1 /******************************************************************************
2  *
3  *  Copyright (C) 2010-2014 Broadcom Corporation
4  *
5  *  Licensed under the Apache License, Version 2.0 (the "License");
6  *  you may not use this file except in compliance with the License.
7  *  You may obtain a copy of the License at:
8  *
9  *  http://www.apache.org/licenses/LICENSE-2.0
10  *
11  *  Unless required by applicable law or agreed to in writing, software
12  *  distributed under the License is distributed on an "AS IS" BASIS,
13  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14  *  See the License for the specific language governing permissions and
15  *  limitations under the License.
16  *
17  ******************************************************************************/
18 
19 /******************************************************************************
20  *
21  *  This is the main implementation file for the NFA HCI.
22  *
23  ******************************************************************************/
24 #include <android-base/logging.h>
25 #include <android-base/stringprintf.h>
26 #include <string.h>
27 
28 #include "nfa_dm_int.h"
29 #include "nfa_ee_api.h"
30 #include "nfa_ee_int.h"
31 #include "nfa_hci_api.h"
32 #include "nfa_hci_defs.h"
33 #include "nfa_hci_int.h"
34 #include "nfa_nv_co.h"
35 
36 using android::base::StringPrintf;
37 
38 /*****************************************************************************
39 **  Global Variables
40 *****************************************************************************/
41 
42 tNFA_HCI_CB nfa_hci_cb;
43 
44 #ifndef NFA_HCI_NV_READ_TIMEOUT_VAL
45 #define NFA_HCI_NV_READ_TIMEOUT_VAL 1000
46 #endif
47 
48 #ifndef NFA_HCI_CON_CREATE_TIMEOUT_VAL
49 #define NFA_HCI_CON_CREATE_TIMEOUT_VAL 1000
50 #endif
51 
52 /*****************************************************************************
53 **  Static Functions
54 *****************************************************************************/
55 
56 /* event handler function type */
57 static bool nfa_hci_evt_hdlr(NFC_HDR* p_msg);
58 
59 static void nfa_hci_sys_enable(void);
60 static void nfa_hci_sys_disable(void);
61 static void nfa_hci_rsp_timeout(void);
62 static void nfa_hci_conn_cback(uint8_t conn_id, tNFC_CONN_EVT event,
63                                tNFC_CONN* p_data);
64 static void nfa_hci_set_receive_buf(uint8_t pipe);
65 static void nfa_hci_assemble_msg(uint8_t* p_data, uint16_t data_len);
66 static void nfa_hci_handle_nv_read(uint8_t block, tNFA_STATUS status);
67 
68 /*****************************************************************************
69 **  Constants
70 *****************************************************************************/
71 static const tNFA_SYS_REG nfa_hci_sys_reg = {
72     nfa_hci_sys_enable, nfa_hci_evt_hdlr, nfa_hci_sys_disable,
73     nfa_hci_proc_nfcc_power_mode};
74 
75 /*******************************************************************************
76 **
77 ** Function         nfa_hci_ee_info_cback
78 **
79 ** Description      Callback function
80 **
81 ** Returns          None
82 **
83 *******************************************************************************/
nfa_hci_ee_info_cback(tNFA_EE_DISC_STS status)84 void nfa_hci_ee_info_cback(tNFA_EE_DISC_STS status) {
85   LOG(VERBOSE) << StringPrintf("%d", status);
86 
87   switch (status) {
88     case NFA_EE_DISC_STS_ON:
89       if ((!nfa_hci_cb.ee_disc_cmplt) &&
90           ((nfa_hci_cb.hci_state == NFA_HCI_STATE_STARTUP) ||
91            (nfa_hci_cb.hci_state == NFA_HCI_STATE_RESTORE))) {
92         /* NFCEE Discovery is in progress */
93         nfa_hci_cb.ee_disc_cmplt = true;
94         nfa_hci_cb.num_ee_dis_req_ntf = 0;
95         nfa_hci_cb.num_hot_plug_evts = 0;
96         nfa_hci_cb.conn_id = 0;
97         nfa_hci_startup();
98       }
99       break;
100 
101     case NFA_EE_DISC_STS_OFF:
102       if (nfa_hci_cb.ee_disable_disc) break;
103       nfa_hci_cb.ee_disable_disc = true;
104 
105       if ((nfa_hci_cb.hci_state == NFA_HCI_STATE_WAIT_NETWK_ENABLE) ||
106           (nfa_hci_cb.hci_state == NFA_HCI_STATE_RESTORE_NETWK_ENABLE)) {
107         if ((nfa_hci_cb.num_nfcee <= 1) ||
108             (nfa_hci_cb.num_ee_dis_req_ntf == (nfa_hci_cb.num_nfcee - 1)) ||
109             (nfa_hci_cb.num_hot_plug_evts == (nfa_hci_cb.num_nfcee - 1))) {
110           /* No UICC Host is detected or
111            * HOT_PLUG_EVT(s) and or EE DISC REQ Ntf(s) are already received
112            * Get Host list and notify SYS on Initialization complete */
113           nfa_sys_stop_timer(&nfa_hci_cb.timer);
114           if ((nfa_hci_cb.num_nfcee > 1) &&
115               (nfa_hci_cb.num_ee_dis_req_ntf != (nfa_hci_cb.num_nfcee - 1))) {
116             /* Received HOT PLUG EVT, we will also wait for EE DISC REQ Ntf(s)
117              */
118             nfa_sys_start_timer(&nfa_hci_cb.timer, NFA_HCI_RSP_TIMEOUT_EVT,
119                                 p_nfa_hci_cfg->hci_netwk_enable_timeout);
120           } else {
121             nfa_hci_cb.w4_hci_netwk_init = false;
122             nfa_hciu_send_get_param_cmd(NFA_HCI_ADMIN_PIPE,
123                                         NFA_HCI_HOST_LIST_INDEX);
124           }
125         }
126       } else if (nfa_hci_cb.num_nfcee <= 1) {
127         /* No UICC Host is detected, HCI NETWORK is enabled */
128         nfa_hci_cb.w4_hci_netwk_init = false;
129       }
130       break;
131 
132     case NFA_EE_DISC_STS_REQ:
133       nfa_hci_cb.num_ee_dis_req_ntf++;
134 
135       if (nfa_hci_cb.ee_disable_disc) {
136         /* Already received Discovery Ntf */
137         if ((nfa_hci_cb.hci_state == NFA_HCI_STATE_WAIT_NETWK_ENABLE) ||
138             (nfa_hci_cb.hci_state == NFA_HCI_STATE_RESTORE_NETWK_ENABLE)) {
