/msm/+/android-msm-angler-3.10-nougat/drivers/nfc/pn544/

I don't have the skills to intergrate these drivers into an Android build for my HTC One M8 - I guess there are people on here who do have the skills though?

Andy
[NFC Hacking] hackintosh5:
The link looks good - make sure to use section 6 paragraph 1 is important for seLinux.
[NFC Hacking] mirhl:
https://github.com/torvalds/linux/commit/06c660340f1e142b607541ece3520fff3f5d2c39

https://github.com/torvalds/linux/commit/f1dd56fdc4b7474bfbda1753b42526dc144b55dd

Seems to be clearly defined in the first 200 lines here

https://github.com/torvalds/linux/blob/master/drivers/nfc/pn544/i2c.c

EDIT: moar

EDIT2:

So.. First of all HAL version is just a stupid define with some bitwise operation.

Secondly, FW version should be made of RomLib, aka hardware variant, plus major version, plus minor version. All in hex.

If you convert the last byte into decimal, you get Rev, while the second last should be Full_SW. As I confirmed here, those also matched the firmware version of the libpn544_fw lib.

I'm not super clear about HW then, but you can get a sense of it from the raw i2c dump and hci source (the part before 62 00 03 shouldn't count since it's just the HCP header)

I couldn't find a pn544 that hadn't that code (including a nexus S!) though, so I'll call it a day too.

HCI should report whatever conformance level you have with UICC-CLF/HCI spec.

What instead remains a mystery is model (for as much as nobody seems to care about it at least directly)

0, 1, 10, 11, 12 are all real world values, and firmware, nor even *actual same* phone sku, seem to bring it any regularity.

EDIT3: the old user manual unfortunately only has one figure. If anybody had newer one..
[NFC Hacking] ajp8868:
How likely is it looking that this will be achievable?
[NFC Hacking] abuttino:
Once you have everything decompiled, I'll start to get another email campaign going to Dan Rosenberg, koush, hashcode and maybe dhacker. If they can solve it, it'll get merged. Hopefully they can help, otherwise, I'll call in some others.
[NFC Hacking] Entropy512:
Lots of devices have NXP chips. The Galaxy S4 is one of the only non-Nexus devices I know of with an NCI-compliant chipset (These are all Broadcom chips, but apparently NCI is not a division of Broadcom but a new standard for NFC controller interfacing). Sony Xperias all use NXP chips too.
[NFC Hacking] abuttino:
This should mean the pressure is on for Google to release the chipset drivers if they cleared the oppo for CM.

Edit: either Google or NXP should be under pressure.
[NFC Hacking] jonathan6131us:
Good news! I've contacted Google Wallet tier 3 support, and from what the advisor told me, I understood he might be pushing the Android Development team to include the NXP stack in 4.4.3. Don't take my word for it, as he said he "may not release confidential information to the end-user"
[NFC Hacking] abuttino:
Wow, amazing. Please pm me how you got in touch with him. I'll put a professional letter together that will gain some more attention.
[NFC Hacking] Entropy512:
No reason for this, considering that:

1) They only approved 4.3 on the N1

2) HCE support is not required for GMS approval on KitKat as evidenced by grouper and tilapia
[NFC Hacking] Azbulldog:
I just received my first NFC-enabled debit card today, and am saddened to find that my phone is still unsupported, unless there is something I missed. Has there been any further progress on this project?
[NFC Hacking] abuttino:
We are still waiting for him to finish decompiling the files.
[NFC Hacking] Borderpatrol1987:
Sorry for the delay guys, I manage a retail store, and had to get through some cleanup projects that stole all my time. I intend to work on this later tonight and tomorrow.
[NFC Hacking] Borderpatrol1987:
allrighty,

Here's what I could pull out that wasn't in binary.

https://drive.google.com/folderview?id=0BweamVOxcuOmLXBsWHdLMHNtbHM&usp=sharing

Code 1 - 5 are what I pulled out tonight.

If you cant access GDrive and want to host them else where let me know.

