HACK: Solve weird problem with lost OUT transfer on ping-pong endpoint

This adds an unconditional endpoint reset procedure to every SET_FEATURE(UnHalt). It doesn't really make sense that this is required, *particularly* as we *MUST NOT* set bEndpoint->bank to 0 here. Without this patch, I'm observing the following problem: Every first OUT transfer after a SET_INTERFACE + UNHALT on a bulk endpoint is lost. "lost" means that it completes successfully on the host, can be seen completing successfully with an ACK on a USB bus analyzer, but still doesn't show up in the firmware. No Endpoint Interrupt is generated. This can be reproduced by calling libusb_set_interface_alt_setting() from the host and then submitting a single OUT transfer. Change-Id: I18ed530e617baddf76e8f9829512443ce2a76e0d
WIP: ignore STALL
2026-03-17 21:58:33 +03:00 · 2022-03-03 19:06:12 +01:00 · 2022-03-03 19:06:12 +01:00 · 2022-03-03 19:06:12 +01:00 · 2022-03-03 19:06:12 +01:00 · 2022-03-03 19:06:12 +01:00
27 changed files with 307 additions and 580 deletions
--- a/.checkpatch.conf
+++ b/.checkpatch.conf
@@ -1 +0,0 @@
--exclude ^firmware/atmel_softpack_libraries/.*$
--- a/contrib/jenkins.sh
+++ b/contrib/jenkins.sh
@@ -27,45 +27,21 @@ verify_value_string_arrays_are_terminated.py $(find . -name "*.[hc]")
 export PKG_CONFIG_PATH="$inst/lib/pkgconfig:$PKG_CONFIG_PATH"
 export LD_LIBRARY_PATH="$inst/lib"

-# dfu target MUST be built first, the combined targets need a bl that can be combined..
-BUILDS="simtrace/dfu qmod/dfu owhw/dfu ngff_cardem/dfu "
-#
-BUILDS+="simtrace/blupdate qmod/blupdate owhw/blupdate ngff_cardem/blupdate "
-BUILDS+="simtrace/cardem qmod/cardem owhw/cardem octsimtest/cardem ngff_cardem/cardem "
-BUILDS+="simtrace/trace ngff_cardem/trace "
+BUILDS=""
+BUILDS+="simtrace/dfu simtrace/blupdate simtrace/trace simtrace/cardem "
+BUILDS+="qmod/dfu qmod/blupdate qmod/cardem "
+BUILDS+="owhw/dfu owhw/blupdate owhw/cardem "
+BUILDS+="octsimtest/cardem "
+BUILDS+="ngff_cardem/dfu ngff_cardem/blupdate ngff_cardem/cardem ngff_cardem/trace "

 cd $TOPDIR/firmware
 for build in $BUILDS; do
 	board=`echo $build | cut -d "/" -f 1`
 	app=`echo $build | cut -d "/" -f 2`
-	case "$build" in
-		"owhw/cardem")
-			comb="combined"
-			;;
-		"qmod/cardem")
-			comb="combined"
-			;;
-		"ngff_cardem/cardem")
-			comb="combined"
-			;;
-		"simtrace/trace")
-			comb="combined"
-			;;
-		*)
-			comb=""
-			;;
-	esac
 	echo
-	# Build the bootloader with clang, the rest with gcc (OS#5260, OS#6026)
-	if [ "$app" = "dfu" ]; then
-		echo "=============== $board / $app START (CLANG) =============="
-		PATH="/opt/llvm-arm/bin:$PATH" make USE_CLANG=1 BOARD="$board" APP="$app" $comb
-		echo "=============== $board / $app RES:$? =============="
-	else
-		echo "=============== $board / $app START (GCC) =============="
-		make USE_CLANG=0 BOARD="$board" APP="$app" $comb
-		echo "=============== $board / $app RES:$? =============="
-	fi
+	echo "=============== $board / $app START  =============="
+	make BOARD="$board" APP="$app"
+	echo "=============== $board / $app RES:$? =============="
 done

 echo
--- a/contrib/prepare_upload.sh
+++ b/contrib/prepare_upload.sh
@@ -9,7 +9,7 @@ echo "Copying binaries with "-latest" and "-$GIT_VERSION" appended..."
 cd firmware/bin
 for ext in bin elf; do
 	for file in *."$ext"; do
-		if ! [[ "$file" =~ ^(.*padded.*|.*nocrcstub.*bin)$ ]];then
+		if ! [[ "$file" =~ ^(.*padded.*|.*nocrcstub.*)$ ]];then
 			without_ext="${file%.*}"
 			cp -v "$file" "$without_ext-latest.$ext"
 			cp -v "$file" "$without_ext-$GIT_VERSION.$ext"
--- a/debian/compat
+++ b/debian/compat
@@ -1 +1 @@
-10
+9
--- a/debian/control
+++ b/debian/control
@@ -1,8 +1,8 @@
 Source: simtrace2
-Maintainer: Osmocom team <openbsc@lists.osmocom.org>
+Maintainer: Harald Welte <laforge@gnumonks.org>
 Section: devel
 Priority: optional
-Build-Depends: debhelper (>= 10),
+Build-Depends: debhelper (>= 9),
               autotools-dev,
               autoconf,
               automake,
@@ -16,8 +16,8 @@ Build-Depends: debhelper (>= 10),
               libusb-1.0-0-dev,
               gcc-arm-none-eabi
 Standards-Version: 3.9.8
-Vcs-Git: https://gitea.osmocom.org/sim-card/simtrace2
-Vcs-Browser: https://gitea.osmocom.org/sim-card/simtrace2
+Vcs-Git: git://git.osmocom.org/simtrace2.git
+Vcs-Browser: http://git.osmocom.org/simtrace2/
 Homepage: http://osmocom.org/projects/simtrace2/wiki

 Package: simtrace2-firmware
--- a/debian/rules
+++ b/debian/rules
@@ -13,4 +13,7 @@ export DEB_LDFLAGS_MAINT_STRIP = -Wl,-Bsymbolic-functions


 %:
-	dh $@ --no-parallel
+	dh $@
+
+override_dh_autoreconf:
+	cd host && dh_autoreconf
--- a/firmware/Makefile
+++ b/firmware/Makefile
@@ -29,13 +29,6 @@
 #   Makefile for compiling the Getting Started with SAM3S Microcontrollers project

 GIT_VERSION=$(shell $(TOP)/git-version-gen $(TOP)/.tarball-version)
-
-CFLAGS = \
-	 -Werror=format-security \
-	 -Wformat \
-	 -g \
-	 $(NULL)
-
 #-------------------------------------------------------------------------------
 #        User-modifiable options
 #-------------------------------------------------------------------------------
--- a/firmware/apps/cardem/main.c
+++ b/firmware/apps/cardem/main.c
@@ -137,6 +137,12 @@ static void check_exec_dbg_cmd(void)
 	board_exec_dbg_cmd(ch);
 }

+#include <osmocom/core/panic.h>
+void WDT_IrqHandler(void)
+{
+	osmo_panic("WDT");
+}
+
 /*------------------------------------------------------------------------------
 *        Main
 *------------------------------------------------------------------------------*/
@@ -152,8 +158,9 @@ extern int main(void)
 	led_blink(LED_GREEN, BLINK_ALWAYS_ON);

 	/* Enable watchdog for 2000ms, with no window */
-	WDT_Enable(WDT, WDT_MR_WDRSTEN | WDT_MR_WDDBGHLT | WDT_MR_WDIDLEHLT |
-		   (WDT_GetPeriod(2000) << 16) | WDT_GetPeriod(2000));
+	WDT_Enable(WDT, WDT_MR_WDFIEN | WDT_MR_WDDBGHLT | WDT_MR_WDIDLEHLT |
+		   (WDT_GetPeriod(1000) << 16) | WDT_GetPeriod(1000));
+	NVIC_EnableIRQ(WDT_IRQn);

 	PIO_InitializeInterrupts(10);

@@ -194,8 +201,8 @@ extern int main(void)
 		WDT_Restart(WDT);
 #if TRACE_LEVEL >= TRACE_LEVEL_DEBUG
 		const char rotor[] = { '-', '\\', '|', '/' };
-		putchar(rotor[i++ % ARRAY_SIZE(rotor)]);
 		putchar('\b');
+		putchar(rotor[i++ % ARRAY_SIZE(rotor)]);
 #endif
 		check_exec_dbg_cmd();
 		osmo_timers_prepare();
@@ -206,10 +213,6 @@ extern int main(void)
 			if (isUsbConnected) {
 				isUsbConnected = 0;
 			}
-			/* HACK: we don't really deal with USB disconnect yet,
-			 * so let's just reset the entire uC if this happens */
-			TRACE_INFO("Resetting uC on USB disconnect\n\r");
-			NVIC_SystemReset();
 		} else if (isUsbConnected == 0) {
 			TRACE_INFO("USB is now configured\n\r");

--- a/firmware/atmel_softpack_libraries/libchip_sam3s/chip.h
+++ b/firmware/atmel_softpack_libraries/libchip_sam3s/chip.h
@@ -15,7 +15,7 @@


 /* Define attribute */
-#if defined   ( __CC_ARM   ) /* Keil µVision 4 */
+#if defined   ( __CC_ARM   ) /* Keil µVision 4 */
    #define WEAK __attribute__ ((weak))
 #elif defined ( __ICCARM__ ) /* IAR Ewarm 5.41+ */
    #define WEAK __weak
--- a/firmware/atmel_softpack_libraries/usb/include/USBD.h
+++ b/firmware/atmel_softpack_libraries/usb/include/USBD.h
@@ -63,7 +63,7 @@
 *------------------------------------------------------------------------------*/