139           /* Received DISC REQ Ntf while waiting for other Host in the network
140            * to bootup after DH host bootup is complete */
141           if ((nfa_hci_cb.num_ee_dis_req_ntf == (nfa_hci_cb.num_nfcee - 1)) &&
142               NFC_GetNCIVersion() < NCI_VERSION_2_0) {
143             /* Received expected number of EE DISC REQ Ntf(s) */
144             nfa_sys_stop_timer(&nfa_hci_cb.timer);
145             nfa_hci_cb.w4_hci_netwk_init = false;
146             nfa_hciu_send_get_param_cmd(NFA_HCI_ADMIN_PIPE,
147                                         NFA_HCI_HOST_LIST_INDEX);
148           }
149         } else if ((nfa_hci_cb.hci_state == NFA_HCI_STATE_STARTUP) ||
150                    (nfa_hci_cb.hci_state == NFA_HCI_STATE_RESTORE)) {
151           /* Received DISC REQ Ntf during DH host bootup */
152           if (nfa_hci_cb.num_ee_dis_req_ntf == (nfa_hci_cb.num_nfcee - 1)) {
153             /* Received expected number of EE DISC REQ Ntf(s) */
154             nfa_hci_cb.w4_hci_netwk_init = false;
155           }
156         }
157       }
158       break;
159     case NFA_EE_RECOVERY_REDISCOVERED:
160     case NFA_EE_MODE_SET_COMPLETE:
161       /*received mode set Ntf */
162       if ((nfa_hci_cb.hci_state == NFA_HCI_STATE_WAIT_NETWK_ENABLE) ||
163           (nfa_hci_cb.hci_state == NFA_HCI_STATE_RESTORE_NETWK_ENABLE) ||
164           (nfa_hci_cb.hci_state == NFA_HCI_STATE_EE_RECOVERY)) {
165         /* Discovery operation is complete, retrieve discovery result */
166         NFA_EeGetInfo(&nfa_hci_cb.num_nfcee, nfa_hci_cb.ee_info);
167         nfa_hci_enable_one_nfcee();
168       }
169       break;
170     case NFA_EE_RECOVERY_INIT:
171       /*NFCEE recovery in progress*/
172       nfa_ee_cb.isDiscoveryStopped = nfa_dm_act_stop_rf_discovery(nullptr);
173       nfa_hci_cb.hci_state = NFA_HCI_STATE_EE_RECOVERY;
174       break;
175   }
176 }
177 
178 /*******************************************************************************
179 **
180 ** Function         nfa_hci_init
181 **
182 ** Description      Initialize NFA HCI
183 **
184 ** Returns          None
185 **
186 *******************************************************************************/
nfa_hci_init(void)187 void nfa_hci_init(void) {
188   LOG(VERBOSE) << __func__;
189 
190   /* initialize control block */
191   memset(&nfa_hci_cb, 0, sizeof(tNFA_HCI_CB));
192 
193   nfa_hci_cb.hci_state = NFA_HCI_STATE_STARTUP;
194   nfa_hci_cb.num_nfcee = NFA_HCI_MAX_HOST_IN_NETWORK;
195   /* register message handler on NFA SYS */
196   nfa_sys_register(NFA_ID_HCI, &nfa_hci_sys_reg);
197 }
198 
199 /*******************************************************************************
200 **
201 ** Function         nfa_hci_is_valid_cfg
202 **
203 ** Description      Validate hci control block config parameters
204 **
205 ** Returns          None
206 **
207 *******************************************************************************/
nfa_hci_is_valid_cfg(void)208 bool nfa_hci_is_valid_cfg(void) {
209   uint8_t xx, yy, zz;
210   tNFA_HANDLE reg_app[NFA_HCI_MAX_APP_CB];
211   uint8_t valid_gate[NFA_HCI_MAX_GATE_CB];
212   uint8_t app_count = 0;
213   uint8_t gate_count = 0;
214   uint32_t pipe_inx_mask = 0;
215 
216   /* First, see if valid values are stored in app names, send connectivity
217    * events flag */
218   for (xx = 0; xx < NFA_HCI_MAX_APP_CB; xx++) {
219     /* Check if app name is valid with null terminated string */
220     if (strlen(&nfa_hci_cb.cfg.reg_app_names[xx][0]) > NFA_MAX_HCI_APP_NAME_LEN)
221       return false;
222 
223     /* Send Connectivity event flag can be either TRUE or FALSE */
224     if ((nfa_hci_cb.cfg.b_send_conn_evts[xx] != true) &&
225         (nfa_hci_cb.cfg.b_send_conn_evts[xx] != false))
226       return false;
227 
228     if (nfa_hci_cb.cfg.reg_app_names[xx][0] != 0) {
229       /* Check if the app name is present more than one time in the control
230        * block */
231       for (yy = xx + 1; yy < NFA_HCI_MAX_APP_CB; yy++) {
232         if ((nfa_hci_cb.cfg.reg_app_names[yy][0] != 0) &&
233             (!strncmp(&nfa_hci_cb.cfg.reg_app_names[xx][0],
234                       &nfa_hci_cb.cfg.reg_app_names[yy][0],
235                       strlen(nfa_hci_cb.cfg.reg_app_names[xx])))) {
236           /* Two app cannot have the same name , NVRAM is corrupted */
237           LOG(VERBOSE) << StringPrintf("nfa_hci_is_valid_cfg (%s)  Reusing: %u",
238                                      &nfa_hci_cb.cfg.reg_app_names[xx][0], xx);
239           return false;
240         }
241       }
242       /* Collect list of hci handle */
243       reg_app[app_count++] = (tNFA_HANDLE)(xx | NFA_HANDLE_GROUP_HCI);
244     }
245   }
246 
247   /* Validate Gate Control block */
248   for (xx = 0; xx < NFA_HCI_MAX_GATE_CB; xx++) {
249     if (nfa_hci_cb.cfg.dyn_gates[xx].gate_id != 0) {
250       if (((nfa_hci_cb.cfg.dyn_gates[xx].gate_id != NFA_HCI_LOOP_BACK_GATE) &&
251            (nfa_hci_cb.cfg.dyn_gates[xx].gate_id !=
252             NFA_HCI_IDENTITY_MANAGEMENT_GATE) &&
253            (nfa_hci_cb.cfg.dyn_gates[xx].gate_id <
254             NFA_HCI_FIRST_HOST_SPECIFIC_GENERIC_GATE)) ||
255           (nfa_hci_cb.cfg.dyn_gates[xx].gate_id > NFA_HCI_LAST_PROP_GATE))
256         return false;
257 
258       /* Check if the same gate id is present more than once in the control
259        * block */
260       for (yy = xx + 1; yy < NFA_HCI_MAX_GATE_CB; yy++) {
261         if ((nfa_hci_cb.cfg.dyn_gates[yy].gate_id != 0) &&
262             (nfa_hci_cb.cfg.dyn_gates[xx].gate_id ==
263              nfa_hci_cb.cfg.dyn_gates[yy].gate_id)) {
264           LOG(VERBOSE) << StringPrintf("nfa_hci_is_valid_cfg  Reusing: %u",
265                                      nfa_hci_cb.cfg.dyn_gates[xx].gate_id);