Drew
[NFC Hacking] azreark1:
Okay, so this is probably a really stupid question but what exactly are we looking for? I'd love to help out and have tons of time on my shift to sift through these files if i knew what i was looking for...
[NFC Hacking] abuttino:
What we are doing is decompiling the jni code for more experienced coders to discover what code is missing from the HCE driver, then to add that code to the AOSP HCE driver.
[NFC Hacking] azreark1:
Where are the hce drivers located?

Posted from my Outlaw(unlocked) XT926, Verizon can suck it.
[NFC Hacking] Borderpatrol1987:
The code is somewhere in the files that I posted last night. The challenge is to find it.
[NFC Hacking] azreark1:
I meant where's the original HCE to compare it with...?
[NFC Hacking] abuttino:
It's in any NXP Google Edition phone's ROM

HTC one, LG G2, etc.
[NFC Hacking] Borderpatrol1987:
I don't know if this link is of any help to find what we are looking for. https://jira.cyanogenmod.org/plugins/servlet/mobile#issue/CYAN-2935
[NFC Hacking] azreark1:
Disregard.
[NFC Hacking] Azbulldog:
Any further developments?
[NFC Hacking] abuttino:
Unfortunately not. The Google wallet team is on this as well. We should see something in the next Android version if anything.
[NFC Hacking] 830hobbes:
I can't post a link yet but NFC World has a new article about NXP updating their firmware for HCE NFC payments. Does this mean those of us with NXP chips will be getting google wallet soon?
[NFC Hacking] abuttino:
It very well could be!
[NFC Hacking] open1your1eyes0:
Looks like the Galaxy S5 is going to have the NXP chipset as well (like the Note 3) but this time they aren't even adding the secure element (probably not important for KitKat's HCE but worth noting).

Source
[NFC Hacking] Entropy512:
I've never heard of the PN547 before. (Most devices so far have had the PN544, or the combo PN65N - the PN65N is a PN544 with embedded SE)

A bit of searching implies that it may possibly be NCI-compliant, and if not, NXP is making sure it will be HCE-capable with KK. (The question, of course, being if this HCE support is opensource or not...)
[NFC Hacking] abuttino:
Can anyone verify the NXP HCE drivers are in the aosp stack? Someone on the jira was saying they are in.
[NFC Hacking] Entropy512:
Nothing new in packages/apps/Nfc in AOSP master - at least nothing related to NXP

Google doesn't use JIRA
[NFC Hacking] abuttino:
*17/Mar/14 1:14 AM

It seems that NXP has finally added HCE support into AOSP! Has anyone gotten Google Wallet working on any NXP devices?

Is what I got from CM's JIRA

https://jira.cyanogenmod.org/plugins/servlet/mobile#issue/CYAN-2935
[NFC Hacking] gk1984:
Not working for me on this morning's nightly for the Sprint HTC One. I miss G Wallet tap and pay...
[NFC Hacking] abuttino:
After Entropy's observances in the AOSP code, I don't think it's really in
[NFC Hacking] abuttino:
Can someone check the AOSP code for 4.4.3 when it comes out? Should be within the next week
[NFC Hacking] gk1984:
Forgive my ignorance but how do you know we'll see 4.4.3 within a week?
[NFC Hacking] abuttino:
Speculation based on observances. Can't really call it a hypothesis..
[NFC Hacking] gk1984:
Alright, thanks. I saw people claim to have already received it but was determined a hoax. Kinda killed my trust in these claims.
[NFC Hacking] abuttino:
Ha!!

Effectively 2 days off.. Not a bad observation.

http://support.sprint.com/support/a...AndUpdateTheSoftwareVersionOnYourGoogleNexus5

It should hit AOSP soon now.
[NFC Hacking] Epicnole:
Since the Nexus 5 came out, has any been able to get tap and pay to work in CM11? I would really like it to work again or get some other tap and pay (isis) to work on my sprint phone.
[NFC Hacking] Entropy512:
They've had no problem getting it to work on devices with Broadcom NFC.

