Changes

firmware: replace libosmocore fsm timers

Concurrent access from main loop and the different uart irqs was not
going well and caused crashes. The libosmocore fsm does still allocate
one internal timer, but it is not used by the firmware, so libosmocore
will not touch the rbtree.

Additionally ignore checkpatch jiffies complaints because we're trying
to do firmware here.

Closes: SYS#7877
Change-Id: Id2bd67b3946bb451008965f0b68b4a919f4d10bd

firmware: replace libosmocore fsm timers

Concurrent access from main loop and the different uart irqs was not
going well and caused crashes. The libosmocore fsm does still allocate
one internal timer, but it is not used by the firmware, so libosmocore
will not touch the rbtree.

Additionally ignore checkpatch jiffies complaints because we're trying
to do firmware here.

Closes: SYS#7877
Change-Id: Id2bd67b3946bb451008965f0b68b4a919f4d10bd

firmware: add tear-free 64bit load/store helpers for jiffies

On Cortex-M4 a 64bit load may compile to two separate LDR
instructions which can lead to torn reads due to interrupts.
LDRD/STRD are restartable, they either complete or restart from
scratch, so the result is always consistent. The only "downside" is the
required alignment, which is fine.

Change-Id: I729c0fdfb5b228b03c2df1cf098743100b1ea625

firmware: replace libosmocore fsm timers

Concurrent access from main loop and the different uart irqs was not
going well and caused crashes. The libosmocore fsm does still allocate
one internal timer, but it is not used by the firmware, so libosmocore
will not touch the rbtree.

Additionally ignore checkpatch jiffies complaints because we're trying
to do firmware here.

Closes: SYS#7877
Change-Id: Id2bd67b3946bb451008965f0b68b4a919f4d10bd

firmware: replace libosmocore fsm timers

Concurrent access from main loop and the different uart irqs was not
going well and caused crashes. The libosmocore fsm does still allocate
one internal timer, but it is not used by the firmware, so libosmocore
will not touch the rbtree.

Additionally ignore checkpatch jiffies complaints because we're trying
to do firmware here.

Closes: SYS#7877
Change-Id: Id2bd67b3946bb451008965f0b68b4a919f4d10bd

firmware: add tear-free 64bit load/store helpers for jiffies

On Cortex-M4 a 64bit load may compile to two separate LDR
instructions which can lead to torn reads due to interrupts.
LDRD/STRD are restartable, they either complete or restart from
scratch, so the result is always consistent. The only "downside" is the
required alignment, which is fine.

Change-Id: I729c0fdfb5b228b03c2df1cf098743100b1ea625

firmware: replace libosmocore fsm timers

Concurrent access from main loop and the different uart irqs was not
going well and caused crashes. The libosmocore fsm does still allocate
one internal timer, but it is not used by the firmware, so libosmocore
will not touch the rbtree.

Additionally ignore checkpatch jiffies complaints because we're trying
to do firmware here.

Closes: SYS#7877
Change-Id: Id2bd67b3946bb451008965f0b68b4a919f4d10bd

firmware: add tear-free 64bit load/store helpers for jiffies

On Cortex-M4 a 64bit load may compile to two separate LDR
instructions which can lead to torn reads due to interrupts.
LDRD/STRD are restartable, they either complete or restart from
scratch, so the result is always consistent. The only "downside" is the
required alignment, which is fine.

Change-Id: I729c0fdfb5b228b03c2df1cf098743100b1ea625

firmware: replace libosmocore fsm timers

Concurrent access from main loop and the different uart irqs was not
going well and caused crashes. The libosmocore fsm does still allocate
one internal timer, but it is not used by the firmware, so libosmocore
will not touch the rbtree.

Additionally ignore checkpatch jiffies complaints because we're trying
to do firmware here.

Closes: SYS#7877
Change-Id: Id2bd67b3946bb451008965f0b68b4a919f4d10bd

firmware: replace libosmocore fsm timers

Concurrent access from main loop and the different uart irqs was not
going well and caused crashes. The libosmocore fsm does still allocate
one internal timer, but it is not used by the firmware, so libosmocore
will not touch the rbtree.