266           return false;
267         }
268       }
269       if ((nfa_hci_cb.cfg.dyn_gates[xx].gate_owner & (~NFA_HANDLE_GROUP_HCI)) >=
270           NFA_HCI_MAX_APP_CB) {
271         LOG(VERBOSE) << StringPrintf(
272             "nfa_hci_is_valid_cfg  Invalid Gate owner: %u",
273             nfa_hci_cb.cfg.dyn_gates[xx].gate_owner);
274         return false;
275       }
276       if (!((nfa_hci_cb.cfg.dyn_gates[xx].gate_id ==
277              NFA_HCI_CONNECTIVITY_GATE) ||
278             ((nfa_hci_cb.cfg.dyn_gates[xx].gate_id >=
279               NFA_HCI_PROP_GATE_FIRST) ||
280              (nfa_hci_cb.cfg.dyn_gates[xx].gate_id <=
281               NFA_HCI_PROP_GATE_LAST)))) {
282         /* The gate owner should be one of the registered application */
283         for (zz = 0; zz < app_count; zz++) {
284           if (nfa_hci_cb.cfg.dyn_gates[xx].gate_owner == reg_app[zz]) break;
285         }
286         if (zz == app_count) {
287           LOG(VERBOSE) << StringPrintf(
288               "nfa_hci_is_valid_cfg  Invalid Gate owner: %u",
289               nfa_hci_cb.cfg.dyn_gates[xx].gate_owner);
290           return false;
291         }
292       }
293       /* Collect list of allocated gates */
294       valid_gate[gate_count++] = nfa_hci_cb.cfg.dyn_gates[xx].gate_id;
295 
296       /* No two gates can own a same pipe */
297       if ((pipe_inx_mask & nfa_hci_cb.cfg.dyn_gates[xx].pipe_inx_mask) != 0)
298         return false;
299       /* Collect the list of pipes on this gate */
300       pipe_inx_mask |= nfa_hci_cb.cfg.dyn_gates[xx].pipe_inx_mask;
301     }
302   }
303 
304   for (xx = 0; (pipe_inx_mask && (xx < NFA_HCI_MAX_PIPE_CB));
305        xx++, pipe_inx_mask >>= 1) {
306     /* Every bit set in pipe increment mask indicates a valid pipe */
307     if (pipe_inx_mask & 1) {
308       /* Check if the pipe is valid one */
309       if (nfa_hci_cb.cfg.dyn_pipes[xx].pipe_id < NFA_HCI_FIRST_DYNAMIC_PIPE)
310         return false;
311     }
312   }
313 
314   if (xx == NFA_HCI_MAX_PIPE_CB) return false;
315 
316   /* Validate Gate Control block */
317   for (xx = 0; xx < NFA_HCI_MAX_PIPE_CB; xx++) {
318     if (nfa_hci_cb.cfg.dyn_pipes[xx].pipe_id != 0) {
319       /* Check if pipe id is valid */
320       if (nfa_hci_cb.cfg.dyn_pipes[xx].pipe_id < NFA_HCI_FIRST_DYNAMIC_PIPE)
321         return false;
322 
323       /* Check if pipe state is valid */
324       if ((nfa_hci_cb.cfg.dyn_pipes[xx].pipe_state != NFA_HCI_PIPE_OPENED) &&
325           (nfa_hci_cb.cfg.dyn_pipes[xx].pipe_state != NFA_HCI_PIPE_CLOSED))
326         return false;
327 
328       /* Check if local gate on which the pipe is created is valid */
329       if ((((nfa_hci_cb.cfg.dyn_pipes[xx].local_gate !=
330              NFA_HCI_LOOP_BACK_GATE) &&
331             (nfa_hci_cb.cfg.dyn_pipes[xx].local_gate !=
332              NFA_HCI_IDENTITY_MANAGEMENT_GATE)) &&
333            (nfa_hci_cb.cfg.dyn_pipes[xx].local_gate <
334             NFA_HCI_FIRST_HOST_SPECIFIC_GENERIC_GATE)) ||
335           (nfa_hci_cb.cfg.dyn_pipes[xx].local_gate > NFA_HCI_LAST_PROP_GATE))
336         return false;
337 
338       /* Check if the peer gate on which the pipe is created is valid */
339       if ((((nfa_hci_cb.cfg.dyn_pipes[xx].dest_gate !=
340              NFA_HCI_LOOP_BACK_GATE) &&
341             (nfa_hci_cb.cfg.dyn_pipes[xx].dest_gate !=
342              NFA_HCI_IDENTITY_MANAGEMENT_GATE)) &&
343            (nfa_hci_cb.cfg.dyn_pipes[xx].dest_gate <
344             NFA_HCI_FIRST_HOST_SPECIFIC_GENERIC_GATE)) ||
345           (nfa_hci_cb.cfg.dyn_pipes[xx].dest_gate > NFA_HCI_LAST_PROP_GATE))
346         return false;
347 
348       /* Check if the same pipe is present more than once in the control block
349        */
350       for (yy = xx + 1; yy < NFA_HCI_MAX_PIPE_CB; yy++) {
351         if ((nfa_hci_cb.cfg.dyn_pipes[yy].pipe_id != 0) &&
352             (nfa_hci_cb.cfg.dyn_pipes[xx].pipe_id ==
353              nfa_hci_cb.cfg.dyn_pipes[yy].pipe_id)) {
354           LOG(VERBOSE) << StringPrintf("nfa_hci_is_valid_cfg  Reusing: %u",
355                                      nfa_hci_cb.cfg.dyn_pipes[xx].pipe_id);
356           return false;
357         }
358       }
359       /* The local gate should be one of the element in gate control block */
360       for (zz = 0; zz < gate_count; zz++) {
361         if (nfa_hci_cb.cfg.dyn_pipes[xx].local_gate == valid_gate[zz]) break;
362       }
363       if (zz == gate_count) {
364         LOG(VERBOSE) << StringPrintf("nfa_hci_is_valid_cfg  Invalid Gate: %u",
365                                    nfa_hci_cb.cfg.dyn_pipes[xx].local_gate);
366         return false;
367       }
368     }
369   }
370 
371   /* Check if admin pipe state is valid */
372   if ((nfa_hci_cb.cfg.admin_gate.pipe01_state != NFA_HCI_PIPE_OPENED) &&
373       (nfa_hci_cb.cfg.admin_gate.pipe01_state != NFA_HCI_PIPE_CLOSED))
374     return false;
375 
376   /* Check if link management pipe state is valid */
377   if ((nfa_hci_cb.cfg.link_mgmt_gate.pipe00_state != NFA_HCI_PIPE_OPENED) &&
378       (nfa_hci_cb.cfg.link_mgmt_gate.pipe00_state != NFA_HCI_PIPE_CLOSED))
379     return false;
380 
381   pipe_inx_mask = nfa_hci_cb.cfg.id_mgmt_gate.pipe_inx_mask;
382   for (xx = 0; (pipe_inx_mask && (xx < NFA_HCI_MAX_PIPE_CB));
383        xx++, pipe_inx_mask >>= 1) {
384     /* Every bit set in pipe increment mask indicates a valid pipe */
385     if (pipe_inx_mask & 1) {
386       /* Check if the pipe is valid one */
387       if (nfa_hci_cb.cfg.dyn_pipes[xx].pipe_id < NFA_HCI_FIRST_DYNAMIC_PIPE)
388         return false;
389       /* Check if the pipe is connected to Identity management gate */
390       if (nfa_hci_cb.cfg.dyn_pipes[xx].local_gate !=
391           NFA_HCI_IDENTITY_MANAGEMENT_GATE)