As the topic of this entire thread indicates, NXP NFC is a whole different story.
[NFC Hacking] open1your1eyes0:
It looks like the Galaxy S5 (which has NXP chipset) is currently working out of box with Google Wallet on 4.4.2. Has anyone looked into what method they are using? My guess is closed-source support like HTC and Motorola did but just curious.
[NFC Hacking] abuttino:
They are using the drivers that NXP provided them with. AOSP ROMs don't have that driver. Which is the point of this thread.
[NFC Hacking] Entropy512:
Either the HTC/Sony trick (closed-source support), or I've seen rumors that the PN547 might possibly be partially NCI-compliant.
[NFC Hacking] gk1984:
Did anyone notice anything in the leaked Android 4.4.3 changelog to give us any hope of NXP support coming to Android 4.4.3? I didn't see anything, but I just used ctrl+f and searched for a few keywords, and I'm not a developer so I could have easily missed something.
[NFC Hacking] abuttino:
Nobody has gotten their hands on 4.4.3 source as far as I've heard. I'm currently waiting to see what happens with my xt926 and the new stock ROMs
[NFC Hacking] Entropy512:
The 4.4.3 changelog didn't look promising... Although it did look weird.

They added some CTS checks to make sure HCE was supported - but didn't add HCE for NXP chips.

Either the changelog is incomplete or grouper is going to start failing CTS!
[NFC Hacking] gk1984:
So... if it's not looking good that 4.4.3 will allow NXP chip users to use Wallet's tap and pay and 4.4.3 isn't out yet... are we still working on this or on hold? I'm starting to think google is holding off on 4.4.3 for I/O at the end of June...
[NFC Hacking] abuttino:
I JUST tried the NFC stack that Verizon just released for my XT926 that has an NXP controller in it. No go.
[NFC Hacking] osm0sis:
I'm comparing the closed implementations and the vendor fw libs for the pn544 are identical on both. :good:

As is libnfc_ndef. The GPe m7 has a bit more of a community than the GPe togari, so I even found a deodexed stock ROM to pull the Nfc.apk from. I'll let you know how it goes.
[NFC Hacking] osm0sis:
So weirdly enough, adding the hce permissions file alone made my ROM show the "Tap & pay" Settings menu item, but adding either the pn544 fw lib, or a re-signed (I used platform keys and the service definitely loads) Nfc.apk and the option goes away again. No difference with ndef, though no obvious issues either. Then the main lib.nfc and lib.nfc_jni files (which do differ between m7 and togari) caused FCs so I called it quits.

Any ideas?
[NFC Hacking] abuttino:
Nope.. Same problems I ran into
[NFC Hacking] raddatt:
I just want to say you guys are doing awesome work here, thank you for it! It's hard to believe that so many NFC-capable phones are unable to use GW Tap and Pay. I have an Oppo N1 with the PN544 chip. I'm not a dev and don't have any experience with NFC hacking, but please let me know if there's anything I can do to help. Keep up the great work! :good: We're rooting for you :)
[NFC Hacking] abuttino:
If you want to help out, please contact anyone you know that can read decompiled JNI code and tell of this thread.
[NFC Hacking] gk1984:
Yesterday on the Google Wallet community, a rep from nxp invited users to communicate with their support on their own forum about this. I posted to the forum asking for the appropriate code to be contributed to aosp this afternoon.

EDIT: links - Google community: https://productforums.google.com/forum/#!msg/wallet/xvpxh5hyyLM/sqOXKiMmvJcJ

NXP support forum: http://nxpcommunity.force.com/community/apex/CommunityRFPage#!/feedtype=SINGLE_QUESTION_DETAIL&dc=RF&criteria=ALLQUESTIONS&id=906D0000000L4EKIA0
[NFC Hacking] raddatt:
Very nice. Apparently, they are saying it should be in another community category? I searched each category, and it looks like the "Identification and Security" category is the one with other NFC threads. Also, someone had posted last year in the RF Small Signal category about an issue related to ours, and NXP directed them to "Identification and Security", as well.

