简体中文 | English
Four Linux kernel patches that fix NFC tag detection on NXP NCI 2.0 controllers (PN7150, SN100x, etc.)
The stock Linux kernel cannot discover NFC tags on NXP NCI 2.0 hardware. RF polling starts, the RF field is active, but no tags are ever detected. This repository contains the root cause analysis, kernel patches, DKMS packages, and diagnostic tools to fix it.
Originally debugged on an ASUS ROG Strix G733CX with its ROG Keystone II NFC slot, but the bugs are in the generic NCI core and NXP driver — they affect any Linux system with an NXP NCI 2.0 NFC controller.
Many ASUS ROG gaming laptops (Strix, Scar, Zephyrus, TUF series) have a feature called ROG Keystone — a small magnetic physical key that slots into the right side of the laptop. Inside the Keystone II is a passive NFC tag — specifically an NXP ICODE SLIX2 (SL2S2602) chip operating at 13.56 MHz using the ISO 15693 / NFC-V protocol (Type 5 Tag). Inside the laptop is an NXP NFC controller (PN7150 or similar) connected via I2C. See Keystone Hardware Specification for detailed chip information.
When you insert the Keystone, the NFC tag enters the built-in antenna's range. The NFC controller reads the tag's UID and triggers functions like:
- Shadow Drive — unlock a hidden drive partition
- Profile switching — load custom performance/lighting profiles
- Identity verification — tie a specific Keystone to a specific laptop
On Windows, this is driven by the NXP NFC driver + ASUS Armoury Crate software. On Linux, it doesn't work at all — the NFC controller is present but the kernel driver has four bugs that prevent any tag (including the Keystone) from being detected.
This project fixes those four kernel bugs, making the NFC hardware fully functional on Linux. Once working, the NFC controller can read any NFC tag — not just the Keystone. You can use it for custom authentication, home automation triggers, data exchange, or anything else NFC can do.
If you have an ASUS ROG laptop and wondered why your Keystone slot does nothing on Linux — this is the fix.
NXP NCI 2.0 controllers require a proprietary PROP_ACT command (GID=0x0F, OID=0x02) after CORE_INIT. Without it, the RF subsystem silently discards all discovery events. The upstream nxp-nci driver never sends this command.
File: kernel/nxp-nci-nfc/core.c — Added nxp_nci_post_setup() callback with PROP_ACT handler.
The NCI spec says unmapped protocols default to Frame RF Interface. NXP controllers don't honor this — they need explicit RF_DISCOVER_MAP entries for T1T, T2T, T3T, and T5T. Without them, simple tags (MIFARE, NTAG, Felica) fail to activate.
File: kernel/nci-patched/core.c — Added 4 explicit Frame RF mappings in nci_init_complete_req().
nci_rf_intf_activated_ntf_packet() validates incoming notifications against sizeof(struct nci_rf_intf_activated_ntf) (~94 bytes). But this struct contains a max-size union of all possible parameter types. Real notifications are variable-length — a typical NFC-A MIFARE NTF is only ~20 bytes. Every real notification gets rejected with -EINVAL.
File: kernel/nci-patched/ntf.c — Changed minimum length check from sizeof(struct) to 7 (fixed header only).
The NXP_NCI_NFC_PROTOCOLS bitmask — which defines which NFC protocols the NXP driver advertises to the kernel — omitted NFC_PROTO_ISO15693_MASK. The NCI core's nci_rf_discover_req() already knew how to poll NFC-V (ISO 15693), but this code path was never triggered because the protocol wasn't registered. As a result, Type 5 / ISO 15693 tags were completely invisible, including the ROG Keystone II (which uses an NXP ICODE SLIX2 chip).
File: kernel/nxp-nci-nfc/core.c — Added NFC_PROTO_ISO15693_MASK to the NXP_NCI_NFC_PROTOCOLS macro.
# Install patched kernel modules via DKMS
sudo ./kernel/install.sh install
# Install systemd configs (auto-load at boot + neard override)
sudo ./systemd/install.sh
# Reboot, or load manually
sudo modprobe nxp-nci_i2c
# Verify
cat /sys/class/nfc/nfc0/name # → "NXP NCI NFC"
# Test with neard
sudo systemctl start neard
# Insert ROG Keystone or hold any NFC tag near the NFC slotIf your laptop has a Keystone slot (the magnetic slot on the right side), you almost certainly have an NXP NFC controller inside. Check:
# Look for NXP ACPI device
sudo dmesg | grep -iE 'NXP|nxp-nci'
# or search ACPI tables
sudo cat /sys/firmware/acpi/tables/DSDT | strings | grep -i NXPKnown ACPI IDs for the NXP NFC chip in ROG laptops: NXP1001, NXP1002, NXP3001, NXP7471.