This clashes with the host build which does not have jiffies, and
is pretty much a burden because it requires special casing code due to
the completely different targets even though it was last used many years
ago and might not even work, so disable it.

Additionally ignore checkpatch jiffies complaints because we're trying
to do firmware here.

Closes: SYS#7877
Change-Id: Id2bd67b3946bb451008965f0b68b4a919f4d10bd

firmware: replace libosmocore fsm timers

Concurrent access from main loop and the different uart irqs was not
going well and caused crashes. The libosmocore fsm does still allocate
one internal timer, but it is not used by the firmware, so libosmocore
will not touch the rbtree.

This clashes with the host build which does not have jiffies, and
is pretty much a burden because it requires special casing code due to
the completely different targets even though it was last used many years
ago and might not even work, so disable it.

Additionally ignore checkpatch jiffies complaints because we're trying
to do firmware here.

Closes: SYS#7877
Change-Id: Id2bd67b3946bb451008965f0b68b4a919f4d10bd

firmware: replace libosmocore fsm timers

Concurrent access from main loop and the different uart irqs was not
going well and caused crashes. The libosmocore fsm does still allocate
one internal timer, but it is not used by the firmware, so libosmocore
will not touch the rbtree.

This clashes with the host build which does not have jiffies, and
is pretty much a burden because it requires special casing code due to
the completely different targets even though it was last used many years
ago and might not even work, so disable it.

Closes: SYS#7877
Change-Id: Id2bd67b3946bb451008965f0b68b4a919f4d10bd

firmware: replace libosmocore fsm timers

Concurrent access from main loop and the different uart irqs was not
going well and caused crashes. The libosmocore fsm does still allocate
one internal timer, but it is not used by the firmware, so libosmocore
will not touch the rbtree.

Closes: SYS#7877
Change-Id: Id2bd67b3946bb451008965f0b68b4a919f4d10bd

fw source: force reformat once and for all

This commit applies the rules to all files that matter
(obv excluding asf4 code) since it is impossible to modify code
because the code never used the code style enforced by the
linter/clang-format and
1) changing code
2) reformatting code
3) extracting the reformatting changes for the modified lines as a
separate commit
4) commiting standalone reformatting changes
4) commiting the actual code change on top
is a workflow that takes forever and is completely ridiculous because
the whole point of formatter rules is to apply them.

This needs a second commit with .git-blame-ignore-revs to not pollute blame.

Change-Id: Iacc086bb566551225e7a21b639a1ad2ec257484f

formatting: update .clang-format

Updates the formatting rules derived from linux kernel
098b6e44cbaa2d526d06af90c862d13fb414a0ec

At the same time tell clang-format to keep the bespoke formatting
used for the fsm and usb descs.

Change-Id: I1fd4d38897946693b5495fa4d0b61925eb9d07f7

fw: add git blame ignore file

Reformatting should not pollute blame, so ignore those revs.

Change-Id: I35b86f52d491c9e28ab0af9e3e3d4fd5f6dbd119

Revert "clang-format: set ColumnLimit: 0"

This reverts commit 97caf6244398760ed8b0c5c045867b4bea36f0a0.

Reason for revert: we don't want clang-format to actively generate arbitrarily long line lengths.

Change-Id: I49111af334e6967a9c3a63ccb9d179df444d63bb

ensure libosmocore logging is properly disabled for builds

Change-Id: I169a059d8daff0a3993318a4ea3ab7adcb05fee3

fw source: force reformat once and for all

This commit applies the rules to all files that matter
(obv excluding asf4 code) since it is impossible to modify code
because the code never used the code style enforced by the
linter/clang-format and
1) changing code
2) reformatting code
3) extracting the reformatting changes for the modified lines as a
separate commit
4) commiting standalone reformatting changes
4) commiting the actual code change on top
is a workflow that takes forever and is completely ridiculous because
the whole point of formatter rules is to apply them.

