Set CFLAGS on top of the Makefile, to avoid using the distribution's
default CFLAGS. In debian testing and unstable, -fcf-protection was
recently added to the default CFLAGS, but it cannot be used with the
cc1: error: '-fcf-protection=full' is not supported for this target
make: *** [Makefile:270: obj/simtrace/flash_backtrace.o] Error 1
At the moment only APDUs are logged to GSMTAP. It is not uncommon that a
card is resetted by the UE multiple times during normal operation. When
the trace lacks the reset events (ATR) it becomes difficult to follow in
which state the card actually is. Let't mark reset events by sending the
ATR via GSMTAP (like simtrace2_sniff already does it)
Move the logic down to where make gets called, so we don't need the
variable. Print whether we use CLANG or GCC.
Don't put /opt/llvm-arm/bin infront of PATH unless building with CLANG.
Right now it doesn't seem to have e.g. an override for gcc, but the
files in that path may change when we update
The Makefile already runs autoreconf -fi in the "utils" target:
(cd host && \
autoreconf -fi && \
./configure --prefix=/usr --disable-werror && \
The override is not useful, as it leads to debhelper running autoreconf
as well, but without running ./configure and make in the host directory
afterwards. So autoreconf just runs twice.
I've also considered to change debian/rules to only run the "fw"
target, and not the "utils" target of the Makefile. But that only makes
it more complex, as debhelper would then need to run make twice, once in
the root directory (as "make fw"), and once in the host directory. We
would need to add several lines to debian/rules to do effectively the
Make this change now, as "cd host && dh_autoreconf" doesn't work with
debhelper compat level v10 anymore (--sourcedir could be used instead,
but as mentioned above, it's not useful).
* Fix UTF-8 encoding. This caused the endianness check to fail, which
reads all .c and .h files.
* Add .checkpatch.conf to skip linting for:
We so far didn't have interrupts enabled for those, and just caught
them "by accident" if a byte was received or if a timeout happened.
Let's explicitly enable those interrupts so we also catch those
conditions by themselves.
Before this patch, all UART characters went through a fifo/ringbuffer
of depth 512, while events like timeout were delivered directly via
a global flags variable from ISR to main code. This means that one or
more correct/complete TPDUs could theoretically still be in the FIFO,
but the "Fast path" of the timeout handling is pre-empting that and
messing with the state machines.
All events from the UART should be delivered via the ring-buffer to make
sure they arrive in order at the main function.
The old "report timeout via change flags in separate USB message" code
is left in place. On the USB protocol we should keep it for
compatibility. Internally we should probably also migrate that over
to the new ring-buffer method in a second step.
So far, we use a uint8_t ring buffer as "FIFO" between USART Rx
interrupt and main context. That's fine for expressing the bytes we
receive. However, if we also want to report USART errors synchronously
in that stream, we actually need more bits to express those.
Reporting USART errors via the ring buffer is the only way how the
sniffer code can know in which TPDU the error occurred. Reporting them
any other way (global variable, ...) would loose the timing relationship
where in the received stream the error occurred.
This change just changes the ringbuffer from 1024-entry 8bit to
512-entry 16bit and doesn't add any error reporting.
Not critical (we disable the USART interrupts in NVIC anyway), but
if Sniffer_init() enables this flag, it's good style for Sniffer_exit()
to disable it.
This is a purely cosmetic change that groups PPS, TPDU and ATR related
global variables into structs. The structs get g_ prefixes to indicate
a global variable. This avoids confusion between very short/generic
variable names that might clash with local variables.
process_byte_pps() would never enter the error path in which the
first byte would be != 0xff. However, the caller already verified
this before calling process_byte_pps() so the error path should
never be hit anyway.
rbuf_write() will tell us in the return value if the buffer was full
(error) or not (success). Let's use that return value rather than a
theoretically race-y call to rbuf_is_full() before.
It's theoretical as the write happens from IRQ context and the read from
normal process context, so the fill-level cannot really change while
we're in the USART interrupt. So it doesn't fix a bug, just improves
coding style and also avoids an extra function call + irq-disable/re-enable.
In low-level debugging it might be useful to trace the TPDU state
changes, so let's factor-out the state-setting as a function that
can be amended with printf() or GPIO toggles or the like.
No logical change is introduced here, just assignments replaced with
calling a function that does the assignment. compiler should inline
Reading of code + datasheet showed that we did enable parity checking
but never actually checked if the USART has the PARE bit in CSR set.
Let's change that. Plus also avoid possible race conditions due to
multiple status resets via US_CR_RSTSTA. Let's only reset that once
per interrupt handler.