 /* Define attribute */
-#if defined   ( __CC_ARM   ) /* Keil µVision 4 */
+#if defined   ( __CC_ARM   ) /* Keil µVision 4 */
    #define WEAK __attribute__ ((weak))
 #elif defined ( __ICCARM__ ) /* IAR Ewarm 5.41+ */
    #define WEAK __weak
--- a/firmware/atmel_softpack_libraries/usb/include/USBDescriptors.h
+++ b/firmware/atmel_softpack_libraries/usb/include/USBDescriptors.h
@@ -296,7 +296,7 @@ typedef uint32_t (*USBDescriptorParseFunction)(void *descriptor, void *parseArg)
 */
 #pragma pack(1)

-#if defined   ( __CC_ARM   ) /* Keil µVision 4 */
+#if defined   ( __CC_ARM   ) /* Keil µVision 4 */
 #elif defined ( __ICCARM__ ) /* IAR Ewarm 5.41+ */
 #define __attribute__(...)
 #elif defined (  __GNUC__  ) /* GCC CS3 2009q3-68 */
--- a/firmware/libboard/qmod/include/board.h
+++ b/firmware/libboard/qmod/include/board.h
@@ -89,8 +89,8 @@
 #define PINS_WWAN_IN		{ PIN_WWAN1, PIN_WWAN2 }

 /* outputs controlling RESET input of modems */
-#define PIN_PERST1		{PIO_PA25, PIOA, ID_PIOA, PIO_OUTPUT_0, PIO_PULLUP}
-#define PIN_PERST2		{PIO_PA26, PIOA, ID_PIOA, PIO_OUTPUT_0, PIO_PULLUP}
+#define PIN_PERST1		{PIO_PA25, PIOA, ID_PIOA, PIO_OUTPUT_1, PIO_PULLUP}
+#define PIN_PERST2		{PIO_PA26, PIOA, ID_PIOA, PIO_OUTPUT_1, PIO_PULLUP}
 #define PINS_PERST		{ PIN_PERST1, PIN_PERST2 }

 #define PIN_VERSION_DET		{PIO_PA19, PIOA, ID_PIOA, PIO_PERIPH_D, PIO_DEFAULT}
--- a/firmware/libboard/simtrace/include/board.h
+++ b/firmware/libboard/simtrace/include/board.h
@@ -155,3 +155,7 @@
 #endif
 /* SIMtrace board supports man-in-the-middle mode */
 //#define HAVE_MITM
+
+#define DETECT_VCC_BY_ADC
+#define VCC_UV_THRESH_1V8	(1500000/2)	/* 10k/10k resistive divider halves voltage */
+#define VCC_UV_THRESH_3V	(2500000/2)	/* 10k/10k resistive divider halves voltage */
--- a/firmware/libcommon/include/cciddriver.h
+++ b/firmware/libcommon/include/cciddriver.h
@@ -175,11 +175,11 @@ typedef struct
 {
 	/// Number of seconds. If 00h then CCID default value is used.
 	unsigned char bTimeOut;
-	/// Several parameters for the PIN format options (defined in § 6.1.11.4)
+	/// Several parameters for the PIN format options (defined in § 6.1.11.4)
 	unsigned char bmFormatString4;
 	/// Define the length of the PIN to present in the APDU command
 	unsigned char bmPINBlockString;
-	/// Allows the length PIN insertion in the APDU command (defined in § 6.1.11.6)
+	/// Allows the length PIN insertion in the APDU command (defined in § 6.1.11.6)
 	unsigned char bmPinLengthFormat;
 	/// Insertion position offset in byte for the current PIN
 	unsigned char bInsertionOffsetOld;
@@ -218,13 +218,13 @@ typedef struct
 /// Protocol Data Structure for Protocol T=0 (bProtocolNum=0, dwLength=00000005h)
 typedef struct
 {
-	/// B7-4 - FI - Index into the table 7 in ISO/IEC 7816-3:1997 selecting a
+	/// B7-4 – FI – Index into the table 7 in ISO/IEC 7816-3:1997 selecting a 
 	/// clock rate conversion factor
-	/// B3-0 - DI - Index into the table 8 in ISO/IEC 7816-3:1997 selecting a
+	/// B3-0 – DI - Index into the table 8 in ISO/IEC 7816-3:1997 selecting a 
 	/// baud rate conversion factor
 	unsigned char bmFindexDindex;
-	/// For T=0 ,B0 - 0b, B7-2 - 000000b
-	/// B1 - Convention used (b1=0 for direct, b1=1 for inverse)
+	/// For T=0 ,B0 – 0b, B7-2 – 000000b
+	/// B1 – Convention used (b1=0 for direct, b1=1 for inverse)
 	unsigned char bmTCCKST0;         // 0 to 2
 	/// Extra Guardtime between two characters. Add 0 to 254 etu to the normal 
 	/// guardtime of 12etu. FFh is the same as 00h.
@@ -243,14 +243,14 @@ typedef struct
 /// Protocol Data Structure for Protocol T=1 (bProtocolNum=1, dwLength=00000007h)
 typedef struct
 {
-	/// B7-4 - FI - Index into the table 7 in ISO/IEC 7816-3:1997 selecting a
+	/// B7-4 – FI – Index into the table 7 in ISO/IEC 7816-3:1997 selecting a 
 	/// clock rate conversion factor
-	/// B3-0 - DI - Index into the table 8 in ISO/IEC 7816-3:1997 selecting a
+	/// B3-0 – DI - Index into the table 8 in ISO/IEC 7816-3:1997 selecting a 
 	/// baud rate conversion factor
 	unsigned char bmFindexDindex;
-	/// For T=1, B7-2 - 000100b
-	/// B0 - Checksum type (b0=0 for LRC, b0=1 for CRC
-	/// B1 - Convention used (b1=0 for direct, b1=1 for inverse)
+	/// For T=1, B7-2 – 000100b
+	/// B0 – Checksum type (b0=0 for LRC, b0=1 for CRC
+	/// B1 – Convention used (b1=0 for direct, b1=1 for inverse)
 	unsigned char bmTCCKST1;           // 10h, 11h, 12h, 13h
 	/// Extra Guardtime (0 to 254 etu between two characters). 
 	/// If value is FFh, then guardtime is reduced by 1.
@@ -292,8 +292,8 @@ typedef struct
   /// - 04h 1.8V
   /// Other bits are RFU.
   unsigned char  bVoltageSupport;
-   /// RRRR -Upper Word- is RFU = 0000h
-   /// PPPP -Lower Word- Encodes the supported protocol types. A "1" in a given
+   /// RRRR –Upper Word- is RFU = 0000h
+   /// PPPP –Lower Word- Encodes the supported protocol types. A ‘1’ in a given
   /// bit position indicates support for the associated ISO protocol.
   /// 0001h = Protocol T=0
   /// 0002h = Protocol T=1
@@ -318,7 +318,7 @@ typedef struct
   /// Indicates the maximum IFSD supported by CCID for protocol T=1.
   unsigned long  dwMaxIFSD;
   /// - RRRR-Upper Word- is RFU = 0000h
-   /// - PPPP-Lower Word- encodes the supported protocol types. A "1" in a given
+   /// - PPPP-Lower Word- encodes the supported protocol types. A ‘1’ in a given
   ///   bit position indicates support for the associated protocol.
   ///   0001h indicates support for the 2-wire protocol 1
   ///   0002h indicates support for the 3-wire protocol 1
--- a/firmware/libcommon/include/ringbuffer.h
+++ b/firmware/libcommon/include/ringbuffer.h
@@ -32,22 +32,4 @@ int rbuf_write(volatile ringbuf * rb, uint8_t item);
 bool rbuf_is_empty(volatile ringbuf * rb);
 bool rbuf_is_full(volatile ringbuf * rb);

-
-/* same as above but with 16bit values instead of 8bit */
-
-#define RING16_BUFLEN 512
-
-typedef struct ringbuf16 {
-	uint16_t buf[RING16_BUFLEN];
-	size_t ird;
-	size_t iwr;
-} ringbuf16;
-
-void rbuf16_reset(volatile ringbuf16 * rb);
-uint16_t rbuf16_read(volatile ringbuf16 * rb);
-uint16_t rbuf16_peek(volatile ringbuf16 * rb);
-int rbuf16_write(volatile ringbuf16 * rb, uint16_t item);
-bool rbuf16_is_empty(volatile ringbuf16 * rb);
-bool rbuf16_is_full(volatile ringbuf16 * rb);
-
 #endif /* end of include guard: SIMTRACE_RINGBUF_H */
--- a/firmware/libcommon/include/simtrace_prot.h
+++ b/firmware/libcommon/include/simtrace_prot.h
@@ -1,6 +1,6 @@
 /* SIMtrace2 USB protocol
 *
- * (C) 2015-2022 by Harald Welte <hwelte@hmw-consulting.de>
+ * (C) 2015-2017 by Harald Welte <hwelte@hmw-consulting.de>
 * (C) 2018 by sysmocom -s.f.m.c. GmbH, Author: Kevin Redon <kredon@sysmocom.de>
 *
 * This program is free software; you can redistribute it and/or modify
@@ -84,8 +84,6 @@ enum simtrace_msg_type_sniff {
 	SIMTRACE_MSGT_SNIFF_PPS,
 	/* TPDU data */
 	SIMTRACE_MSGT_SNIFF_TPDU,
-	/* Statistics */
-	SIMTRACE_MSGT_DO_SNIFF_STATS,
 };