This needs a second commit with .git-blame-ignore-revs to not pollute blame.

Change-Id: Iacc086bb566551225e7a21b639a1ad2ec257484f

fw: add git blame ignore file

Reformatting should not pollute blame, so ignore those revs.

Change-Id: I35b86f52d491c9e28ab0af9e3e3d4fd5f6dbd119

ccid: properly emit wait time ext messages

The CCID message that tells the host that the card
asked for a wait time extension was missing.

This is a bit weird, because it breaks the 1:1
relationship between messages and responses that
usually exists, nor does it consume a bSeq,
so we just emit WT msgs as appropriate.

It is bounded to prevent msgb exhaustion issues.

Closes: OS#6458
Change-Id: Ib69483d453a0e5ebb1bc1885a8f78790a0f10d70

firmware: fix msgb/list mixed irq access handling

This fixes the mishandling of in_progress and the queues in the submit
functions that are in part irq driven, too, and ensures nothing breaks
by preventing concurrent access from irqs to the queues. Applying the
same pattern to all functions/cases is fine either way.

On top of all of tha the out ep was irq driven, so if submit_next_out
fails it was stuck, now fixed by attempted submit from main loop, and of
course the queue manipulation should be irq safe here as well.

Change-Id: I9212bfa7688cb4d3161ba963b854225744128632

ccid: generate proper error for short messages

Change-Id: I3bf0bebd361666a2f3d0341444415a6f25d2b4bf

ccid: Handle the TPDU-length = 4 case according to CCID spec

While ISO7816-3 forbids any TPDU shorter from 5 bytes, the CCID spec
begs to differ and actually permits a host to send us 4-byte TPDUs of
Form 1, giving the responsibility of adding the P3=00h octet to the CCID
implementation.

Let's implement this accordingly.  While at it, also reject TPDUs of
lengths 1, 2 and 3 bytes - just like zero-length TPDUs.

Change-Id: Ia27962bda526af3373b36d637e2b548aa01a3346
Closes: OS#6973

ccid: properly reject PC_to_RDR_{ResetParameters,SetParameters}

As per CCID 1.1 ch 6.2.3 a reader that does not support
these commands can reject them, which we now do, instead of
pretending to accept the params.

This requires https://gitlab.com/wireshark/wireshark/-/issues/20107 to
be properly decoded in wireshark >= 4.4.8 .

As a bonus this fixes the error response in gen_err_resp which so far had superfluous param data attached to it.

Closes: OS#5380
Change-Id: I4d0671c160e9028097397ec47982bafbfdc24f24

ccid: properly reject PC_to_RDR_{ResetParameters,SetParameters}

As per CCID 1.1 ch 6.2.3 a reader that does not support
these commands can reject them, which we now do, instead of
pretending to accept the params.

This requires https://gitlab.com/wireshark/wireshark/-/issues/20107 to
be properly decoded in wireshark >= 4.4.8 .

Closes: OS#5380
Change-Id: I4d0671c160e9028097397ec47982bafbfdc24f24

ccid: properly emit wait time ext messages

The CCID message that tells the host that the card
asked for a wait time extension was missing.

This is a bit weird, because it breaks the 1:1
relationship between messages and responses that
usually exists, nor does it consume a bSeq,
so we just count and emit WT msgs as appropriate.

Closes: OS#6458
Change-Id: Ib69483d453a0e5ebb1bc1885a8f78790a0f10d70

firmware: enable watchdog timer

2s is plenty, and while not perfect it should at
least ensure that hangs that require manual
intervention happen rarely if at all.

At least from a custimer POV having resets in case
something breaks is better than ending up with non
working devices that are stuck.

Change-Id: I1ef1fc70d33492efe0171a7879c1a23f16957195

ccid: properly emit wait time ext messages

The CCID message that tells the host that the card
asked for a wait time extension was missing.

This is a bit weird, because it breaks the 1:1
relationship between messages and responses that
usually exists, nor does it consume a bSeq,
so we just count and emit WT msgs as appropriate.