392         return false;
393     }
394   }
395   if (xx == NFA_HCI_MAX_PIPE_CB) return false;
396 
397   return true;
398 }
399 
400 /*******************************************************************************
401 **
402 ** Function         nfa_hci_cfg_default
403 **
404 ** Description      Configure default values for hci control block
405 **
406 ** Returns          None
407 **
408 *******************************************************************************/
nfa_hci_restore_default_config(uint8_t * p_session_id)409 void nfa_hci_restore_default_config(uint8_t* p_session_id) {
410   memset(&nfa_hci_cb.cfg, 0, sizeof(nfa_hci_cb.cfg));
411   memcpy(nfa_hci_cb.cfg.admin_gate.session_id, p_session_id,
412          NFA_HCI_SESSION_ID_LEN);
413   nfa_hci_cb.nv_write_needed = true;
414 }
415 
416 /*******************************************************************************
417 **
418 ** Function         nfa_hci_proc_nfcc_power_mode
419 **
420 ** Description      Restore NFA HCI sub-module
421 **
422 ** Returns          None
423 **
424 *******************************************************************************/
nfa_hci_proc_nfcc_power_mode(uint8_t nfcc_power_mode)425 void nfa_hci_proc_nfcc_power_mode(uint8_t nfcc_power_mode) {
426   LOG(VERBOSE) << StringPrintf("nfcc_power_mode=%d", nfcc_power_mode);
427 
428   /* if NFCC power mode is change to full power */
429   if (nfcc_power_mode == NFA_DM_PWR_MODE_FULL) {
430     nfa_hci_cb.b_low_power_mode = false;
431     if (nfa_hci_cb.hci_state == NFA_HCI_STATE_IDLE) {
432       nfa_hci_cb.hci_state = NFA_HCI_STATE_RESTORE;
433       nfa_hci_cb.ee_disc_cmplt = false;
434       nfa_hci_cb.ee_disable_disc = true;
435       if (nfa_hci_cb.num_nfcee > 1)
436         nfa_hci_cb.w4_hci_netwk_init = true;
437       else
438         nfa_hci_cb.w4_hci_netwk_init = false;
439       nfa_hci_cb.conn_id = 0;
440       nfa_hci_cb.num_ee_dis_req_ntf = 0;
441       nfa_hci_cb.num_hot_plug_evts = 0;
442     } else {
443       LOG(ERROR) << StringPrintf("Cannot restore now");
444       nfa_sys_cback_notify_nfcc_power_mode_proc_complete(NFA_ID_HCI);
445     }
446   } else {
447     nfa_hci_cb.hci_state = NFA_HCI_STATE_IDLE;
448     nfa_hci_cb.w4_rsp_evt = false;
449     nfa_hci_cb.conn_id = 0;
450     nfa_sys_stop_timer(&nfa_hci_cb.timer);
451     nfa_hci_cb.b_low_power_mode = true;
452     nfa_sys_cback_notify_nfcc_power_mode_proc_complete(NFA_ID_HCI);
453   }
454 }
455 
456 /*******************************************************************************
457 **
458 ** Function         nfa_hci_dh_startup_complete
459 **
460 ** Description      Initialization of terminal host in HCI Network is completed
461 **                  Wait for other host in the network to initialize
462 **
463 ** Returns          None
464 **
465 *******************************************************************************/
nfa_hci_dh_startup_complete(void)466 void nfa_hci_dh_startup_complete(void) {
467   if (nfa_hci_cb.w4_hci_netwk_init) {
468     if (nfa_hci_cb.hci_state == NFA_HCI_STATE_STARTUP) {
469       nfa_hci_cb.hci_state = NFA_HCI_STATE_WAIT_NETWK_ENABLE;
470       /* Wait for EE Discovery to complete */
471       nfa_sys_start_timer(&nfa_hci_cb.timer, NFA_HCI_RSP_TIMEOUT_EVT,
472                           NFA_EE_DISCV_TIMEOUT_VAL);
473     } else if (nfa_hci_cb.hci_state == NFA_HCI_STATE_RESTORE) {
474       nfa_hci_cb.hci_state = NFA_HCI_STATE_RESTORE_NETWK_ENABLE;
475       /* No HCP packet to DH for a specified period of time indicates all host
476        * in the network is initialized */
477       nfa_sys_start_timer(&nfa_hci_cb.timer, NFA_HCI_RSP_TIMEOUT_EVT,
478                           p_nfa_hci_cfg->hci_netwk_enable_timeout);
479     }
480   } else if ((nfa_hci_cb.num_nfcee > 1) &&
481              (nfa_hci_cb.num_ee_dis_req_ntf != (nfa_hci_cb.num_nfcee - 1))) {
482     if (nfa_hci_cb.hci_state == NFA_HCI_STATE_RESTORE)
483       nfa_hci_cb.ee_disable_disc = true;
484     /* Received HOT PLUG EVT, we will also wait for EE DISC REQ Ntf(s) */
485     nfa_sys_start_timer(&nfa_hci_cb.timer, NFA_HCI_RSP_TIMEOUT_EVT,
486                         p_nfa_hci_cfg->hci_netwk_enable_timeout);
487   } else {
488     /* Received EE DISC REQ Ntf(s) */
489     nfa_hciu_send_get_param_cmd(NFA_HCI_ADMIN_PIPE, NFA_HCI_HOST_LIST_INDEX);
490   }
491 }
492 
493 /*******************************************************************************
494 **
495 ** Function         nfa_hci_startup_complete
496 **
497 ** Description      HCI network initialization is completed
498 **
499 ** Returns          None
500 **
501 *******************************************************************************/
nfa_hci_startup_complete(tNFA_STATUS status)502 void nfa_hci_startup_complete(tNFA_STATUS status) {
503   tNFA_HCI_EVT_DATA evt_data;
504 
505   LOG(VERBOSE) << StringPrintf("Status: %u", status);
506 
507   nfa_sys_stop_timer(&nfa_hci_cb.timer);
508 
509   if ((nfa_hci_cb.hci_state == NFA_HCI_STATE_RESTORE) ||
510       (nfa_hci_cb.hci_state == NFA_HCI_STATE_RESTORE_NETWK_ENABLE)) {
511     nfa_ee_proc_hci_info_cback();
512     nfa_sys_cback_notify_nfcc_power_mode_proc_complete(NFA_ID_HCI);
513   } else {
514     evt_data.hci_init.status = status;
515 
516     nfa_hciu_send_to_all_apps(NFA_HCI_INIT_EVT, &evt_data);
517     nfa_sys_cback_notify_enable_complete(NFA_ID_HCI);
518   }
519 
520   if (status == NFA_STATUS_OK)
521     nfa_hci_cb.hci_state = NFA_HCI_STATE_IDLE;
522 
523   else
524     nfa_hci_cb.hci_state = NFA_HCI_STATE_DISABLED;
525 }
526 
527 /*******************************************************************************
528 **
529 ** Function         nfa_hci_enable_one_nfcee
530 **
531 ** Description      Enable NFCEE Hosts which are discovered.
