Changes

cosmetic: fix typo in comment

Change-Id: I9647fd799839e1d7aa7ab9c118a2e51455536ce4

firmware: Implement debug command via USB control vendor class

Allows to collect talloc reports and other debug information
from a script while the remsim-client is still running.

Change-Id: I1f4d29335eb0d2feef376b8ecdfe57a0162914d6

firmware: Add talloc_report_buf() encode the allocation by bits

First byte encodes the amount of blocks.
The following bytes encode a block as a single bit.

Change-Id: I3a8ddbe4100f342db2c59ad1fb9aa0014efc62b8

firmware: Implement debug command via USB control vendor class

Allows to collect talloc reports and other debug information
from a script while the remsim-client is still running.

Change-Id: I1f4d29335eb0d2feef376b8ecdfe57a0162914d6

cosmetic: fix typo in comment

Change-Id: I9647fd799839e1d7aa7ab9c118a2e51455536ce4

host: simtrace2-sniff: init exit code

Early failure i.e. of libusb return random values as exit code.

Change-Id: If920824d35c1f37efe16440b5fb190ca0fb19148

firmware: protect uart_tx_queue against ISR

cardem:
- dispatch_usb_command_cardem() appends to uart_tx_queue from the main loop
- tx_byte_tpdu() dequeues from the USART IRQ handler @ NVIC prio 0

card_handle_reset() has the same issue, drains queue and
frees uart_tx_msg from main loop while the ISR may own them.

All of this needs protection against the irq.

Needs a fixed llist_add_tail_irqsafe(), which called __enable_irq() instead of
restoring the saved PRIMASK for some unknown reason?!?!?!?

Change-Id: I7d9cdcc56263b27dfd4649dfb1da1d67761ee923

firmware: use the full 11 bit US_FIDI.FI_DI_RATIO

US_FIDI_FI_DI_RATIO_Msk is 0x7ff,
cemu rejected >= 0x400 in emu_update_fidi() and masked with 0x3ff
in card_emu_uart_update_fidi(), but update_fidi() used by
the sniffer already used 0x7ff.

-> ratios 1024..2047 are unusable in cemu, which is the entire upper
half of ISO 7816-3 Table 7 at Di=1.

A reader trying one of those in a PPS gets the proposal echoed and
accepted, after which the card keeps transmitting at the old rate.

FI_DI_RATIO is clock periods per bit -> larger ratio is a SLOWER link.
The old check rejected slow values but accepted Fi=372/Di=64, ratio 5 !?

Unify and use the register mask (= shifed by 0 so usable as value) and
reject ratios that do not fit rather than truncating to garbage dividers.

Change-Id: I6211dd5be7c5c5d2150af2aa37a403b33e6d340d

firmware: sniffer: honor the ep argument of usb_msg_alloc_hdr()

Even though all callers pass the same endpoint anyway the arg should
be used and not discarded.

Change-Id: I1fa0097b9eef531900b359c7293a6c60040254e4

contrib/flash.py: fix typos

Python has no versoin nor printf.

Change-Id: I4fd4d2592b44b3ae827e00ae73d8c451aa2ec18f

firmware: iso7816_3: fix F/D ratio for Di 8 and 9

iso7816_3_compute_fd_ratio() multiplied F by D for every d_index >= 8,
presumably because the upper half of ISO 7816-3 Table 8 encodes 1/D.

But 7816-3 2006 and 1997 differ!
That assumption is only true for the range 1010..1111, which in the
2006 version is RFU. Indices 1000 and 1001 are Di = 12 and Di = 20,
see iso7816_3_di_table[].

So right now Fi=372/Di=12 -> 372 * 12 = 4464 instead of 372 / 12 =
31.
In the cemu  value is rejected in emu_update_fidi()
and the old baud rate is silently kept.
In the sniffer update_fidi() programs US_FIDI as
4464 & 0x7ff = 368, which is garbage.

Use F/D for indices 1..9 and keep the legacy 1/D reading only for the RFU
range, where we cant really do anything useful anyway.