Can you please try that? Thank you.
[NFC Hacking] gk1984:
I reposted in the appropriate section over there. Thanks for finding that. I wasn't entirely sure which section to try initially. But hey, something is better than nothing, right? Hopefully there's a response. I received an email when they responded, so I'll share what I get when I have a response.
[NFC Hacking] raddatt:
Yes, their categories are pretty confusing. Thanks, let's hope for the best.
[NFC Hacking] Defenestratus:
4.4.3 is pushed to AOSP. Are the components we need in that dump or are we still stranded?
[NFC Hacking] abuttino:
We won't know for a while. But if you want to look at the source code, you can probably see if the NXP stack is there.. I'm in the middle of putting data on my new phone
[NFC Hacking] Entropy512:
Nope, we're hosed.
[NFC Hacking] abuttino:
I am glad I upgraded my phone. It would be nice to run CM again but I'll stick with stock until NXP gets on the ball
[NFC Hacking] osm0sis:
Nexus 7 2013 on 4.4.3 now has 2 NFC apks: /system/app/NfcNci.apk and /system/priv-app/NfcProvision.apk; I realize this is Broadcom, but it's a significant change to the NFC framework, so I guess we'll have to see what those closed-source NXP PN544 devices do with 4.4.3 and then we can likely try using the re-signed files again. :good:

http://www.androidpolice.com/2014/0...e-starting-with-the-htc-one-m7-and-galaxy-s4/
[NFC Hacking] lionelhuts:
Bad news. I'm running stock 4.4.3 on the 2012 Nexus 7 which has an NXP NFC chip and Tap and Pay is not available.
[NFC Hacking] osm0sis:
I know.. :(

Oh well, stay hopeful.. Like I said, we can try bringing the apks/binaries/libraries over again from the GPe devices and try that again since it seems some things have changed. :good:
[NFC Hacking] abuttino:
I've already done that with the xt926.. It didn't work.
[NFC Hacking] osm0sis:
Doesn't have 4.4.3 yet, I don't think? I mean the Xperia Ultra Z GPe and One M7 GPe since they just got the OTAs and are far more likely to have files that could also work on another AOSP device. :good: :)
[NFC Hacking] abuttino:
4.4.3 offered nothing for NFC. That's why Entropy said "we're hosed"

The best I can say, get on their ass at NXP. This is just stupid. If google has any shot if making wallet work, they gotta do something quick
[NFC Hacking] gk1984:
I thought I read somewhere that the 2012 Nexus 7 didn't support hce due to hardware limitations. Might not be completely hopeless for the rest of us.
[NFC Hacking] lionelhuts:
The 2012 N7 HW can support HCE. It just needs proper NXP drivers in AOSP to do it.
[NFC Hacking] Entropy512:
Based on some recent info from Martin at Google who replied to a G+ post of mine:

It lacks the ability to do AID routing, e.g. "HCE the way Google intended" - selectively routing to the host OR the SE depending on what the AID coming from the reader is. (Some PN544s do it, some don't).

The thing is - there's not really any point to routing to the SE any more now that Wallet no longer supports SE-based tap-to-pay. But still, since it doesn't do AID routing and it's apparently a fairly large patchset, Google has chosen not to implemented. (Also, NXP probably is choosing to keep it proprietary for whatever reason...) Actually, I should ask Martin about the whole "what's the point of an SE any more?" thing.

In theory it's possible, but in practice it's a huge amount of work unless someone has a copy of the ARM Hex-Rays decompiler (a disassembler won't really help that much, and IDA without the decompiler probably won't be of too much use.) Even if someone does use Hex-Rays, the result would be of questionable legality.
[NFC Hacking] abuttino:
I kinda figured that. When you get into card acceptance, there is so much red tape, it's not even worth it.