532 **
533 ** Returns          None
534 **
535 *******************************************************************************/
nfa_hci_enable_one_nfcee(void)536 void nfa_hci_enable_one_nfcee(void) {
537   uint8_t xx;
538   uint8_t nfceeid = 0;
539 
540   LOG(VERBOSE) << StringPrintf("%d", nfa_hci_cb.num_nfcee);
541 
542   for (xx = 0; xx < nfa_hci_cb.num_nfcee; xx++) {
543     nfceeid = nfa_hci_cb.ee_info[xx].ee_handle & ~NFA_HANDLE_GROUP_EE;
544     if (nfa_hci_cb.ee_info[xx].ee_status == NFA_EE_STATUS_INACTIVE) {
545       NFC_NfceeModeSet(nfceeid, NFC_MODE_ACTIVATE);
546       return;
547     }
548   }
549 
550   if (xx == nfa_hci_cb.num_nfcee) {
551     if ((nfa_hci_cb.hci_state == NFA_HCI_STATE_WAIT_NETWK_ENABLE) ||
552         (nfa_hci_cb.hci_state == NFA_HCI_STATE_RESTORE_NETWK_ENABLE)) {
553       nfa_hciu_send_get_param_cmd(NFA_HCI_ADMIN_PIPE, NFA_HCI_HOST_LIST_INDEX);
554     } else if (nfa_hci_cb.hci_state == NFA_HCI_STATE_EE_RECOVERY) {
555       nfa_hci_cb.hci_state = NFA_HCI_STATE_IDLE;
556       if (nfa_ee_cb.isDiscoveryStopped == true) {
557         nfa_dm_act_start_rf_discovery(nullptr);
558         nfa_ee_cb.isDiscoveryStopped = false;
559       }
560     }
561   }
562 }
563 
564 /*******************************************************************************
565 **
566 ** Function         nfa_hci_startup
567 **
568 ** Description      Perform HCI startup
569 **
570 ** Returns          None
571 **
572 *******************************************************************************/
nfa_hci_startup(void)573 void nfa_hci_startup(void) {
574   tNFA_STATUS status = NFA_STATUS_FAILED;
575   uint8_t target_handle;
576   uint8_t count = 0;
577   bool found = false;
578 
579   if (HCI_LOOPBACK_DEBUG == NFA_HCI_DEBUG_ON) {
580     /* First step in initialization is to open the admin pipe */
581     nfa_hciu_send_open_pipe_cmd(NFA_HCI_ADMIN_PIPE);
582     return;
583   }
584 
585   /* We can only start up if NV Ram is read and EE discovery is complete */
586   if (nfa_hci_cb.nv_read_cmplt && nfa_hci_cb.ee_disc_cmplt &&
587       (nfa_hci_cb.conn_id == 0)) {
588     if (NFC_GetNCIVersion() >= NCI_VERSION_2_0) {
589       NFC_SetStaticHciCback(nfa_hci_conn_cback);
590     } else {
591       NFA_EeGetInfo(&nfa_hci_cb.num_nfcee, nfa_hci_cb.ee_info);
592 
593       while ((count < nfa_hci_cb.num_nfcee) && (!found)) {
594         target_handle = (uint8_t)nfa_hci_cb.ee_info[count].ee_handle;
595 
596         if (nfa_hci_cb.ee_info[count].ee_interface[0] ==
597             NFA_EE_INTERFACE_HCI_ACCESS) {
598           found = true;
599 
600           if (nfa_hci_cb.ee_info[count].ee_status == NFA_EE_STATUS_INACTIVE) {
601             NFC_NfceeModeSet(target_handle, NFC_MODE_ACTIVATE);
602           }
603           if ((status = NFC_ConnCreate(NCI_DEST_TYPE_NFCEE, target_handle,
604                                        NFA_EE_INTERFACE_HCI_ACCESS,
605                                        nfa_hci_conn_cback)) == NFA_STATUS_OK)
606             nfa_sys_start_timer(&nfa_hci_cb.timer, NFA_HCI_RSP_TIMEOUT_EVT,
607                                 NFA_HCI_CON_CREATE_TIMEOUT_VAL);
608           else {
609             nfa_hci_cb.hci_state = NFA_HCI_STATE_DISABLED;
610             LOG(ERROR) << StringPrintf(
611                 "nfa_hci_startup - Failed to Create Logical connection. HCI "
612                 "Initialization/Restore failed");
613             nfa_hci_startup_complete(NFA_STATUS_FAILED);
614           }
615         }
616         count++;
617       }
618       if (!found) {
619         LOG(ERROR) << StringPrintf(
620             "nfa_hci_startup - HCI ACCESS Interface not discovered. HCI "
621             "Initialization/Restore failed");
622         nfa_hci_startup_complete(NFA_STATUS_FAILED);
623       }
624     }
625   }
626 }
627 
628 /*******************************************************************************
629 **
630 ** Function         nfa_hci_sys_enable
631 **
632 ** Description      Enable NFA HCI
633 **
634 ** Returns          None
635 **
636 *******************************************************************************/
nfa_hci_sys_enable(void)637 static void nfa_hci_sys_enable(void) {
638   LOG(VERBOSE) << __func__;
639   nfa_ee_reg_cback_enable_done(&nfa_hci_ee_info_cback);
640 
641   nfa_nv_co_read((uint8_t*)&nfa_hci_cb.cfg, sizeof(nfa_hci_cb.cfg),
642                  DH_NV_BLOCK);
643   nfa_sys_start_timer(&nfa_hci_cb.timer, NFA_HCI_RSP_TIMEOUT_EVT,
644                       NFA_HCI_NV_READ_TIMEOUT_VAL);
645 }
646 
647 /*******************************************************************************
648 **
649 ** Function         nfa_hci_sys_disable
650 **
651 ** Description      Disable NFA HCI
652 **
653 ** Returns          None
654 **
655 *******************************************************************************/
nfa_hci_sys_disable(void)656 static void nfa_hci_sys_disable(void) {
657   tNFA_HCI_EVT_DATA evt_data;
658 
659   nfa_sys_stop_timer(&nfa_hci_cb.timer);
660 
661   if (nfa_hci_cb.conn_id) {
662     if (nfa_sys_is_graceful_disable()) {
663       /* Tell all applications stack is down */
664       if (NFC_GetNCIVersion() == NCI_VERSION_1_0) {
665         nfa_hciu_send_to_all_apps(NFA_HCI_EXIT_EVT, &evt_data);
666         NFC_ConnClose(nfa_hci_cb.conn_id);
667         return;
668       }
669     }
670     nfa_hci_cb.conn_id = 0;
671   }
672 
673   nfa_hci_cb.hci_state = NFA_HCI_STATE_DISABLED;
674   /* deregister message handler on NFA SYS */
675   nfa_sys_deregister(NFA_ID_HCI);
676 }
677 
678 /*******************************************************************************
679 **
680 ** Function         nfa_hci_conn_cback
681 **
682 ** Description      This function Process event from NCI
683 **
684 ** Returns          None
685 **
686 *******************************************************************************/
nfa_hci_conn_cback(uint8_t conn_id,tNFC_CONN_EVT event,tNFC_CONN * p_data)687 static void nfa_hci_conn_cback(uint8_t conn_id, tNFC_CONN_EVT event,
688                                tNFC_CONN* p_data) {
689   uint8_t* p;
690   NFC_HDR* p_pkt = (NFC_HDR*)p_data->data.p_data;
691   uint8_t chaining_bit;
692   uint8_t pipe;
693   uint16_t pkt_len;
694   const uint8_t MAX_BUFF_SIZE = 100;
695   char buff[MAX_BUFF_SIZE];
696   LOG(VERBOSE) << StringPrintf("%s State: %u  Cmd: %u", __func__,
697                              nfa_hci_cb.hci_state, event);
698   if (event == NFC_CONN_CREATE_CEVT) {
699     nfa_hci_cb.conn_id = conn_id;
700     nfa_hci_cb.buff_size = p_data->conn_create.buff_size;
701 
702     if (nfa_hci_cb.hci_state == NFA_HCI_STATE_STARTUP) {
703       nfa_hci_cb.w4_hci_netwk_init = true;