Change-Id: I44d6451d8b04aea2b0db7291b06a812afe84e52f

firmware: card_emu: use Di in the waiting time

ISO 7816-3 section 10.2 defines WT = WI x 960 x Fi/f seconds,
store as etu, etu = Fi / (D x f) seconds, so the Fi cancels,
but the D does not:

WT [etu] = WI x 960 x D

cemu dropped both (?!) -> WI x 960.
The old comment explains why Fi can be dropped, which is right, but
what about Di ?!
sniffer gets it right (wt_wi * 960UL * wt_d), so the two state machines
disagreed here again, by up to a factor of 64???!!?!!?

This was fixed in osmo-ccid-firmware in 066489d in 2020 but not ported
to st2.

Additionally the waiting time was only recalculated at the end of the ATR,
where D is still 1 by definition, so a PPS increasing D reprogrammed the
baud rate but left the waiting time untouched??!

etu duration shrinks with D by the same factor, wall clock WT is
independent of D, which is the whole point.
The old code decreased the waiting time by a factor of D:
after a PPS to D=8 the card emitted its NULL procedure byte at ~0.09s
instead of ~0.71s with a reader deadline of ~1.43s,
and the inactivity timeout fires 8x too early, which probably led to
unexplained wtime_exp errors.

Update wt when WI becomes known (end of ATR) and
where D changes (after the PPS response) + tests.

Change-Id: I4263176d6073029d01f9ff5b11a6311617956af6

host: simtrace2_api: do not log random memory

tx_cfg->features is logged before the memcpy() that fills it.
Looks like no one is using config.ac --enable-sanitize?

Change-Id: Id8369d312c8600ba9eea80c8f7782f196d7e20d1

firmware: qmod: fix '@' debug command switching the wrong channel

Apparently copy paste mistake.

Change-Id: I9383adcfffab07ffa5f1fd3505e3aa244fb393ff

firmware: sniffer: do not drop maximum-length ATRs

7816-3 8.1/8.2.1 allow TS plus 32 bytes.
atr_i is a byte count, not an index, process_byte_atr() guards its own
store with the same condition before incrementing, so atr_i reaches 33.

Change-Id: Ic8398cbefc0b522946b6470fd0268fa70662dab1

firmware: card_emu: fix 7816-3 10.3.2 0=256 case

add_tpdu_byte() accumulates bytes received from the reader, but passes
reader_to_card = 0, but ISO 7816-3 10.3.2 says P3 == 0 means 256 not 0

Only reachable with P3 == 0 in a receive data phase, but
simtrace2-cardem-pcsc only requests PB_AND_RX when there is command data.

Fix this anyway.

Change-Id: I0fa4741bc1293549816595e6b4e8af9e22bcfbc1

firmware: sniffer: fix ~INS procedure byte comparison

(~g_tpdu.packet[1]) == byte can never be true.
Unary ~ applies the integer promotions first,
so for tpdu INS = 0xA4 lhs should be 0x5B but as int
it gets zero extended to at least 16 bits and then flipped,
so it is 0xFFFFFF5B = -165, byte promotes to 0..255.

The ack was therefore dead code -> fallthrough to SW1
branch, fails 0x6x/0x9x test, TPDU gets flagged
SNIFF_DATA_FLAG_ERROR_MALFORMED from what I can tell.
But I am losing track of all these arcane issues to be honest.

Narrow the complement back to 8 bits.
Fyi this is unrelated to signedness and not specific to ARM.

Change-Id: I800f50ef35356429d07aa685ea919e70ec34946e

firmware: Implement debug command via USB control vendor class

Allows to collect talloc reports and other debug information
from a script while the remsim-client is still running.

Change-Id: I1f4d29335eb0d2feef376b8ecdfe57a0162914d6

firmware: Implement debug command via USB control vendor class

Allows to collect talloc reports and other debug information
from a script while the remsim-client is still running.

Change-Id: I1f4d29335eb0d2feef376b8ecdfe57a0162914d6

firmware: Implement debug command via USB control vendor class

Allows to collect talloc reports and other debug information
from a script while the remsim-client is still running.