TODO: actually do something useful at that point. We currently don't
report those to the host, nor do we attempt to recover in any way. The
data sheet also doesn't tell us what it actually does in such
situations; it appears the character is *not* returned from the USART,
so we're missing one byte in the stream at that point.
Due to popular demand people want elf files that can be loaded to get
debug symbols, so publish the elf file, but not the stub-less bin file.
This elf file can ONLY be used to look up symbols, it should NOT be
"load"ed into flash, because the preceding crc stub has to match. Mixing
older crc stubs that are still in flash and newer elf files means the
device will end up in DFU mode upon reset.
In the function set_tpdu_state(), there is a missing transition to
WAIT_TX state. This is fine if you are coming from the WAIT_PB state,
which has already restarted the waiting timer via
card_emu_uart_update_wt(), but if you are coming from the WAIT_RX
state, then card_emu_uart_update_wt() is never called and the USART
timer is never restarted. (Because the transmitter is left enabled in
WAIT_RX, the response is still sent to the modem; it is just the
half-wait timeouts that are missing).
- improves trace diagnostic output by moving cursor back over the
the rotor before a diagnostic message has a chance to be printed.
there is still a race condition, but it is much better.
As the bootloader goes beyond partition size in modern gcc, use clang
Depends: docker-playground Ib82a53fa7edc62d21e772efbb9b2c049d1b50c4d
This fixes the firmware USB interface somehow getting stuck
after a USB disconnect/reconnect without power cycle.
Right now there are a number of things we only execute the first time we
reach USBD_STATE_CONFIGURED, but not at any subsequent such event.
It's also rather clear that this doesn't really show in simtrace2 as it
is bus-powered. And it doesn't show on OWHW as we don't have any USB
unplug situations of the USB between the on-board traces of USB host and
SAM3S. So this really only is relevant to QMOD.
A cheap and dirty work-around is to simply reset the entire uC every
time a USB unplug happens.
osmo_apdu_segment_in() may return a negative number on receipt of
"unknown APDU case", and that would crash simtrace2-cardem-pcsc:
msgb(0x55d2cf7aa8a0): Not enough tailroom msgb_put
(allocated 920, head at 0, len 7, tailroom 1017 < want tailroom 65534)
backtrace() returned 19 addresses
Whenever osmo_apdu_segment_in() fails to recognize an APDU, the
communication is broken, because we don't know if we should continue
transmitting or receiving. Only a successful return value by would
allow us to know this. Do not crash, exit() gracefully.
This change prevents contention on the ISO7816 bus by disabling the card emulation state machine when the SIM switch is in the local mode. Without this change, the card emulation firmware can clobber ISO7816 communications and cause contention with certain (but not all) SIM cards.
- Add 'enabled' flag to cardemu instance that is set/cleared by usb_command_sim_select() (the only place where sim switch occurs).
- Flag is initialized as false (disabled) by default, to match local SIM mode default.
- When card emulation is disabled, force SIM VCC to be "OFF", SIM RESET as "not in RESET", and drop bytes bytes received on the ISO7816 interface (but do service buffers).
The firmware doesn't recover from a OSMO_ASSERT() which direct reset the board.
After the reset the firmware will waits forever for the USBD state USBD_STATE_CONFIGURED.
By adding the explicit USBD_HAL_DISCONNECT the board always recovers.
Particularly the VCC/RST/CLK changes can happen quite frequent, and
we were seeing quite a number of overflows of the usb_buf queue for EP06
(interrupt endpoint) in cardem.
I first tried increasing the maximum queue size to up to 10, but that
still didn't resolve those EP06 overflow error log messages.
Reducing the bInterval from 16 to 1 made them go away in all my
Sometimes I get LIBUSB_TRANSFER_ERROR particularly when the USB bus
is very busy. We shouldn't terminate the program, but simply resubmit
it. That's what we have multiple transfers for...
We initialize a local variable to -1, and if the user specifies
no address from the command line, we use this in the interface match
struct, which uses a uint8_t. This means 255 ends up in there, and
as a result no usb interface ever matches unless the user explicitly
specifies the -A command line argument.
With this patch any absent -A argument will result in ifm.addr == 0,
which means "don't match on address", and which is what we want here.
In some readers (at least CardMan 3121), the simtrace2-cardem firmware
claims there are power-up sequences where RESET is released before VCC
becomes active. Let's detect such spec-incompliant power-up sequences
and use them to trigger a cold reset of the card.
* drop log statements that are already in libosmo-simtrace2
* don't printf directly, but go via LOGCI
* make LOGCI use libosmocore logging
* configure libosmocore logging in a 'convenient' way
The SIMtrace2 protocol alwasy contained a field for the VCC voltage,
the cardem firmware just never populated that field, even on those
boards that use the ADC to determine its voltage.