 /* common message header */
@@ -315,9 +313,6 @@ struct st_modem_status {
 #define SNIFF_DATA_FLAG_ERROR_INCOMPLETE (1<<5)
 #define SNIFF_DATA_FLAG_ERROR_MALFORMED (1<<6)
 #define SNIFF_DATA_FLAG_ERROR_CHECKSUM (1<<7)
-#define SNIFF_DATA_FLAG_ERROR_OVERRUN (1<<8)
-#define SNIFF_DATA_FLAG_ERROR_FRAMING (1<<9)
-#define SNIFF_DATA_FLAG_ERROR_PARITY (1<<10)

 /* SIMTRACE_MSGT_SNIFF_CHANGE */
 struct sniff_change {
@@ -340,24 +335,3 @@ struct sniff_data {
 	/* data */
 	uint8_t data[0];
 } __attribute__ ((packed));
-
-/* SIMTRACE_MSGT_DO_SNIFF_STATS */
-struct st_sniff_stats {
-	uint32_t flags;				/* RFU */
-	uint32_t num_bytes;			/* total lnumber of bytes received */
-	uint32_t num_tpdu;			/* total number of TPDUs received */
-	uint32_t num_atr;			/* total number of ATRs received */
-	uint32_t num_pps;			/* total number of PPS (req, resp) received */
-	uint32_t num_reset;			/* total number of resets */
-	struct {
-		uint32_t overruns;
-		uint32_t framing_errs;
-		uint32_t parity_errs;
-		uint32_t breaks;
-	} num_usart;
-	uint32_t num_waiting_time_exp;
-	uint32_t num_tpdu_overflows;		/* TPDU buffer overflows */
-	uint32_t num_csum_errors;		/* ATR + PPS checksum */
-	uint32_t num_ringbuf_overflows;		/* ISR->main ringbuffer overflows */
-	uint32_t num_tpdu_malformed;
-} __attribute__ ((packed));
--- a/firmware/libcommon/source/card_emu.c
+++ b/firmware/libcommon/source/card_emu.c
@@ -775,15 +775,6 @@ static void set_tpdu_state(struct card_handle *ch, enum tpdu_state new_ts)
 		/* prepare to extend the waiting time once half of it is reached */
 		card_emu_uart_update_wt(ch->uart_chan, ch->waiting_time);
 		break;
-	case TPDU_S_WAIT_TX:
-		/* If we came from WAIT_RX, disable the receiver and
-		 * enable the transmitter. If we came from WAIT_RX or
-		 * WAIT_PB, reset the waiting time so that we can extend
-		 * waiting time if needed. */
-		card_emu_uart_enable(ch->uart_chan, ENABLE_TX);
-		/* prepare to extend the waiting time once half of it is reached */
-		card_emu_uart_update_wt(ch->uart_chan, ch->waiting_time);
-		break;
 	default:
 		break;
 	}
--- a/firmware/libcommon/source/cciddriver.c
+++ b/firmware/libcommon/source/cciddriver.c
@@ -193,8 +193,8 @@ static void RDRtoPCDatablock_ATR( void )
 	ccidDriver.ProtocolDataStructure[0] = Atr[2];     // TA(1)

 	// bmTCCKST0
-	// For T=0 ,B0 - 0b, B7-2 - 000000b
-	// B1 - Convention used (b1=0 for direct, b1=1 for inverse)
+	// For T=0 ,B0 – 0b, B7-2 – 000000b
+	// B1 – Convention used (b1=0 for direct, b1=1 for inverse)

 	// bGuardTimeT0
 	// Extra Guardtime between two characters. Add 0 to 254 etu to the normal 
@@ -1005,7 +1005,7 @@ unsigned char CCID_Removal( void )
 //------------------------------------------------------------------------------
 /// Interrupt-IN Messages
 /// This message is sent when any bit in the bHardwareErrorCode field is set. 
-/// If this message is sent when there is no "outstanding" command, the bSeq
+/// If this message is sent when there is no “outstanding” command, the bSeq 
 /// field will be undefined.
 /// \param bSlot ICC slot number
 /// \param bSeq  Sequence number of the bulk OUT command when the hardware error
--- a/firmware/libcommon/source/mode_cardemu.c
+++ b/firmware/libcommon/source/mode_cardemu.c
@@ -83,21 +83,10 @@ struct cardem_inst {
 #ifdef DETECT_VCC_BY_ADC
 	uint32_t vcc_uv;
 #endif
-
-	/*! real-time state of VCC I/O line, irrespective of enabled flag */
 	bool vcc_active;
-
-	/*! last VCC state we reported to the card emu state machine (conditioned by enabled flag) */
 	bool vcc_active_last;
-
-	/*! real-time state of RST I/O line, irrespective of enabled flag */
 	bool rst_active;
-
-	/*! last RST state we reported to the card emu state machine (conditioned by enabled flag) */
 	bool rst_active_last;
-
-	/*! flag indicating whether this instance should perform card emulation, or not */
-	bool enabled;
 };

 struct cardem_inst cardem_inst[] = {
@@ -437,7 +426,7 @@ void card_emu_uart_interrupt(uint8_t uart_chan)

 #ifdef DETECT_VCC_BY_ADC
 #if !defined(VCC_UV_THRESH_1V8) || !defined(VCC_UV_THRESH_3V)
-#error "You must define VCC_UV_THRESH_{1V8,3V} if you use ADC VCC detection"
+#error "You must define VCC_UV_THRESH_{1V1,3V} if you use ADC VCC detection"
 #endif

 static volatile int adc_triggered = 0;
@@ -526,25 +515,19 @@ void ADC_IrqHandler(void)
 #endif /* DETECT_VCC_BY_ADC */


-/**
- * called from main loop; dispatches card I/O state changes to card_emu from main loop.
- * NOTE: conditions I/O state on the ci->enabled flag; if the instance is disabled, we assume VCC is
- * disabled and the device is not in reset
- */
+/* called from main loop; dispatches card I/O state changes to card_emu from main loop */
 static void process_io_statechg(struct cardem_inst *ci)
 {
-	const bool vcc_active = ci->vcc_active && ci->enabled;
-	if (vcc_active != ci->vcc_active_last) {
-		card_emu_io_statechg(ci->ch, CARD_IO_VCC, vcc_active);
+	if (ci->vcc_active != ci->vcc_active_last) {
+		card_emu_io_statechg(ci->ch, CARD_IO_VCC, ci->vcc_active);
 		/* FIXME do this for real */
-		card_emu_io_statechg(ci->ch, CARD_IO_CLK, vcc_active);
-		ci->vcc_active_last = vcc_active;
+		card_emu_io_statechg(ci->ch, CARD_IO_CLK, ci->vcc_active);
+		ci->vcc_active_last = ci->vcc_active;
 	}

-	const bool rst_active = ci->rst_active && ci->enabled;
-	if (rst_active != ci->rst_active_last) {
-		card_emu_io_statechg(ci->ch, CARD_IO_RST, rst_active);
-		ci->rst_active_last = rst_active;
+	if (ci->rst_active != ci->rst_active_last) {
+		card_emu_io_statechg(ci->ch, CARD_IO_RST, ci->rst_active);
+		ci->rst_active_last = ci->rst_active;
 	}
 }

@@ -584,6 +567,35 @@ void mode_cardemu_configure(void)
 	TRACE_ENTRY();
 }

+struct relevant_irq {
+	uint32_t irq;
+	uint32_t prio;
+	const char *name;
+};
+static const struct relevant_irq relevant_irqs[] = {
+	{ UDP_IRQn, 		14, "USB" },
+	{ CONSOLE_IRQ,		15, "CONSOLE" },
+	{ FIRST_USART_IRQ,	 0, "7816_0" },
+#ifdef CARDEMU_SECOND_UART
+	{ USART0_IRQn,	 	 0, "7816_1" },
+#endif
+#ifdef DETECT_VCC_BY_ADC
+	{ ADC_IRQn,		13, "ADC" },
+#endif
+	{ PIOA_IRQn,		10, "PIOA" },
+	{ PIOB_IRQn,		10, "PIOB" },
+	{ PIOC_IRQn,		10, "PIOC" },
+};
+void dump_irq_prios(void)
+{
+	printf("Interrupt Enable Mask (ISER): %08x%08x\n\r", NVIC->ISER[1], NVIC->ISER[0]);
+	for (unsigned int i = 0; i < ARRAY_SIZE(relevant_irqs); i++) {
+		const struct relevant_irq *ri = &relevant_irqs[i];
+		printf("IRQ prio %02u (%s): current=%u, expected=%u\r\n", ri->irq, ri->name,
+			NVIC_GetPriority(ri->irq), ri->prio);
+	}
+}
+
 /* called if config is activated */
 void mode_cardemu_init(void)
 {
@@ -653,6 +665,9 @@ void mode_cardemu_init(void)
 	sim_switch_use_physical(1, 1);
 	/* TODO check RST and VCC */
 #endif /* CARDEMU_SECOND_UART */
+
+	dump_irq_prios();
+
 }

 /* called if config is deactivated */
@@ -795,8 +810,10 @@ static int usb_command_sim_select(struct msgb *msg, struct cardem_inst *ci)
 	if (msgb_l2len(msg) < sizeof(*mss))
 		return -1;