Known affected laptops (Keystone-equipped models):
| Series | Models | Keystone Version |
|---|---|---|
| ROG Strix SCAR | G533, G733, G534, G734, G814 | Keystone II |
| ROG Strix G | G533, G733CX, G534, G734 | Keystone II |
| ROG Zephyrus Duo | GX650, GX551 | Keystone II |
| ROG Strix (older) | G531, G731 | Keystone I |
These bugs are not ASUS-specific. They affect any Linux system with:
- An NXP NFC controller: PN7150, PN7160, SN100x, SN110x, SN220
- Using the
nxp-nci/nxp-nci_i2ckernel driver - Speaking NCI 2.0 protocol
This includes industrial/embedded boards, dev kits (NXP OM5578 / OM27160), and other laptops.
How to check:
# Is there an NXP NFC controller?
dmesg | grep -i nxp-nci
# or
cat /sys/class/nfc/nfc*/name 2>/dev/null
# Is RF polling working but tags not found?
sudo dmesg -w | grep -iE 'nci|nfc'
# If you see RF_DISCOVER_RSP success but no RF_INTF_ACTIVATED_NTF → you have these bugs├── kernel/
│ ├── install.sh # DKMS install/remove/status
│ ├── nxp-nci-nfc/ # Patched NXP NCI driver (Bug #1, #4)
│ ├── nci-patched/ # Patched NCI core module (Bug #2, #3)
│ └── nfc-enable/ # Standalone GPIO enabler (debug only)
├── systemd/
│ ├── install.sh # Systemd config installer
│ ├── modules-load.d/ # Auto-load modules at boot
│ └── neard.service.d/ # neard service override
├── tools/ # Python NFC diagnostic tools
│ ├── nfc_tool.py # Direct I2C/NCI: info, poll, reset
│ ├── nfc_diag.py # System diagnostics
│ ├── nfc_devup.py # Power up NFC device via netlink
│ └── ... # (5 more diagnostic scripts)
└── docs/
└── human/
├── architecture.md # Stack diagram, NCI protocol, data flow
├── kernel-patches.md # Detailed bug analysis (symptom → cause → fix)
├── keystone-hardware.md # ROG Keystone II NFC tag specifications
└── development-guide.md # Building userspace NFC apps
Host NFCC (PN7150)
│ │
│─── CORE_RESET_CMD ──────────>│
│<── CORE_RESET_RSP ───────────│
│<── CORE_RESET_NTF ───────────│ (NCI 2.0)
│ │
│─── CORE_INIT_CMD ───────────>│
│<── CORE_INIT_RSP ────────────│
│ │
│─── NXP_PROP_ACT_CMD ────────>│ ★ Fix #1
│<── NXP_PROP_ACT_RSP ─────────│
│ │
│─── RF_DISCOVER_MAP_CMD ─────>│ ★ Fix #2 (T1T/T2T/T3T/T5T → Frame RF)
│<── RF_DISCOVER_MAP_RSP ──────│
│ │
│─── RF_DISCOVER_CMD ─────────>│ ★ Fix #4 (NFC-V/ISO 15693 included)
│<── RF_DISCOVER_RSP ──────────│
│ │
│ [tag enters field] │
│<── RF_INTF_ACTIVATED_NTF ────│ ★ Fix #3 (length check relaxed)
These patches have not been submitted upstream yet. The plan is:
- Clean up patches into proper
git format-patchform againstnet-next - Split into 4 separate commits with proper
Signed-off-by - Submit to
linux-nfc@lists.01.organdlinux-kernel@vger.kernel.org
Once upstream merges the fixes, the DKMS packages here will no longer be needed.
| Distro | Kernel | Hardware | Keystone | Status |
|---|---|---|---|---|
| Arch Linux | 6.18.x | ASUS ROG Strix G733CX (PN7150) | II | Working |
If you test on other hardware, please open an issue with your results.
- ASUS ROG Keystone — official product page
- NXP PN7150 — NFC controller datasheet
- NCI 2.0 Specification — NFC Forum (requires membership)
- neard — Linux NFC daemon
- linux-nfc — Linux NFC community
Kernel modules: GPL-2.0-only (same as Linux kernel) Python tools: GPL-2.0-only Documentation: CC-BY-4.0