Change-Id: I1f4d29335eb0d2feef376b8ecdfe57a0162914d6

firmware: Drop CEMU_TX_DATA when sim is in-active

When the emulated sim is in reset or without power, drop
CEMU_TX_DATA.

Change-Id: I796e548225a742cddfde12bd6a60e4d2e5c04c8f

firmware: Add talloc_report_buf() encode the allocation by bits

First byte encodes the amount of blocks.
The following bytes encode a block as a single bit.

Change-Id: I3a8ddbe4100f342db2c59ad1fb9aa0014efc62b8

firmware: Add talloc_report_buf() encode the allocation by bits

First byte encodes the amount of blocks.
The following bytes encode a block as a single bit.

Change-Id: I3a8ddbe4100f342db2c59ad1fb9aa0014efc62b8

firmware: Implement debug command via USB control vendor class

Allows to collect talloc reports and other debug information
from a script while the remsim-client is still running.

Change-Id: I1f4d29335eb0d2feef376b8ecdfe57a0162914d6

firmware: card_emu.h: add missing header stdbool.h.

Change-Id: I4ad6d5cf0b4477cbd5f761d70c4cd92fb3ca1fcd

contrib: add usb_vendor_request.py script to collect debug infos

Change-Id: Ie18e171c684ce9d67e711e3d6fda6850d5fc9e7e

firmware: card_emu.h: declare usb_buf_upd_len_and_submit()

usb_buf_upd_len_and_submit() already a public function and should be
accessible.

Change-Id: I734d4b2d782223dd2f735f140d8c9bc6fc00a086

firmware: Drop CEMU_TX_DATA when sim is in-active

When the emulated sim is in reset or without power, drop
CEMU_TX_DATA.

Change-Id: I796e548225a742cddfde12bd6a60e4d2e5c04c8f

README.md: describe the debug uart

Change-Id: I4cf929fded962e7ffb4c01628279385b2af04157

firmware: Implement debug command via USB control vendor class

Allows to collect talloc reports and other debug information
from a script while the remsim-client is still running.

Change-Id: I1f4d29335eb0d2feef376b8ecdfe57a0162914d6

firmware: Add talloc_report_buf() encode the allocation by bits

First byte encodes the amount of blocks.
The following bytes encode a block as a single bit.

Change-Id: I3a8ddbe4100f342db2c59ad1fb9aa0014efc62b8

firmare: Drop CEMU_TX_DATA when sim is in-active

When the emulated sim is in reset or without power, drop
CEMU_TX_DATA.

Change-Id: I796e548225a742cddfde12bd6a60e4d2e5c04c8f

README.md: fix typo in firmware

Change-Id: I16721418fce55322c8730920ceaa4e65f91a8a7e

firmware: Add talloc_report_buf() encode the allocation by bits

First byte encodes the amount of blocks.
The following bytes encode a block as a single bit.

Change-Id: I3a8ddbe4100f342db2c59ad1fb9aa0014efc62b8

contrib: add usb_vendor_request.py script to collect debug infos

Change-Id: Ie18e171c684ce9d67e711e3d6fda6850d5fc9e7e

README.md: describe the debug uart

Change-Id: I4cf929fded962e7ffb4c01628279385b2af04157

firmware: card_emu.h: add missing header stdbool.h.

Change-Id: I4ad6d5cf0b4477cbd5f761d70c4cd92fb3ca1fcd

firmware: card_emu.h: declare usb_buf_upd_len_and_submit()

usb_buf_upd_len_and_submit() already a public function and should be
accessible.

Change-Id: I734d4b2d782223dd2f735f140d8c9bc6fc00a086

firmware: Implement debug command via USB control vendor class

Allows to collect talloc reports and other debug information
from a script while the remsim-client is still running.

Change-Id: I1f4d29335eb0d2feef376b8ecdfe57a0162914d6

Bump version: 0.9.0.4-3248-dirty → 0.9.1

Change-Id: I0d06c6f15aa99be7609eac9afb6b9df8e6cf3dc5