-	ci->enabled = mss->remote_sim ? true : false;
-	sim_switch_use_physical(ci->num, !ci->enabled);
+	if (mss->remote_sim)
+		sim_switch_use_physical(ci->num, 0);
+	else
+		sim_switch_use_physical(ci->num, 1);

 	return 0;
 }
@@ -940,10 +957,7 @@ void mode_cardemu_run(void)
 			}
 			uint8_t byte = rbuf_read(&ci->rb);
 			__enable_irq();
-
-			if (ci->enabled) {
-				card_emu_process_rx_byte(ci->ch, byte);
-			}
+			card_emu_process_rx_byte(ci->ch, byte);
 			//TRACE_ERROR("%uRx%02x\r\n", i, byte);
 		}

--- a/firmware/libcommon/source/ringbuffer.c
+++ b/firmware/libcommon/source/ringbuffer.c
@@ -28,16 +28,6 @@ void rbuf_reset(volatile ringbuf * rb)
 	local_irq_restore(state);
 }

-void rbuf16_reset(volatile ringbuf16 * rb)
-{
-	unsigned long state;
-
-	local_irq_save(state);
-	rb->ird = 0;
-	rb->iwr = 0;
-	local_irq_restore(state);
-}
-
 uint8_t rbuf_read(volatile ringbuf * rb)
 {
 	unsigned long state;
@@ -51,49 +41,21 @@ uint8_t rbuf_read(volatile ringbuf * rb)
 	return val;
 }

-uint16_t rbuf16_read(volatile ringbuf16 * rb)
-{
-	unsigned long state;
-	uint16_t val;
-
-	local_irq_save(state);
-	val = rb->buf[rb->ird];
-	rb->ird = (rb->ird + 1) % RING16_BUFLEN;
-	local_irq_restore(state);
-
-	return val;
-}
-
 uint8_t rbuf_peek(volatile ringbuf * rb)
 {
 	return rb->buf[rb->ird];
 }

-uint16_t rbuf16_peek(volatile ringbuf16 * rb)
-{
-	return rb->buf[rb->ird];
-}
-
 bool rbuf_is_empty(volatile ringbuf * rb)
 {
 	return rb->ird == rb->iwr;
 }

-bool rbuf16_is_empty(volatile ringbuf16 * rb)
-{
-	return rb->ird == rb->iwr;
-}
-
 static bool __rbuf_is_full(volatile ringbuf * rb)
 {
 	return rb->ird == (rb->iwr + 1) % RING_BUFLEN;
 }

-static bool __rbuf16_is_full(volatile ringbuf16 * rb)
-{
-	return rb->ird == (rb->iwr + 1) % RING16_BUFLEN;
-}
-
 bool rbuf_is_full(volatile ringbuf * rb)
 {
 	unsigned long state;
@@ -106,18 +68,6 @@ bool rbuf_is_full(volatile ringbuf * rb)
 	return rc;
 }

-bool rbuf16_is_full(volatile ringbuf16 * rb)
-{
-	unsigned long state;
-	bool rc;
-
-	local_irq_save(state);
-	rc = rb->ird == (rb->iwr + 1) % RING16_BUFLEN;
-	local_irq_restore(state);
-
-	return rc;
-}
-
 int rbuf_write(volatile ringbuf * rb, uint8_t item)
 {
 	unsigned long state;
@@ -134,18 +84,4 @@ int rbuf_write(volatile ringbuf * rb, uint8_t item)
 	}
 }

-int rbuf16_write(volatile ringbuf16 * rb, uint16_t item)
-{
-	unsigned long state;

-	local_irq_save(state);
-	if (!__rbuf16_is_full(rb)) {
-		rb->buf[rb->iwr] = item;
-		rb->iwr = (rb->iwr + 1) % RING16_BUFLEN;
-		local_irq_restore(state);
-		return 0;
-	} else {
-		local_irq_restore(state);
-		return -1;
-	}
-}
--- a/firmware/libcommon/source/sniffer.c
+++ b/firmware/libcommon/source/sniffer.c
@@ -1,6 +1,6 @@
 /* SIMtrace 2 sniffer mode
 *
- * (C) 2016-2022 by Harald Welte <hwelte@hmw-consulting.de>
+ * (C) 2016-2017 by Harald Welte <hwelte@hmw-consulting.de>
 * (C) 2018 by sysmocom -s.f.m.c. GmbH, Author: Kevin Redon <kredon@sysmocom.de>
 *
 * This program is free software; you can redistribute it and/or modify
@@ -111,14 +111,6 @@ enum tpdu_sniff_state {
 	TPDU_S_SW2, /*!< second status word */
 };

-/*! Error flags we use to report USART errors via the ringbuffer */
-#define RBUF16_F_OVERRUN	0x0100
-#define RBUF16_F_FRAMING	0x0200
-#define RBUF16_F_PARITY		0x0400
-#define RBUF16_F_TIMEOUT_WT	0x0800
-#define RBUF16_F_BREAK		0x1000
-#define RBUF16_F_DATA_BYTE	0x8000
-
 /*------------------------------------------------------------------------------
 *         Internal variables
 *------------------------------------------------------------------------------*/
@@ -146,61 +138,50 @@ static struct Usart_info sniff_usart = {
 	.state = USART_RCV,
 };
 /*! Ring buffer to store sniffer communication data */
-static struct ringbuf16 sniff_buffer;
+static struct ringbuf sniff_buffer;

 /* Flags  to know is the card status changed (see SIMTRACE_MSGT_DT_SNIFF_CHANGE flags) */
-static volatile uint32_t change_flags = 0;
-
-/* statistics for SIMTRACE_MSGT_DO_SNIFF_STATS */
-static struct st_sniff_stats g_stats;
+volatile uint32_t change_flags = 0;

 /* ISO 7816 variables */
 /*! ISO 7816-3 state */
-static enum iso7816_3_sniff_state iso_state = ISO7816_S_RESET;
-
-static struct {
-	/*! ATR state */
-	enum atr_sniff_state state;
-	/*! ATR data
-	 *  @remark can be used to check later protocol changes
-	 */
-	uint8_t atr[MAX_ATR_SIZE];
-	/*! Current index in the ATR data */
-	uint8_t atr_i;
-} g_atr;
-
+enum iso7816_3_sniff_state iso_state = ISO7816_S_RESET;
+/*! ATR state */
+enum atr_sniff_state atr_state;
+/*! ATR data
+ *  @remark can be used to check later protocol changes
+ */
+uint8_t atr[MAX_ATR_SIZE];
+/*! Current index in the ATR data */
+uint8_t atr_i = 0;
 /*! If convention conversion is needed */
-static bool convention_convert = false;
+bool convention_convert = false;
 /*! The supported T protocols */
-static uint16_t t_protocol_support = 0;
-
-static struct {
-	/*! PPS state
-	 *  @remark it is shared between request and response since they aren't simultaneous but
-	 *  follow the same procedure */
-	enum pps_sniff_state state;
-	/*! PPS request data
-	 *  @remark can be used to check PPS response */
-	uint8_t req[MAX_PPS_SIZE];
-	/*! PPS response data */
-	uint8_t rsp[MAX_PPS_SIZE];
-} g_pps;
-
-static struct {
-	/*! TPDU state */
-	enum tpdu_sniff_state state;
-	/*! Final TPDU packet
-	 *  @note this is the complete command+response TPDU, including header, data, and status words
-	 *  @remark this does not include the procedure bytes */
-	uint8_t packet[5+256+2];
-	/*! Current index in TPDU packet */
-	uint16_t packet_i;
-} g_tpdu;
+uint16_t t_protocol_support = 0;
+/*! PPS state 
+ *  @remark it is shared between request and response since they aren't simultaneous but follow the same procedure
+ */
+enum pps_sniff_state pps_state;
+/*! PPS request data
+ *  @remark can be used to check PPS response
+ */
+uint8_t pps_req[MAX_PPS_SIZE];
+/*! PPS response data */
+uint8_t pps_rsp[MAX_PPS_SIZE];
+/*! TPDU state */
+enum tpdu_sniff_state tpdu_state;
+/*! Final TPDU packet
+ *  @note this is the complete command+response TPDU, including header, data, and status words
+ *  @remark this does not include the procedure bytes
+ */
+uint8_t tpdu_packet[5+256+2];
+/*! Current index in TPDU packet */
+uint16_t tpdu_packet_i = 0;

 /*! Waiting Time (WT)
 *  @note defined in ISO/IEC 7816-3:2006(E) section 8.1 and 10.2
 */
-static uint32_t g_wt = 9600;
+uint32_t wt = 9600;

 /*------------------------------------------------------------------------------
 *         Internal functions
@@ -215,11 +196,10 @@ static const uint8_t convention_convert_lut[256] = { 0xff, 0x7f, 0xbf, 0x3f, 0xd
 /*! Update Waiting Time (WT)
 *  @param[in] wi Waiting Integer (0 if unchanged)
 *  @param[in] d Baud Rate divider (0 if unchanged)
- *  @param[in] cause String describing the source of the change
 *  @note set wt to be used by the receiver timeout
 *  @note defined in ISO/IEC 7816-3:2006(E) section 8.1 and 10.2
 */
-static void update_wt(uint8_t wi, uint8_t d, const char *cause)
+static void update_wt(uint8_t wi, uint8_t d)
 {
 	static uint8_t wt_wi = 10; /* Waiting time Integer (WI), used to calculate the Waiting Time (WT) */
 	static uint8_t wt_d = 1; /* baud rate adjustment integer (the actual value, not the table index) */
@@ -230,8 +210,8 @@ static void update_wt(uint8_t wi, uint8_t d, const char *cause)
 	if (0 != d) {
 		wt_d = d;
 	}
-	g_wt = wt_wi * 960UL * wt_d;
-	TRACE_INFO("WT updated (wi=%u, d=%u, cause=%s) to %lu ETU\n\r", wi, d, cause, g_wt);
+	wt = wt_wi * 960UL * wt_d;
+	TRACE_INFO("WT updated to %lu ETU\n\r", wt);
 }