704       nfa_hciu_alloc_gate(NFA_HCI_CONNECTIVITY_GATE, 0);
705     }
706 
707     if (nfa_hci_cb.cfg.admin_gate.pipe01_state == NFA_HCI_PIPE_CLOSED) {
708       /* First step in initialization/restore is to open the admin pipe */
709       nfa_hciu_send_open_pipe_cmd(NFA_HCI_ADMIN_PIPE);
710     } else {
711       /* Read session id, to know DH session id is correct */
712       nfa_hciu_send_get_param_cmd(NFA_HCI_ADMIN_PIPE,
713                                   NFA_HCI_SESSION_IDENTITY_INDEX);
714     }
715   } else if (event == NFC_CONN_CLOSE_CEVT) {
716     nfa_hci_cb.conn_id = 0;
717     nfa_hci_cb.hci_state = NFA_HCI_STATE_DISABLED;
718     /* deregister message handler on NFA SYS */
719     nfa_sys_deregister(NFA_ID_HCI);
720   }
721 
722   if ((event != NFC_DATA_CEVT) || (p_pkt == nullptr)) return;
723 
724   if ((nfa_hci_cb.hci_state == NFA_HCI_STATE_WAIT_NETWK_ENABLE) ||
725       (nfa_hci_cb.hci_state == NFA_HCI_STATE_RESTORE_NETWK_ENABLE)) {
726     /* Received HCP Packet before timeout, Other Host initialization is not
727      * complete */
728     nfa_sys_stop_timer(&nfa_hci_cb.timer);
729     if (nfa_hci_cb.w4_hci_netwk_init)
730       nfa_sys_start_timer(&nfa_hci_cb.timer, NFA_HCI_RSP_TIMEOUT_EVT,
731                           p_nfa_hci_cfg->hci_netwk_enable_timeout);
732   }
733 
734   p = (uint8_t*)(p_pkt + 1) + p_pkt->offset;
735   pkt_len = p_pkt->len;
736 
737   if (pkt_len < 1) {
738     LOG(ERROR) << StringPrintf("Insufficient packet length! Dropping :%u bytes",
739                                pkt_len);
740     /* release GKI buffer */
741     GKI_freebuf(p_pkt);
742     return;
743   }
744 
745   chaining_bit = ((*p) >> 0x07) & 0x01;
746   pipe = (*p++) & 0x7F;
747   if (pkt_len != 0) pkt_len--;
748 
749   if (nfa_hci_cb.assembling == false) {
750     if (pkt_len < 1) {
751       LOG(ERROR) << StringPrintf(
752           "Insufficient packet length! Dropping :%u bytes", pkt_len);
753       /* release GKI buffer */
754       GKI_freebuf(p_pkt);
755       return;
756     }
757     /* First Segment of a packet */
758     nfa_hci_cb.type = ((*p) >> 0x06) & 0x03;
759     nfa_hci_cb.inst = (*p++ & 0x3F);
760     if (pkt_len != 0) pkt_len--;
761     nfa_hci_cb.assembly_failed = false;
762     nfa_hci_cb.msg_len = 0;
763 
764     if (chaining_bit == NFA_HCI_MESSAGE_FRAGMENTATION) {
765       nfa_hci_cb.assembling = true;
766       nfa_hci_set_receive_buf(pipe);
767       nfa_hci_assemble_msg(p, pkt_len);
768     } else {
769       if ((pipe >= NFA_HCI_FIRST_DYNAMIC_PIPE) &&
770           (nfa_hci_cb.type == NFA_HCI_EVENT_TYPE)) {
771         nfa_hci_set_receive_buf(pipe);
772         nfa_hci_assemble_msg(p, pkt_len);
773         p = nfa_hci_cb.p_msg_data;
774       }
775     }
776   } else {
777     if (nfa_hci_cb.assembly_failed) {
778       /* If Reassembly failed because of insufficient buffer, just drop the new
779        * segmented packets */
780       LOG(ERROR) << StringPrintf(
781           "Insufficient buffer to Reassemble HCP "
782           "packet! Dropping :%u bytes",
783           pkt_len);
784     } else {
785       /* Reassemble the packet */
786       nfa_hci_assemble_msg(p, pkt_len);
787     }
788 
789     if (chaining_bit == NFA_HCI_NO_MESSAGE_FRAGMENTATION) {
790       /* Just added the last segment in the chain. Reset pointers */
791       nfa_hci_cb.assembling = false;
792       p = nfa_hci_cb.p_msg_data;
793       pkt_len = nfa_hci_cb.msg_len;
794     }
795   }
796 
797   LOG(VERBOSE) << StringPrintf(
798       "nfa_hci_conn_cback Recvd data pipe:%d  %s  chain:%d  assmbl:%d  len:%d",
799       (uint8_t)pipe,
800       nfa_hciu_get_type_inst_names(pipe, nfa_hci_cb.type, nfa_hci_cb.inst, buff,
801                                    MAX_BUFF_SIZE),
802       (uint8_t)chaining_bit, (uint8_t)nfa_hci_cb.assembling, p_pkt->len);
803 
804   /* If still reassembling fragments, just return */
805   if (nfa_hci_cb.assembling) {
806     /* if not last packet, release GKI buffer */
807     GKI_freebuf(p_pkt);
808     return;
809   }
810 
811   /* If we got a response, cancel the response timer. Also, if waiting for */
812   /* a single response, we can go back to idle state                       */
813   if ((nfa_hci_cb.hci_state == NFA_HCI_STATE_WAIT_RSP) &&
814       ((nfa_hci_cb.type == NFA_HCI_RESPONSE_TYPE) ||
815        (nfa_hci_cb.w4_rsp_evt && (nfa_hci_cb.type == NFA_HCI_EVENT_TYPE)))) {
816     nfa_sys_stop_timer(&nfa_hci_cb.timer);
817     nfa_hci_cb.hci_state = NFA_HCI_STATE_IDLE;
818   }
819 
820   switch (pipe) {
821     case NFA_HCI_ADMIN_PIPE:
822       /* Check if data packet is a command, response or event */
823       if (nfa_hci_cb.type == NFA_HCI_COMMAND_TYPE) {
824         nfa_hci_handle_admin_gate_cmd(p, pkt_len);
825       } else if (nfa_hci_cb.type == NFA_HCI_RESPONSE_TYPE) {
826         nfa_hci_handle_admin_gate_rsp(p, (uint8_t)pkt_len);
827       } else if (nfa_hci_cb.type == NFA_HCI_EVENT_TYPE) {
828         nfa_hci_handle_admin_gate_evt();
829       }
830       break;
831 
832     case NFA_HCI_LINK_MANAGEMENT_PIPE:
833       /* We don't send Link Management commands, we only get them */
834       if (nfa_hci_cb.type == NFA_HCI_COMMAND_TYPE)
835         nfa_hci_handle_link_mgm_gate_cmd(p, pkt_len);
836       break;
837 
838     default:
839       if (pipe >= NFA_HCI_FIRST_DYNAMIC_PIPE)
840         nfa_hci_handle_dyn_pipe_pkt(pipe, p, pkt_len);
841       break;
842   }
843 
844   if ((nfa_hci_cb.type == NFA_HCI_RESPONSE_TYPE) ||
845       (nfa_hci_cb.w4_rsp_evt && (nfa_hci_cb.type == NFA_HCI_EVENT_TYPE))) {
846     nfa_hci_cb.w4_rsp_evt = false;
847   }
848 
849   /* Send a message to ouselves to check for anything to do */
850   p_pkt->event = NFA_HCI_CHECK_QUEUE_EVT;
851   p_pkt->len = 0;
852   nfa_sys_sendmsg(p_pkt);
853 }
854 
855 /*******************************************************************************
856 **
857 ** Function         nfa_hci_handle_nv_read
858 **
859 ** Description      handler function for nv read complete event
860 **
861 ** Returns          None
862 **
863 *******************************************************************************/
nfa_hci_handle_nv_read(uint8_t block,tNFA_STATUS status)864 void nfa_hci_handle_nv_read(uint8_t block, tNFA_STATUS status) {
865   uint8_t session_id[NFA_HCI_SESSION_ID_LEN];
866   uint8_t default_session[NFA_HCI_SESSION_ID_LEN] = {0xFF, 0xFF, 0xFF, 0xFF,
867                                                      0xFF, 0xFF, 0xFF, 0xFF};
868   uint8_t reset_session[NFA_HCI_SESSION_ID_LEN] = {0x00, 0x00, 0x00, 0x00,
869                                                    0x00, 0x00, 0x00, 0x00};
870   uint32_t os_tick;
871 