Closes: OS#6458
Change-Id: Ib69483d453a0e5ebb1bc1885a8f78790a0f10d70

ccid: Fix CCID RDR_to_PC_Parameters (missing bProtocolNum)

Our RDR_to_PC_Parameters message was broken, as it was missing
the bProtocolNum value after the header.  Let's fix that.

Change-Id: I67d5cb876d20b29f4759d5b194606f34b8b966c4

ccid: Fix [unused] RDR_to_PC_Hardware_Error struct definition

Our definition of the message was wrong; it is an interrupt endpoint
message without the full header of the bulk-in endpoint. Luckily the
definition was not used in the code base, so this is not fixing any
problem visible on the protocol level.

Change-Id: Ieb756c37402c4ebea32cc3cd23ba3842f4c0df3e

irq: make default IRQ handler Dummy_Handler weak

To allow overwriting the default handler from the application,
make it weak.

Change-Id: I544e9c84dd538bb744fb799904adc58f9d850465

main: rework panic handler

When an OSMO_ASSERT() fails it will call the osmo panic handler.
Previous it will always calls into a breakpoint which will require
a power-cycle.

Change the default (for production) to use a system reset.
But still allow calling into breakpoint by setting `break_on_panic` via SWD.

Change-Id: I91c732001e848ec5509bf81af8aac1a2a80eb718

irq: make default IRQ handler Dummy_Handler weak

To allow overwriting the default handler from the application,
make it weak.

Change-Id: I83850b8bad54f55bb26e69d7c4bdac7357c21902

sysmoOCTSIM: define own IRQ handlers

Previous: In case of an fault, nmi or an uncatched IRQ, the OCTSIM
would go into a while(1) loop and would require a power cycle.
Overwrite the default Dummy_Handler with our own handler and
add panic handler as function to allow them to show up as
a different backtrace.

Change-Id: If8476fd4a784312a0597ddd0b7eb54a7ebf94868

clang-format: set ColumnLimit: 0

While our coding style says "we accept line lengths of up to 120
characters", in practice we oftentimes end up preferring longer lines
(e.g. due to having comments at the end, or to keep them consistent with
similar but shorter lines).

The checkpatch config has already been adjusted to just ignore the line
length completely. Adjust the clang-format config to do the same.

Related: osmo-ci I88fd86ac550fddb3017aeceb647c3d9e75367372
Change-Id: I1f0d511d90a0725f195e08dd6a99eb3d55bd6fc1

After initialisation: turn user led on

Related: OS#5158
Change-Id: Ide37ea32648536d333bd5051b142eb15959d29bf

sysmoOCTSIM: define own IRQ handlers

Previous: In case of an fault, nmi or an uncatched IRQ, the OCTSIM
would go into a while(1) loop and would require a power cycle.
Use a generic panic handler

Change-Id: If8476fd4a784312a0597ddd0b7eb54a7ebf94868

main: rework panic handler

When an OSMO_ASSERT() fails it will call the osmo panic handler.
Previous it will always calls into a breakpoint which will require
a power-cycle.

Change the default (for production) to use a system reset.
But still allow calling into breakpoint by setting `break_on_panic` via SWD.

Change-Id: I91c732001e848ec5509bf81af8aac1a2a80eb718

same54: make the default irq handler weak

The default handler for all IRQs is the Dummy_Handler, which is a
simple while(true); wait-loop.

Introduce a weak symbol Default_Handler which alias to the
Dummy_Handler.

This allows replacing the default handler by a single
symbol rather than setting all IRQs seperate to the new handler.

Change-Id: I544e9c84dd538bb744fb799904adc58f9d850465

After initialisation: turn system led on

Related: OS#5158
Change-Id: Ide37ea32648536d333bd5051b142eb15959d29bf

dfu: fix integer overflow in delay_us()

delay_us(uint16_t) can't handle us > 65535.
Split the 100 ms into 2 function calls.

Change-Id: Ieaf1109c99662a21927901a2e0e3ddac42aa3d3c