 /*! Allocate USB buffer and push + initialize simtrace_msg_hdr
@@ -275,15 +255,6 @@ void usb_msg_upd_len_and_submit(struct msgb *usb_msg)
 	usb_buf_submit(usb_msg);
 }

-/*! Update the TPDU state
- *  @param[in] tpdu_state_new new TPDU state to update to
- */
-static void change_tpdu_state(enum tpdu_sniff_state tpdu_state_new)
-{
-	//TRACE_ERROR("TPDU state %u->%u\n\r", g_tpdu.state, tpdu_state_new);
-	g_tpdu.state = tpdu_state_new;
-}
-
 /*! Update the ISO 7816-3 state
 *  @param[in] iso_state_new new ISO 7816-3 state to update to
 */
@@ -299,33 +270,32 @@ static void change_state(enum iso7816_3_sniff_state iso_state_new)
 	switch (iso_state_new) {
 	case ISO7816_S_RESET:
 		update_fidi(&sniff_usart, 0x11); /* reset baud rate to default Di/Fi values */
-		update_wt(10, 1, "RESET"); /* reset WT time-out */
+		update_wt(10, 1); /* reset WT time-out */
 		break;
 	case ISO7816_S_WAIT_ATR:
-		rbuf16_reset(&sniff_buffer); /* reset buffer for new communication */
+		rbuf_reset(&sniff_buffer); /* reset buffer for new communication */
 		break;
 	case ISO7816_S_IN_ATR:
-		g_atr.atr_i = 0;
+		atr_i = 0;
 		convention_convert = false;
 		t_protocol_support = 0;
-		g_atr.state = ATR_S_WAIT_TS;
+		atr_state = ATR_S_WAIT_TS;
 		break;
 	case ISO7816_S_IN_PPS_REQ:
 	case ISO7816_S_IN_PPS_RSP:
-		g_pps.state = PPS_S_WAIT_PPSS;
+		pps_state = PPS_S_WAIT_PPSS;
 		break;
 	case ISO7816_S_WAIT_TPDU:
-		change_tpdu_state(TPDU_S_CLA);
-		g_tpdu.packet_i = 0;
+		tpdu_state = TPDU_S_CLA;
+		tpdu_packet_i = 0;
 		break;
 	default:
 		break;
 	}

-	TRACE_INFO("ISO 7816-3 state %u->%u\n\r", iso_state, iso_state_new);
-
 	/* save new state */
 	iso_state = iso_state_new;
+	TRACE_INFO("Changed to ISO 7816-3 state %u\n\r", iso_state);
 }

 const struct value_string data_flags[] = {
@@ -410,13 +380,13 @@ static void usb_send_atr(uint32_t flags)
 		TRACE_WARNING("Can't print ATR in ISO 7816-3 state %u\n\r", iso_state);
 		return;
 	}
-	if (g_atr.atr_i >= ARRAY_SIZE(g_atr.atr)) {
+	if (atr_i >= ARRAY_SIZE(atr)) {
 		TRACE_ERROR("ATR buffer overflow\n\r");
 		return;
 	}

 	/* Send ATR over USB */
-	usb_send_data(SIMTRACE_MSGT_SNIFF_ATR, g_atr.atr, g_atr.atr_i, flags);
+	usb_send_data(SIMTRACE_MSGT_SNIFF_ATR, atr, atr_i, flags);
 }

 /*! Process ATR byte
@@ -434,16 +404,16 @@ static void process_byte_atr(uint8_t byte)
 		TRACE_ERROR("Processing ATR data in wrong ISO 7816-3 state %u\n\r", iso_state);
 		return;
 	}
-	if (g_atr.atr_i >= ARRAY_SIZE(g_atr.atr)) {
+	if (atr_i >= ARRAY_SIZE(atr)) {
 		TRACE_ERROR("ATR data overflow\n\r");
 		return;
 	}

 	/* save data for use by other functions */
-	g_atr.atr[g_atr.atr_i++] = byte;
+	atr[atr_i++] = byte;

 	/* handle ATR byte depending on current state */
-	switch (g_atr.state) {
+	switch (atr_state) {
 	case ATR_S_WAIT_TS: /* see ISO/IEC 7816-3:2006 section 8.1 */
 		flags = 0;
 		switch (byte) {
@@ -452,12 +422,11 @@ static void process_byte_atr(uint8_t byte)
 			convention_convert = !convention_convert;
 		case 0x3b: /* direct convention used and correctly decoded */
 		case 0x3f: /* inverse convention used and correctly decoded */
-			g_atr.state = ATR_S_WAIT_T0; /* wait for format byte */
+			atr_state = ATR_S_WAIT_T0; /* wait for format byte */
 			break;
 		default:
 			TRACE_WARNING("Invalid TS received\n\r");
 			led_blink(LED_RED, BLINK_2F_O); /* indicate error to user */
-			g_stats.num_tpdu_malformed++;
 			usb_send_atr(SNIFF_DATA_FLAG_ERROR_MALFORMED); /* send ATR to host software using USB */
 			change_state(ISO7816_S_WAIT_ATR); /* reset state */
 			break;
@@ -466,41 +435,41 @@ static void process_byte_atr(uint8_t byte)
 		break;
 	case ATR_S_WAIT_T0: /* see ISO/IEC 7816-3:2006 section 8.2.2 */
 	case ATR_S_WAIT_TD: /* see ISO/IEC 7816-3:2006 section 8.2.3 */
-		if (ATR_S_WAIT_T0 == g_atr.state) {
+		if (ATR_S_WAIT_T0 == atr_state) {
 			atr_hist_len = (byte & 0x0f); /* save the number of historical bytes */
-		} else if (ATR_S_WAIT_TD == g_atr.state) {
+		} else if (ATR_S_WAIT_TD == atr_state) {
 			t_protocol_support |= (1<<(byte & 0x0f)); /* remember supported protocol to know if TCK will be present */
 		}
 		y = (byte & 0xf0); /* remember upcoming interface bytes */
 		i++; /* next interface byte sub-group is coming */
 		if (y & 0x10) {
-			g_atr.state = ATR_S_WAIT_TA; /* wait for interface byte TA */
+			atr_state = ATR_S_WAIT_TA; /* wait for interface byte TA */
 			break;
 		}
 	case ATR_S_WAIT_TA: /* see ISO/IEC 7816-3:2006 section 8.2.3 */
 		if (y & 0x20) {
-			g_atr.state = ATR_S_WAIT_TB; /* wait for interface byte TB */
+			atr_state = ATR_S_WAIT_TB; /* wait for interface byte TB */
 			break;
 		}
 	case ATR_S_WAIT_TB: /* see ISO/IEC 7816-3:2006 section 8.2.3 */
 		if (y & 0x40) {
-			g_atr.state = ATR_S_WAIT_TC; /* wait for interface byte TC */
+			atr_state = ATR_S_WAIT_TC; /* wait for interface byte TC */
 			break;
 		}
 	case ATR_S_WAIT_TC: /* see ISO/IEC 7816-3:2006 section 8.2.3 */
 		/* retrieve WI encoded in TC2*/
-		if (ATR_S_WAIT_TC == g_atr.state && 2 == i) {
+		if (ATR_S_WAIT_TC==atr_state && 2==i) {
 			if (0 == byte) {
-				update_wt(10, 0, "TC2=0");
+				update_wt(10, 0);
 			} else {
-				update_wt(byte, 0, "TC2");
+				update_wt(byte, 0);
 			}
 		}
 		if (y & 0x80) {
-			g_atr.state = ATR_S_WAIT_TD; /* wait for interface byte TD */
+			atr_state = ATR_S_WAIT_TD; /* wait for interface byte TD */
 			break;
 		} else if (atr_hist_len) {
-			g_atr.state = ATR_S_WAIT_HIST; /* wait for historical bytes */
+			atr_state = ATR_S_WAIT_HIST; /* wait for historical bytes */
 			break;
 		}
 	case ATR_S_WAIT_HIST: /* see ISO/IEC 7816-3:2006 section 8.2.4 */
@@ -509,7 +478,7 @@ static void process_byte_atr(uint8_t byte)
 		}
 		if (0 == atr_hist_len) {
 			if (t_protocol_support > 1) {
-				g_atr.state = ATR_S_WAIT_TCK; /* wait for check bytes */
+				atr_state = ATR_S_WAIT_TCK; /* wait for check bytes */
 				break;
 			}
 		} else {
@@ -517,26 +486,24 @@ static void process_byte_atr(uint8_t byte)
 		}
 	case ATR_S_WAIT_TCK:  /* see ISO/IEC 7816-3:2006 section 8.2.5 */
 		/* verify checksum if present */
-		if (ATR_S_WAIT_TCK == g_atr.state) {
+		if (ATR_S_WAIT_TCK == atr_state) {
 			uint8_t ui;
 			uint8_t checksum = 0;
-			for (ui = 1; ui < g_atr.atr_i; ui++) {
-				checksum ^= g_atr.atr[ui];
+			for (ui = 1; ui < atr_i; ui++) {
+				checksum ^= atr[ui];
 			}
 			if (checksum) {
 				flags |= SNIFF_DATA_FLAG_ERROR_CHECKSUM;
 				/* We still consider the data as valid (e.g. for WT) even is the checksum is wrong.
 				 * It is up to the reader to handle this error (e.g. by resetting)
 				 */
-				g_stats.num_csum_errors++;
 			}
 		}
 		usb_send_atr(flags); /* send ATR to host software using USB */
-		g_stats.num_atr++;
 		change_state(ISO7816_S_WAIT_TPDU); /* go to next state */
 		break;
 	default:
-		TRACE_INFO("Unknown ATR state %u\n\r", g_atr.state);
+		TRACE_INFO("Unknown ATR state %u\n\r", atr_state);
 	}
 }