872   if (block == DH_NV_BLOCK) {
873     /* Stop timer as NVDATA Read Completed */
874     nfa_sys_stop_timer(&nfa_hci_cb.timer);
875     nfa_hci_cb.nv_read_cmplt = true;
876     if ((status != NFA_STATUS_OK) || (!nfa_hci_is_valid_cfg()) ||
877         (!(memcmp(nfa_hci_cb.cfg.admin_gate.session_id, default_session,
878                   NFA_HCI_SESSION_ID_LEN))) ||
879         (!(memcmp(nfa_hci_cb.cfg.admin_gate.session_id, reset_session,
880                   NFA_HCI_SESSION_ID_LEN)))) {
881       nfa_hci_cb.b_hci_netwk_reset = true;
882       /* Set a new session id so that we clear all pipes later after seeing a
883        * difference with the HC Session ID */
884       memcpy(&session_id[(NFA_HCI_SESSION_ID_LEN / 2)],
885              nfa_hci_cb.cfg.admin_gate.session_id,
886              (NFA_HCI_SESSION_ID_LEN / 2));
887       os_tick = GKI_get_os_tick_count();
888       memcpy(session_id, (uint8_t*)&os_tick, (NFA_HCI_SESSION_ID_LEN / 2));
889       nfa_hci_restore_default_config(session_id);
890     }
891     nfa_hci_startup();
892   }
893 }
894 
895 /*******************************************************************************
896 **
897 ** Function         nfa_hci_rsp_timeout
898 **
899 ** Description      action function to process timeout
900 **
901 ** Returns          None
902 **
903 *******************************************************************************/
nfa_hci_rsp_timeout()904 void nfa_hci_rsp_timeout() {
905   tNFA_HCI_EVT evt = 0;
906   tNFA_HCI_EVT_DATA evt_data;
907   uint8_t delete_pipe;
908 
909   LOG(VERBOSE) << StringPrintf("State: %u  Cmd: %u", nfa_hci_cb.hci_state,
910                              nfa_hci_cb.cmd_sent);
911 
912   evt_data.status = NFA_STATUS_FAILED;
913 
914   switch (nfa_hci_cb.hci_state) {
915     case NFA_HCI_STATE_STARTUP:
916     case NFA_HCI_STATE_RESTORE:
917       LOG(ERROR) << StringPrintf(
918           "nfa_hci_rsp_timeout - Initialization failed!");
919       nfa_hci_startup_complete(NFA_STATUS_TIMEOUT);
920       break;
921 
922     case NFA_HCI_STATE_WAIT_NETWK_ENABLE:
923     case NFA_HCI_STATE_RESTORE_NETWK_ENABLE:
924 
925       if (nfa_hci_cb.w4_hci_netwk_init) {
926         /* HCI Network is enabled */
927         nfa_hci_cb.w4_hci_netwk_init = false;
928         nfa_hciu_send_get_param_cmd(NFA_HCI_ADMIN_PIPE,
929                                     NFA_HCI_HOST_LIST_INDEX);
930       } else {
931         nfa_hci_startup_complete(NFA_STATUS_FAILED);
932       }
933       break;
934 
935     case NFA_HCI_STATE_REMOVE_GATE:
936       /* Something wrong, NVRAM data could be corrupt */
937       if (nfa_hci_cb.cmd_sent == NFA_HCI_ADM_DELETE_PIPE) {
938         nfa_hciu_send_clear_all_pipe_cmd();
939       } else {
940         nfa_hciu_remove_all_pipes_from_host(0);
941         nfa_hci_api_dealloc_gate(nullptr);
942       }
943       break;
944 
945     case NFA_HCI_STATE_APP_DEREGISTER:
946       /* Something wrong, NVRAM data could be corrupt */
947       if (nfa_hci_cb.cmd_sent == NFA_HCI_ADM_DELETE_PIPE) {
948         nfa_hciu_send_clear_all_pipe_cmd();
949       } else {
950         nfa_hciu_remove_all_pipes_from_host(0);
951         nfa_hci_api_deregister(nullptr);
952       }
953       break;
954 
955     case NFA_HCI_STATE_WAIT_RSP:
956       nfa_hci_cb.hci_state = NFA_HCI_STATE_IDLE;
957 
958       if (nfa_hci_cb.w4_rsp_evt) {
959         nfa_hci_cb.w4_rsp_evt = false;
960         evt = NFA_HCI_EVENT_RCVD_EVT;
961         evt_data.rcvd_evt.pipe = nfa_hci_cb.pipe_in_use;
962         evt_data.rcvd_evt.evt_code = 0;
963         evt_data.rcvd_evt.evt_len = 0;
964         evt_data.rcvd_evt.p_evt_buf = nullptr;
965         nfa_hci_cb.rsp_buf_size = 0;
966         nfa_hci_cb.p_rsp_buf = nullptr;
967 
968         break;
969       }
970 
971       delete_pipe = 0;
972       switch (nfa_hci_cb.cmd_sent) {
973         case NFA_HCI_ANY_SET_PARAMETER:
974           /*
975            * As no response to the command sent on this pipe, we may assume the
976            * pipe is
977            * deleted already and release the pipe. But still send delete pipe
978            * command to be safe.
979            */
980           delete_pipe = nfa_hci_cb.pipe_in_use;
981           evt_data.registry.pipe = nfa_hci_cb.pipe_in_use;
982           evt_data.registry.data_len = 0;
983           evt_data.registry.index = nfa_hci_cb.param_in_use;
984           evt = NFA_HCI_SET_REG_RSP_EVT;
985           break;
986 
987         case NFA_HCI_ANY_GET_PARAMETER:
988           /*
989            * As no response to the command sent on this pipe, we may assume the
990            * pipe is
991            * deleted already and release the pipe. But still send delete pipe
992            * command to be safe.
993            */
994           delete_pipe = nfa_hci_cb.pipe_in_use;
995           evt_data.registry.pipe = nfa_hci_cb.pipe_in_use;
996           evt_data.registry.data_len = 0;
997           evt_data.registry.index = nfa_hci_cb.param_in_use;
998           evt = NFA_HCI_GET_REG_RSP_EVT;
999           break;
1000 
1001         case NFA_HCI_ANY_OPEN_PIPE:
1002           /*
1003            * As no response to the command sent on this pipe, we may assume the
1004            * pipe is
1005            * deleted already and release the pipe. But still send delete pipe
1006            * command to be safe.
1007            */
1008           delete_pipe = nfa_hci_cb.pipe_in_use;
1009           evt_data.opened.pipe = nfa_hci_cb.pipe_in_use;
1010           evt = NFA_HCI_OPEN_PIPE_EVT;
1011           break;
1012 
1013         case NFA_HCI_ANY_CLOSE_PIPE:
1014           /*
1015            * As no response to the command sent on this pipe, we may assume the
1016            * pipe is
1017            * deleted already and release the pipe. But still send delete pipe
1018            * command to be safe.
1019            */
1020           delete_pipe = nfa_hci_cb.pipe_in_use;
1021           evt_data.closed.pipe = nfa_hci_cb.pipe_in_use;
1022           evt = NFA_HCI_CLOSE_PIPE_EVT;
1023           break;
1024 
1025         case NFA_HCI_ADM_CREATE_PIPE:
1026           evt_data.created.pipe = nfa_hci_cb.pipe_in_use;
1027           evt_data.created.source_gate = nfa_hci_cb.local_gate_in_use;
1028           evt_data.created.dest_host = nfa_hci_cb.remote_host_in_use;
1029           evt_data.created.dest_gate = nfa_hci_cb.remote_gate_in_use;
1030           evt = NFA_HCI_CREATE_PIPE_EVT;
1031           break;
1032 
1033         case NFA_HCI_ADM_DELETE_PIPE:
1034           /*
1035            * As no response to the command sent on this pipe, we may assume the
1036            * pipe is
1037            * deleted already. Just release the pipe.
