1 #include "fuzz.h"
2
hal_inject_event(uint8_t hal_evt,tHAL_NFC_STATUS status)3 void hal_inject_event(uint8_t hal_evt, tHAL_NFC_STATUS status) {
4 tNFC_HAL_EVT_MSG msg = {};
5
6 msg.hdr.len = 0;
7 msg.hdr.event = BT_EVT_TO_NFC_MSGS;
8 msg.hdr.offset = 0;
9 msg.hdr.layer_specific = 0;
10 msg.hal_evt = hal_evt;
11 msg.status = status;
12
13 FUZZLOG("Injecting event to NFC code: event=%d, status=%d", hal_evt, status);
14 nfc_main_handle_hal_evt(&msg);
15 }
16
hal_inject_data(const uint8_t * p_data,uint16_t data_len)17 bool hal_inject_data(const uint8_t* p_data, uint16_t data_len) {
18 FUZZLOG("Injecting data to NFC stack: %s",
19 BytesToHex(p_data, data_len).c_str());
20
21 // For NCI responses, nfc_ncif_process_event checks the response OID matches
22 // the command being sent last time. So mimic this by always copying the first
23 // two bytes into last header.
24 if (data_len >= sizeof(nfc_cb.last_hdr)) {
25 memcpy(nfc_cb.last_hdr, p_data, sizeof(nfc_cb.last_hdr));
26 }
27
28 NFC_HDR* p_msg;
29 p_msg = (NFC_HDR*)GKI_getbuf(sizeof(NFC_HDR) + NFC_RECEIVE_MSGS_OFFSET +
30 data_len);
31 if (p_msg != nullptr) {
32 /* Initialize NFC_HDR */
33 p_msg->len = data_len;
34 p_msg->event = BT_EVT_TO_NFC_NCI;
35 p_msg->offset = NFC_RECEIVE_MSGS_OFFSET;
36
37 uint8_t* p = (uint8_t*)(p_msg + 1) + p_msg->offset;
38 memcpy(p, p_data, p_msg->len);
39
40 if (nfc_ncif_process_event(p_msg)) {
41 GKI_freebuf(p_msg);
42 }
43 return true;
44 } else {
45 LOG(ERROR) << StringPrintf("No buffer");
46 return false;
47 }
48 }
49
HalInitialize()50 static void HalInitialize() { FUZZLOG("HAL_OP: type=initialize"); }
51
HalTerminate()52 static void HalTerminate() { FUZZLOG("HAL_OP: type=terminate"); }
53
HalOpen(tHAL_NFC_CBACK *,tHAL_NFC_DATA_CBACK *)54 static void HalOpen(tHAL_NFC_CBACK* /*p_hal_inject_event*/,
55 tHAL_NFC_DATA_CBACK* /*p_data_cback*/) {
56 FUZZLOG("HAL_OP, type=open");
57 hal_inject_event(HAL_NFC_OPEN_CPLT_EVT, HAL_NFC_STATUS_OK);
58 }
59
HalClose()60 static void HalClose() {
61 FUZZLOG("HAL_OP, type=close");
62 hal_inject_event(HAL_NFC_CLOSE_CPLT_EVT, HAL_NFC_STATUS_OK);
63 }
64
65 const uint8_t reset_req[] = {0x20, 0x00, 0x01, 0x01};
66
67 const uint8_t reset_rsp[] = {0x40, 0x00, 0x01, 0x00};
68
69 const uint8_t reset_ntf[] = {0x60, 0x00, 0x09, 0x02, 0x01, 0x20,
70 0x04, 0x04, 0x51, 0x12, 0x01, 0x90};
71
72 const uint8_t init_req[] = {0x20, 0x01, 0x02, 0x00, 0x00};
73
74 const uint8_t init_rsp[] = {
75 0x40, 0x01, 0x1E, 0x00, 0x1A, 0x7E, 0x06, 0x01, 0x01, 0x5C, 0x03,
76 0xFF, 0xFF, 0x01, 0xFF, 0x00, 0x08, 0x00, 0x00, 0x01, 0x00, 0x02,
77 0x00, 0x03, 0x00, 0x80, 0x00, 0x82, 0x00, 0x83, 0x00, 0x84, 0x00};
78
HalWrite(uint16_t data_len,uint8_t * p_data)79 static void HalWrite(uint16_t data_len, uint8_t* p_data) {
80 FUZZLOG("HAL_OP: type=write, data=%s", BytesToHex(p_data, data_len).c_str());
81
82 if (data_len == sizeof(reset_req) &&
83 memcmp(reset_req, p_data, data_len) == 0) {
84 hal_inject_data(reset_rsp, sizeof(reset_rsp));
85 hal_inject_data(reset_ntf, sizeof(reset_ntf));
86 } else if (data_len == sizeof(init_req) &&
87 memcmp(init_req, p_data, data_len) == 0) {
88 hal_inject_data(init_rsp, sizeof(init_rsp));
89 }
90 }
91
HalCoreInitialized(uint16_t data_len,uint8_t * p_core_init_rsp_params)92 static void HalCoreInitialized(uint16_t data_len,
93 uint8_t* p_core_init_rsp_params) {
94 FUZZLOG("HAL_OP: type=coreInitialized, data=%s",
95 BytesToHex(p_core_init_rsp_params, data_len).c_str());
96 hal_inject_event(HAL_NFC_POST_INIT_CPLT_EVT, HAL_NFC_STATUS_OK);
97 }
98
HalPrediscover()99 static bool HalPrediscover() {
100 FUZZLOG("HAL_OP: type=prediscover, return=false");
101 return false;
102 }
103
HalControlGranted()104 static void HalControlGranted() { FUZZLOG("HAL_OP: type=controlGranted"); }
105
HalPowerCycle()106 static void HalPowerCycle() { FUZZLOG("HAL_OP: type=powerCycle"); }
107
108 // Magic value from the real NFC code.
109 #define MAX_NFC_EE 2
HalGetMaxNfcee()110 static uint8_t HalGetMaxNfcee() {
111 FUZZLOG("HAL_OP: type=getMaxNfcee, return=%d", MAX_NFC_EE);
112 return MAX_NFC_EE;
113 }
114
115 static tHAL_NFC_ENTRY s_halFuncEntries = {
116 .initialize = HalInitialize,
117 .terminate = HalTerminate,
118 .open = HalOpen,
119 .close = HalClose,
120 .core_initialized = HalCoreInitialized,
121 .write = HalWrite,
122 .prediscover = HalPrediscover,
123 .control_granted = HalControlGranted,
124 .power_cycle = HalPowerCycle,
125 .get_max_ee = HalGetMaxNfcee,
126 };
127
get_hal_func_entries()128 tHAL_NFC_ENTRY* get_hal_func_entries() { return &s_halFuncEntries; }