@@ -550,9 +517,9 @@ static void usb_send_pps(uint32_t flags)

 	/* Sanity check */
 	if (ISO7816_S_IN_PPS_REQ == iso_state) {
-		pps_cur = g_pps.req;
+		pps_cur = pps_req;
 	} else if (ISO7816_S_IN_PPS_RSP == iso_state) {
-		pps_cur = g_pps.rsp;
+		pps_cur = pps_rsp;
 	} else {
 		TRACE_ERROR("Can't print PPS in ISO 7816-3 state %u\n\r", iso_state);
 		return;
@@ -561,22 +528,22 @@ static void usb_send_pps(uint32_t flags)
 	/* Get only relevant data */
 	uint8_t pps[6];
 	uint8_t pps_i = 0;
-	if (g_pps.state > PPS_S_WAIT_PPSS) {
+	if (pps_state > PPS_S_WAIT_PPSS) {
 		pps[pps_i++] = pps_cur[0];
 	}
-	if (g_pps.state > PPS_S_WAIT_PPS0) {
+	if (pps_state > PPS_S_WAIT_PPS0) {
 		pps[pps_i++] = pps_cur[1];
 	}
-	if (g_pps.state > PPS_S_WAIT_PPS1 && pps_cur[1] & 0x10) {
+	if (pps_state > PPS_S_WAIT_PPS1 && pps_cur[1] & 0x10) {
 		pps[pps_i++] = pps_cur[2];
 	}
-	if (g_pps.state > PPS_S_WAIT_PPS2 && pps_cur[1] & 0x20) {
+	if (pps_state > PPS_S_WAIT_PPS2 && pps_cur[1] & 0x20) {
 		pps[pps_i++] = pps_cur[3];
 	}
-	if (g_pps.state > PPS_S_WAIT_PPS3 && pps_cur[1] & 0x40) {
+	if (pps_state > PPS_S_WAIT_PPS3 && pps_cur[1] & 0x40) {
 		pps[pps_i++] = pps_cur[4];
 	}
-	if (g_pps.state > PPS_S_WAIT_PCK) {
+	if (pps_state > PPS_S_WAIT_PCK) {
 		pps[pps_i++] = pps_cur[5];
 	}

@@ -606,25 +573,24 @@ static void process_byte_pps(uint8_t byte)

 	/* sanity check */
 	if (ISO7816_S_IN_PPS_REQ == iso_state) {
-		pps_cur = g_pps.req;
+		pps_cur = pps_req;
 	} else if (ISO7816_S_IN_PPS_RSP == iso_state) {
-		pps_cur = g_pps.rsp;
+		pps_cur = pps_rsp;
 	} else {
 		TRACE_ERROR("Processing PPS data in wrong ISO 7816-3 state %u\n\r", iso_state);
 		return;
 	}

 	/* handle PPS byte depending on current state */
-	switch (g_pps.state) { /* see ISO/IEC 7816-3:2006 section 9.2 */
+	switch (pps_state) { /* see ISO/IEC 7816-3:2006 section 9.2 */
 	case PPS_S_WAIT_PPSS: /*!< initial byte */
 		flags = 0;
-		if (byte == 0xff) {
+		if (0xff) {
 			pps_cur[0] = byte;
-			g_pps.state = PPS_S_WAIT_PPS0; /* go to next state */
+			pps_state = PPS_S_WAIT_PPS0; /* go to next state */
 		} else {
 			TRACE_INFO("Invalid PPSS received\n\r");
 			led_blink(LED_RED, BLINK_2F_O); /* indicate error to user */
-			g_stats.num_tpdu_malformed++;
 			usb_send_pps(SNIFF_DATA_FLAG_ERROR_MALFORMED); /* send ATR to host software using USB */
 			change_state(ISO7816_S_WAIT_TPDU); /* go back to TPDU state */
 		}
@@ -632,24 +598,24 @@ static void process_byte_pps(uint8_t byte)
 	case PPS_S_WAIT_PPS0: /*!< format byte */
 		pps_cur[1] = byte;
 		if (pps_cur[1] & 0x10) {
-			g_pps.state = PPS_S_WAIT_PPS1; /* go to next state */
+			pps_state = PPS_S_WAIT_PPS1; /* go to next state */
 			break;
 		}
 	case PPS_S_WAIT_PPS1: /*!< first parameter byte */
 		pps_cur[2] = byte; /* not always right but doesn't affect the process */
 		if (pps_cur[1] & 0x20) {
-			g_pps.state = PPS_S_WAIT_PPS2; /* go to next state */
+			pps_state = PPS_S_WAIT_PPS2; /* go to next state */
 			break;
 		}
 	case PPS_S_WAIT_PPS2: /*!< second parameter byte */
 		pps_cur[3] = byte; /* not always right but doesn't affect the process */
 		if (pps_cur[1] & 0x40) {
-			g_pps.state = PPS_S_WAIT_PPS3; /* go to next state */
+			pps_state = PPS_S_WAIT_PPS3; /* go to next state */
 			break;
 		}
 	case PPS_S_WAIT_PPS3: /*!< third parameter byte */
 		pps_cur[4] = byte; /* not always right but doesn't affect the process */
-		g_pps.state = PPS_S_WAIT_PCK; /* go to next state */
+		pps_state = PPS_S_WAIT_PCK; /* go to next state */
 		break;
 	case PPS_S_WAIT_PCK: /*!< check byte */
 		pps_cur[5] = byte; /* not always right but doesn't affect the process */
@@ -670,13 +636,12 @@ static void process_byte_pps(uint8_t byte)
 		if (check) {
 			flags |= SNIFF_DATA_FLAG_ERROR_CHECKSUM;
 		}
-		g_pps.state = PPS_S_WAIT_END;
+		pps_state = PPS_S_WAIT_END;
 		usb_send_pps(flags); /* send PPS to host software using USB */
 		if (ISO7816_S_IN_PPS_REQ == iso_state) {
 			if (0 == check) { /* checksum is valid */
 				change_state(ISO7816_S_WAIT_PPS_RSP); /* go to next state */
 			} else { /* checksum is invalid */
-				g_stats.num_csum_errors++;
 				change_state(ISO7816_S_WAIT_TPDU); /* go to next state */
 			}
 		} else if (ISO7816_S_IN_PPS_RSP == iso_state) {
@@ -692,21 +657,19 @@ static void process_byte_pps(uint8_t byte)
 				TRACE_INFO("PPS negotiation successful: Fn=%u Dn=%u\n\r",
 					   iso7816_3_fi_table[fn], iso7816_3_di_table[dn]);
 				update_fidi(&sniff_usart, pps_cur[2]);
-				update_wt(0, iso7816_3_di_table[dn], "PPS");
+				update_wt(0, iso7816_3_di_table[dn]);
 				usb_send_fidi(pps_cur[2]); /* send Fi/Di change notification to host software over USB */
 			} else { /* checksum is invalid */
 				TRACE_INFO("PPS negotiation failed\n\r");
-				g_stats.num_csum_errors++;
 			}
-			g_stats.num_pps++;
 			change_state(ISO7816_S_WAIT_TPDU); /* go to next state */
 		}
 		break;
 	case PPS_S_WAIT_END:
-		TRACE_WARNING("Unexpected PPS received %u\n\r", g_pps.state);
+		TRACE_WARNING("Unexpected PPS received %u\n\r", pps_state);
 		break;
 	default:
-		TRACE_WARNING("Unknown PPS state %u\n\r", g_pps.state);
+		TRACE_WARNING("Unknown PPS state %u\n\r", pps_state);
 		break;
 	}
 }
@@ -724,7 +687,7 @@ static void usb_send_tpdu(uint32_t flags)
 	}

 	/* Send ATR over USB */
-	usb_send_data(SIMTRACE_MSGT_SNIFF_TPDU, g_tpdu.packet, g_tpdu.packet_i, flags);
+	usb_send_data(SIMTRACE_MSGT_SNIFF_TPDU, tpdu_packet, tpdu_packet_i, flags);
 }

 static void process_byte_tpdu(uint8_t byte)
@@ -734,102 +697,97 @@ static void process_byte_tpdu(uint8_t byte)
 		TRACE_ERROR("Processing TPDU data in wrong ISO 7816-3 state %u\n\r", iso_state);
 		return;
 	}
-	if (g_tpdu.packet_i >= ARRAY_SIZE(g_tpdu.packet)) {
-		g_stats.num_tpdu_overflows++;
+	if (tpdu_packet_i >= ARRAY_SIZE(tpdu_packet)) {
 		TRACE_ERROR("TPDU data overflow\n\r");
 		return;
 	}