1038            */
1039           if (nfa_hci_cb.pipe_in_use <= NFA_HCI_LAST_DYNAMIC_PIPE)
1040             nfa_hciu_release_pipe(nfa_hci_cb.pipe_in_use);
1041           evt_data.deleted.pipe = nfa_hci_cb.pipe_in_use;
1042           evt = NFA_HCI_DELETE_PIPE_EVT;
1043           break;
1044 
1045         default:
1046           /*
1047            * As no response to the command sent on this pipe, we may assume the
1048            * pipe is
1049            * deleted already and release the pipe. But still send delete pipe
1050            * command to be safe.
1051            */
1052           delete_pipe = nfa_hci_cb.pipe_in_use;
1053           break;
1054       }
1055       if (delete_pipe && (delete_pipe <= NFA_HCI_LAST_DYNAMIC_PIPE)) {
1056         nfa_hciu_send_delete_pipe_cmd(delete_pipe);
1057         nfa_hciu_release_pipe(delete_pipe);
1058       }
1059       break;
1060     case NFA_HCI_STATE_DISABLED:
1061     default:
1062       LOG(VERBOSE) << StringPrintf("Timeout in DISABLED/ Invalid state");
1063       break;
1064   }
1065   if (evt != 0) nfa_hciu_send_to_app(evt, &evt_data, nfa_hci_cb.app_in_use);
1066 }
1067 
1068 /*******************************************************************************
1069 **
1070 ** Function         nfa_hci_set_receive_buf
1071 **
1072 ** Description      Set reassembly buffer for incoming message
1073 **
1074 ** Returns          status
1075 **
1076 *******************************************************************************/
nfa_hci_set_receive_buf(uint8_t pipe)1077 static void nfa_hci_set_receive_buf(uint8_t pipe) {
1078   if ((pipe >= NFA_HCI_FIRST_DYNAMIC_PIPE) &&
1079       (nfa_hci_cb.type == NFA_HCI_EVENT_TYPE)) {
1080     if ((nfa_hci_cb.rsp_buf_size) && (nfa_hci_cb.p_rsp_buf != nullptr)) {
1081       nfa_hci_cb.p_msg_data = nfa_hci_cb.p_rsp_buf;
1082       nfa_hci_cb.max_msg_len = nfa_hci_cb.rsp_buf_size;
1083       return;
1084     }
1085   }
1086   nfa_hci_cb.p_msg_data = nfa_hci_cb.msg_data;
1087   nfa_hci_cb.max_msg_len = NFA_MAX_HCI_EVENT_LEN;
1088 }
1089 
1090 /*******************************************************************************
1091 **
1092 ** Function         nfa_hci_assemble_msg
1093 **
1094 ** Description      Reassemble the incoming message
1095 **
1096 ** Returns          None
1097 **
1098 *******************************************************************************/
nfa_hci_assemble_msg(uint8_t * p_data,uint16_t data_len)1099 static void nfa_hci_assemble_msg(uint8_t* p_data, uint16_t data_len) {
1100   if ((nfa_hci_cb.msg_len + data_len) > nfa_hci_cb.max_msg_len) {
1101     /* Fill the buffer as much it can hold */
1102     memcpy(&nfa_hci_cb.p_msg_data[nfa_hci_cb.msg_len], p_data,
1103            (nfa_hci_cb.max_msg_len - nfa_hci_cb.msg_len));
1104     nfa_hci_cb.msg_len = nfa_hci_cb.max_msg_len;
1105     /* Set Reassembly failed */
1106     nfa_hci_cb.assembly_failed = true;
1107     LOG(ERROR) << StringPrintf(
1108         "Insufficient buffer to Reassemble HCP "
1109         "packet! Dropping :%u bytes",
1110         ((nfa_hci_cb.msg_len + data_len) - nfa_hci_cb.max_msg_len));
1111   } else {
1112     memcpy(&nfa_hci_cb.p_msg_data[nfa_hci_cb.msg_len], p_data, data_len);
1113     nfa_hci_cb.msg_len += data_len;
1114   }
1115 }
1116 
1117 /*******************************************************************************
1118 **
1119 ** Function         nfa_hci_evt_hdlr
1120 **
1121 ** Description      Processing all event for NFA HCI
1122 **
1123 ** Returns          TRUE if p_msg needs to be deallocated
1124 **
1125 *******************************************************************************/
nfa_hci_evt_hdlr(NFC_HDR * p_msg)1126 static bool nfa_hci_evt_hdlr(NFC_HDR* p_msg) {
1127   LOG(VERBOSE) << StringPrintf(
1128       "nfa_hci_evt_hdlr state: %s (%d) event: %s (0x%04x)",
1129       nfa_hciu_get_state_name(nfa_hci_cb.hci_state).c_str(),
1130       nfa_hci_cb.hci_state, nfa_hciu_get_event_name(p_msg->event).c_str(),
1131       p_msg->event);
1132 
1133   /* If this is an API request, queue it up */
1134   if ((p_msg->event >= NFA_HCI_FIRST_API_EVENT) &&
1135       (p_msg->event <= NFA_HCI_LAST_API_EVENT)) {
1136     GKI_enqueue(&nfa_hci_cb.hci_api_q, p_msg);
1137   } else {
1138     tNFA_HCI_EVENT_DATA* p_evt_data = (tNFA_HCI_EVENT_DATA*)p_msg;
1139     switch (p_msg->event) {
1140       case NFA_HCI_RSP_NV_READ_EVT:
1141         nfa_hci_handle_nv_read(p_evt_data->nv_read.block,
1142                                p_evt_data->nv_read.status);
1143         break;
1144 
1145       case NFA_HCI_RSP_NV_WRITE_EVT:
1146         /* NV Ram write completed - nothing to do... */
1147         break;
1148 
1149       case NFA_HCI_RSP_TIMEOUT_EVT:
1150         nfa_hci_rsp_timeout();
1151         break;
1152 
1153       case NFA_HCI_CHECK_QUEUE_EVT:
1154         if (HCI_LOOPBACK_DEBUG == NFA_HCI_DEBUG_ON) {
1155           if (p_msg->len != 0) {
1156             tNFC_CONN nfc_conn;
1157             nfc_conn.data.p_data = p_msg;
1158             nfa_hci_conn_cback(0, NFC_DATA_CEVT, &nfc_conn);
1159             return false;
1160           }
1161         }
1162         break;
1163     }
1164   }
1165 
1166   if ((p_msg->event > NFA_HCI_LAST_API_EVENT)) GKI_freebuf(p_msg);
1167 
1168   nfa_hci_check_api_requests();
1169 
1170   if (nfa_hciu_is_no_host_resetting()) nfa_hci_check_pending_api_requests();
1171 
1172   if ((nfa_hci_cb.hci_state == NFA_HCI_STATE_IDLE) &&
1173       (nfa_hci_cb.nv_write_needed)) {
1174     nfa_hci_cb.nv_write_needed = false;
1175     nfa_nv_co_write((uint8_t*)&nfa_hci_cb.cfg, sizeof(nfa_hci_cb.cfg),
1176                     DH_NV_BLOCK);
1177   }
1178 
1179   return false;
1180 }
1181