/ISA for a major merchant company
[NFC Hacking] gk1984:
Has anyone tried pulling files from htc one gpe 4.4.3 update yet? I know it didn't work before but crossing my fingers something changed
[NFC Hacking] Entropy512:
No. I've been poking at the OnePlus system dump. It appears there are now two approaches to doing this:

1) A more "legacy" approach that patches the NXP libnfc, etc. to support HCE

2) A "newer" approach that implements an NCI translation layer between the NXP chip and the rest of the system. However, this appears to require alternate firmware on the PN544 and I have not identified a way to switch between "legacy" firmware and "modern" firmware yet. (e.g. I haven't been able to get the blobset to even work on a Find 7a which is nearly identical to the OnePlus.)
[NFC Hacking] gk1984:
Thanks. I don't have any experience in development but willing to help if I can. I may need a little guidance but would love to take a piece of this.
[NFC Hacking] TheWhisp:
Do those Google Play edition devices have PN544? There are some [Samsung] devices with PN547 on which NFC is completely broken. Seems that AOSP doesn't support it, or am I doing something wrong?
[NFC Hacking] Entropy512:
Yes.

Right now:

PN544 - no HCE except via closed source

PN547 - I think CM got the NCI HAL working on the Note3 but not sure, they may have had to use blobs to do it.

It appears it may be possible to firmware-flash the PN544 into an NCI or pseudo-NCI mode where it behaves more similar to a PN547 (this appears to be what CM11S on the OnePlus One is doing), however it may be this flash has to occur at the factory. PN544 firmware flashing has always been a little "wtf is going on here?" to me. For example, Samsung stock firmwares for many devices could downgrade firmware, but AOSP-derivatives never could. I think if AOSP derivatives upgraded, it was non-persistent.
[NFC Hacking] abuttino:
I shouldn't ask this question.. But do you know if the Moto X has TnP support in CM or AOSP?

Sent from my Moto X
[NFC Hacking] Entropy512:
I'm fairly certain it doesn't. (I believe it uses an NXP PN544...)

I did some more poking with the OnePlus blobs. I think that the PN65T contained in the OPO is actually a PN547 variant, not PN544. Which makes that the most significant difference from the Find 7/7a.

If it IS the same chip and only has firmware differences, NXP made transitioning from "old" to "new" firmwares as difficult as possible. The NCI HAL from the OPO doesn't even attempt to load firmware when used on a Find 7, the HAL just fails. The new firmware blob is also very different from the PN544 blob, so you can't just try and use a PN544 HAL to forceload the new blob onto a chip running old firmware - but again, I suspect it's not just a firmware difference but a completely different chip. I'm looking to see if I can find some info on exactly how to identify the chip model/revision.

(The PN547 seems to use the same I2C interface as the PN544, and hence the same kernel driver.)
[NFC Hacking] gk1984:
If it's firmware, then why does hce work on gpe roms but not aosp? Or can a rom flash contain the firmware?
[NFC Hacking] Entropy512:
There's more than just firmware.

Pretty much there are two NFC driver architectures out there:

1) Legacy NXP drivers, seen on nearly (maybe all) PN544 devices. The opensource versions of this architecture have no HCE support at all. Some GPE devices have closed-source HCE support for this architecture

2) The new "NCI" interface. This is more standardized, and the device-specific stuff is contained in a single HAL blob that, in theory, is plug-and-play with the opensource NCI NFC stack in Android. The Broadcom NCI stack is fully opensource including the HAL blob. There's also an NXP NCI stack with a closed-source HAL blob but interfaces with the rest of the opensource drivers. This is what the OnePlus One uses.

The NCI-based NXP stack will NOT talk to a a chip running "legacy" PN544 firmware. I haven't determined yet if this is just a firmware difference, or in reality, the OnePlus uses a PN547 (newer chip) while the Find 7/7a uses an older PN544. All I know for sure is that the kernel driver is nearly identical (other than some secure element clocking stuff) and the OnePlus HAL won't talk to the Find 7/7a's chip.

All of the GPe devices seem to be using an HCE-modified legacy NXP stack - which is, again, closed-source.
[NFC Hacking] gk1984:
Any chance of something useful from the Android L port to the HTC One? I know it doesn't look like NFC itself is working, but I wonder how much from the port could open up HCE

http://xdaforums.com/htc-one/development/port-android-l-developer-preview-htc-one-t2812816
[NFC Hacking] Entropy512:
If NFC isn't working at all, it's even less useful than the existing KitKat firmware (which is partially useful but requires a ton of reverse engineering)