 	/* handle TPDU byte depending on current state */
-	switch (g_tpdu.state) {
+	switch (tpdu_state) {
 	case TPDU_S_CLA:
 		if (0xff == byte) {
 			TRACE_WARNING("0xff is not a valid class byte\n\r");
 			led_blink(LED_RED, BLINK_2F_O); /* indicate error to user */
-			g_stats.num_tpdu_malformed++;
 			usb_send_tpdu(SNIFF_DATA_FLAG_ERROR_MALFORMED); /* send ATR to host software using USB */
 			change_state(ISO7816_S_WAIT_TPDU); /* go back to TPDU state */
 			return;
 		}
-		g_tpdu.packet_i = 0;
-		g_tpdu.packet[g_tpdu.packet_i++] = byte;
-		change_tpdu_state(TPDU_S_INS);
+		tpdu_packet_i = 0;
+		tpdu_packet[tpdu_packet_i++] = byte;
+		tpdu_state = TPDU_S_INS;
 		break;
 	case TPDU_S_INS:
 		if ((0x60 == (byte & 0xf0)) || (0x90 == (byte & 0xf0))) {
-			TRACE_WARNING("invalid INS 0x%02x\n\r", byte);
+			TRACE_WARNING("invalid CLA 0x%02x\n\r", byte);
 			led_blink(LED_RED, BLINK_2F_O); /* indicate error to user */
-			g_stats.num_tpdu_malformed++;
 			usb_send_tpdu(SNIFF_DATA_FLAG_ERROR_MALFORMED); /* send ATR to host software using USB */
 			change_state(ISO7816_S_WAIT_TPDU); /* go back to TPDU state */
 			return;
 		}
-		g_tpdu.packet_i = 1;
-		g_tpdu.packet[g_tpdu.packet_i++] = byte;
-		change_tpdu_state(TPDU_S_P1);
+		tpdu_packet_i = 1;
+		tpdu_packet[tpdu_packet_i++] = byte;
+		tpdu_state = TPDU_S_P1;
 		break;
 	case TPDU_S_P1:
-		g_tpdu.packet_i = 2;
-		g_tpdu.packet[g_tpdu.packet_i++] = byte;
-		change_tpdu_state(TPDU_S_P2);
+		tpdu_packet_i = 2;
+		tpdu_packet[tpdu_packet_i++] = byte;
+		tpdu_state = TPDU_S_P2;
 		break;
 	case TPDU_S_P2:
-		g_tpdu.packet_i = 3;
-		g_tpdu.packet[g_tpdu.packet_i++] = byte;
-		change_tpdu_state(TPDU_S_P3);
+		tpdu_packet_i = 3;
+		tpdu_packet[tpdu_packet_i++] = byte;
+		tpdu_state = TPDU_S_P3;
 		break;
 	case TPDU_S_P3:
-		g_tpdu.packet_i = 4;
-		g_tpdu.packet[g_tpdu.packet_i++] = byte;
-		change_tpdu_state(TPDU_S_PROCEDURE);
+		tpdu_packet_i = 4;
+		tpdu_packet[tpdu_packet_i++] = byte;
+		tpdu_state = TPDU_S_PROCEDURE;
 		break;
 	case TPDU_S_PROCEDURE:
 		if (0x60 == byte) { /* wait for next procedure byte */
 			break;
-		} else if (g_tpdu.packet[1] == byte) { /* get all remaining data bytes */
-			change_tpdu_state(TPDU_S_DATA_REMAINING);
+		} else if (tpdu_packet[1] == byte) { /* get all remaining data bytes */
+			tpdu_state = TPDU_S_DATA_REMAINING;
 			break;
-		} else if ((~g_tpdu.packet[1]) == byte) { /* get single data byte */
-			change_tpdu_state(TPDU_S_DATA_SINGLE);
+		} else if ((~tpdu_packet[1]) == byte) { /* get single data byte */
+			tpdu_state = TPDU_S_DATA_SINGLE;
 			break;
 		}
 	case TPDU_S_SW1:
 		if ((0x60 == (byte & 0xf0)) || (0x90 == (byte & 0xf0))) { /* this procedure byte is SW1 */
-			g_tpdu.packet[g_tpdu.packet_i++] = byte;
-			change_tpdu_state(TPDU_S_SW2);
+			tpdu_packet[tpdu_packet_i++] = byte;
+			tpdu_state = TPDU_S_SW2;
 		} else {
 			TRACE_WARNING("invalid SW1 0x%02x\n\r", byte);
 			led_blink(LED_RED, BLINK_2F_O); /* indicate error to user */
-			g_stats.num_tpdu_malformed++;
 			usb_send_tpdu(SNIFF_DATA_FLAG_ERROR_MALFORMED); /* send ATR to host software using USB */
 			change_state(ISO7816_S_WAIT_TPDU); /* go back to TPDU state */
 			return;
 		}
 		break;
 	case TPDU_S_SW2:
-		g_tpdu.packet[g_tpdu.packet_i++] = byte;
+		tpdu_packet[tpdu_packet_i++] = byte;
 		usb_send_tpdu(0); /* send TPDU to host software using USB */
-		g_stats.num_tpdu++;
 		change_state(ISO7816_S_WAIT_TPDU); /* this is the end of the TPDU */
 		break;
 	case TPDU_S_DATA_SINGLE:
 	case TPDU_S_DATA_REMAINING:
-		g_tpdu.packet[g_tpdu.packet_i++] = byte;
-		if (0 == g_tpdu.packet[4]) {
-			if (5+256 <= g_tpdu.packet_i) {
-				change_tpdu_state(TPDU_S_PROCEDURE);
+		tpdu_packet[tpdu_packet_i++] = byte;
+		if (0 == tpdu_packet[4]) {
+			if (5+256 <= tpdu_packet_i) {
+				tpdu_state = TPDU_S_PROCEDURE;
 			}
 		} else {
-			if (5+g_tpdu.packet[4] <= g_tpdu.packet_i) {
-				change_tpdu_state(TPDU_S_PROCEDURE);
+			if (5+tpdu_packet[4] <= tpdu_packet_i) {
+				tpdu_state = TPDU_S_PROCEDURE;
 			}
 		}
-		if (TPDU_S_DATA_SINGLE == g_tpdu.state) {
-			change_tpdu_state(TPDU_S_PROCEDURE);
+		if (TPDU_S_DATA_SINGLE == tpdu_state) {
+			tpdu_state = TPDU_S_PROCEDURE;
 		}
 		break;
 	default:
-		TRACE_ERROR("unhandled TPDU state %u\n\r", g_tpdu.state);
+		TRACE_ERROR("unhandled TPDU state %u\n\r", tpdu_state);
 	}
 }

@@ -841,49 +799,37 @@ void Sniffer_usart_isr(void)

 	/* Read channel status register */
 	uint32_t csr = sniff_usart.base->US_CSR;
-
-	uint16_t byte = 0;
+	/* Verify if there was an error */
+	if (csr & US_CSR_OVRE) {
+		TRACE_WARNING("USART overrun error\n\r");
+		sniff_usart.base->US_CR |= US_CR_RSTSTA;
+	}
+	if (csr & US_CSR_FRAME) {
+		TRACE_WARNING("USART framing error\n\r");
+		sniff_usart.base->US_CR |= US_CR_RSTSTA;
+	}

 	/* Verify if character has been received */
 	if (csr & US_CSR_RXRDY) {
 		/* Read communication data byte between phone and SIM */
-		byte = RBUF16_F_DATA_BYTE | (sniff_usart.base->US_RHR & 0xff);
-		g_stats.num_bytes++;
+		uint8_t byte = sniff_usart.base->US_RHR;
 		/* Reset WT timer */
-		wt_remaining = g_wt;
+		wt_remaining = wt;
+		/* Store sniffed data into buffer (also clear interrupt */
+		if (rbuf_is_full(&sniff_buffer)) {
+			TRACE_ERROR("USART buffer full\n\r");
+		} else {
+			rbuf_write(&sniff_buffer, byte);
+		}
 	}

-	/* Verify if there was an error */
-	if (csr & US_CSR_OVRE) {
-		g_stats.num_usart.overruns++;
-		byte |= RBUF16_F_OVERRUN;
-	}
-	if (csr & US_CSR_FRAME) {
-		g_stats.num_usart.framing_errs++;
-		byte |= RBUF16_F_FRAMING;
-	}
-	if (csr & US_CSR_PARE) {
-		g_stats.num_usart.parity_errs++;
-		byte |= RBUF16_F_PARITY;
-	}
-	if (csr & US_CSR_RXBRK) {
-		g_stats.num_usart.breaks++;
-		byte |= RBUF16_F_BREAK;
-	};
-
-	if (csr & (US_CSR_OVRE|US_CSR_FRAME|US_CSR_PARE))
-		sniff_usart.base->US_CR |= US_CR_RSTSTA;
-
 	/* Verify it WT timeout occurred, to detect unresponsive card */
 	if (csr & US_CSR_TIMEOUT) {
 		if (wt_remaining <= (sniff_usart.base->US_RTOR & 0xffff)) {
-			/* ensure the timeout is enqueued in the ring-buffer */
-			byte |= RBUF16_F_TIMEOUT_WT;
 			/* Just set the flag and let the main loop handle it */
 			change_flags |= SNIFF_CHANGE_FLAG_TIMEOUT_WT;
 			/* Reset timeout value */
-			wt_remaining = g_wt;
-			g_stats.num_waiting_time_exp++;
+			wt_remaining = wt;
 		} else {
 			wt_remaining -= (sniff_usart.base->US_RTOR & 0xffff); /* be sure to subtract the actual timeout since the new might not have been set and reloaded yet */
 		}
@@ -899,14 +845,6 @@ void Sniffer_usart_isr(void)
 			sniff_usart.base->US_CR |= US_CR_RETTO;
 		}
 	}
-
-	/* Store sniffed data (or error flags, or both) into buffer */
-	if (byte) {
-		if (rbuf16_write(&sniff_buffer, byte) != 0) {
-			g_stats.num_ringbuf_overflows++;
-			TRACE_ERROR("USART buffer full\n\r");
-		}
-	}
 }

 /** PIO interrupt service routine to checks if the card reset line has changed
@@ -921,7 +859,6 @@ static void Sniffer_reset_isr(const Pin* pPin)
 	/* Update the ISO state according to the reset change (reset is active low) */
 	if (PIO_Get(&pin_rst)) {
 		change_flags |= SNIFF_CHANGE_FLAG_RESET_DEASSERT; /* set flag and let main loop send it */
-		g_stats.num_reset++;
 	} else {
 		change_flags |= SNIFF_CHANGE_FLAG_RESET_ASSERT; /* set flag and let main loop send it */
 	}
@@ -949,9 +886,6 @@ void Sniffer_usart0_irq(void)
 *          Initialization routine
 *-----------------------------------------------------------------------------*/

-#define SNIFFER_IER (US_IER_RXRDY | US_IER_TIMEOUT | US_IER_OVRE | US_IER_FRAME | US_IER_PARE | \
-		     US_CSR_RXBRK)
-
 /* Called during USB enumeration after device is enumerated by host */
 void Sniffer_configure(void)
 {
@@ -963,7 +897,7 @@ void Sniffer_exit(void)
 {
 	TRACE_INFO("Sniffer exit\n\r");
 	/* Disable USART */
-	USART_DisableIt(sniff_usart.base, SNIFFER_IER);
+	USART_DisableIt(sniff_usart.base, US_IER_RXRDY);
 	/* NOTE: don't forget to set the IRQ according to the USART peripheral used */
 	NVIC_DisableIRQ(IRQ_USART_SIM);
 	USART_SetReceiverEnabled(sniff_usart.base, 0);
@@ -977,8 +911,6 @@ void Sniffer_init(void)
 {
 	TRACE_INFO("Sniffer Init\n\r");

-	memset(&g_stats, 0, sizeof(g_stats));
-
 	/* Configure pins to sniff communication between phone and card */
 	PIO_Configure(pins_sniff, PIO_LISTSIZE(pins_sniff));
 	/* Configure pins to connect phone to card */
@@ -993,15 +925,15 @@ void Sniffer_init(void)
 	PIO_EnableIt(&pin_rst);

 	/* Clear ring buffer containing the sniffed data */
-	rbuf16_reset(&sniff_buffer);
+	rbuf_reset(&sniff_buffer);
 	/* Configure USART to as ISO-7816 slave communication to sniff communication */
 	ISO7816_Init(&sniff_usart, CLK_SLAVE);
 	/* Only receive data when sniffing */
 	USART_SetReceiverEnabled(sniff_usart.base, 1);
 	/* Enable Receiver time-out to detect waiting time (WT) time-out (e.g. unresponsive cards) */
-	sniff_usart.base->US_RTOR = g_wt;
+	sniff_usart.base->US_RTOR = wt;
 	/* Enable interrupt to indicate when data has been received or timeout occurred */
-	USART_EnableIt(sniff_usart.base, SNIFFER_IER);
+	USART_EnableIt(sniff_usart.base, US_IER_RXRDY | US_IER_TIMEOUT);
 	/* Set USB priority lower than USART to not miss sniffing data (both at 0 per default) */
 	if (NVIC_GetPriority(IRQ_USART_SIM) >= NVIC_GetPriority(UDP_IRQn)) {
 		NVIC_SetPriority(UDP_IRQn, NVIC_GetPriority(IRQ_USART_SIM) + 2);
@@ -1059,84 +991,45 @@ void Sniffer_run(void)
 	 * is remaining
 	 */
 	/* Handle sniffed data */
-	if (!rbuf16_is_empty(&sniff_buffer)) { /* use if instead of while to let the main loop restart the watchdog */
-		uint16_t entry = rbuf16_read(&sniff_buffer);
-
-		if (entry & RBUF16_F_DATA_BYTE) {
-			uint8_t byte = entry & 0xff;
-			/* Convert convention if required */
-			if (convention_convert) {
-				byte = convention_convert_lut[byte];
-			}
-
-			//TRACE_ERROR_WP(">%02x", byte);
-			switch (iso_state) { /* Handle byte depending on state */
-			case ISO7816_S_RESET: /* During reset we shouldn't receive any data */
-				break;
-			case ISO7816_S_WAIT_ATR: /* After a reset we expect the ATR */
-				change_state(ISO7816_S_IN_ATR); /* go to next state */
-			case ISO7816_S_IN_ATR: /* More ATR data incoming */
-				process_byte_atr(byte);
-				break;
-			case ISO7816_S_WAIT_TPDU: /* After the ATR we expect TPDU or PPS data */
-			case ISO7816_S_WAIT_PPS_RSP:
-				if (0xff == byte) {
-					if (ISO7816_S_WAIT_PPS_RSP == iso_state) {
-						change_state(ISO7816_S_IN_PPS_RSP); /* Go to PPS state */
-					} else {
-						change_state(ISO7816_S_IN_PPS_REQ); /* Go to PPS state */
-					}
-					process_byte_pps(byte);
-					break;
+	if (!rbuf_is_empty(&sniff_buffer)) { /* use if instead of while to let the main loop restart the watchdog */
+		uint8_t byte = rbuf_read(&sniff_buffer);
+		/* Convert convention if required */
+		if (convention_convert) {
+			byte = convention_convert_lut[byte];
+		}
+		//TRACE_ERROR_WP(">%02x", byte);
+		switch (iso_state) { /* Handle byte depending on state */
+		case ISO7816_S_RESET: /* During reset we shouldn't receive any data */
+			break;
+		case ISO7816_S_WAIT_ATR: /* After a reset we expect the ATR */
+			change_state(ISO7816_S_IN_ATR); /* go to next state */
+		case ISO7816_S_IN_ATR: /* More ATR data incoming */
+			process_byte_atr(byte);
+			break;
+		case ISO7816_S_WAIT_TPDU: /* After the ATR we expect TPDU or PPS data */
+		case ISO7816_S_WAIT_PPS_RSP:
+			if (0xff == byte) {
+				if (ISO7816_S_WAIT_PPS_RSP == iso_state) {
+					change_state(ISO7816_S_IN_PPS_RSP); /* Go to PPS state */
+				} else {
+					change_state(ISO7816_S_IN_PPS_REQ); /* Go to PPS state */
 				}
-			case ISO7816_S_IN_TPDU: /* More TPDU data incoming */
-				if (ISO7816_S_WAIT_TPDU == iso_state) {
-					change_state(ISO7816_S_IN_TPDU);
-				}
-				process_byte_tpdu(byte);
-				break;
-			case ISO7816_S_IN_PPS_REQ:
-			case ISO7816_S_IN_PPS_RSP:
 				process_byte_pps(byte);
 				break;
-			default:
-				TRACE_ERROR("Data received in unknown state %u\n\r", iso_state);
 			}
-		}
-
-		/* Use timeout to detect interrupted data transmission */
-		if (entry & RBUF16_F_TIMEOUT_WT) {
-			TRACE_ERROR("USART TIMEOUT Error\n\r");
-			switch (iso_state) {
-			case ISO7816_S_IN_ATR:
-				led_blink(LED_RED, BLINK_2F_O); /* indicate error to user */
-				usb_send_atr(SNIFF_DATA_FLAG_ERROR_INCOMPLETE); /* send incomplete ATR to host software using USB */
-				change_state(ISO7816_S_WAIT_ATR);
-				break;
-			case ISO7816_S_IN_TPDU:
-				led_blink(LED_RED, BLINK_2F_O); /* indicate error to user */
-				usb_send_tpdu(SNIFF_DATA_FLAG_ERROR_INCOMPLETE); /* send incomplete PPS to host software using USB */
-				change_state(ISO7816_S_WAIT_TPDU);
-				break;
-			case ISO7816_S_IN_PPS_REQ:
-			case ISO7816_S_IN_PPS_RSP:
-				led_blink(LED_RED, BLINK_2F_O); /* indicate error to user */
-				usb_send_pps(SNIFF_DATA_FLAG_ERROR_INCOMPLETE); /* send incomplete TPDU to host software using USB */
-				change_state(ISO7816_S_WAIT_TPDU);
-				break;
-			default:
-				break;
+		case ISO7816_S_IN_TPDU: /* More TPDU data incoming */
+			if (ISO7816_S_WAIT_TPDU == iso_state) {
+				change_state(ISO7816_S_IN_TPDU);
 			}
+			process_byte_tpdu(byte);
+			break;
+		case ISO7816_S_IN_PPS_REQ:
+		case ISO7816_S_IN_PPS_RSP:
+			process_byte_pps(byte);
+			break;
+		default:
+			TRACE_ERROR("Data received in unknown state %u\n\r", iso_state);
 		}
-
-		if (entry & RBUF16_F_PARITY)
-			TRACE_ERROR("USART PARITY Error\r\n");
-		if (entry & RBUF16_F_FRAMING)
-			TRACE_ERROR("USART FRAMING Error\r\n");
-		if (entry & RBUF16_F_OVERRUN)
-			TRACE_ERROR("USART OVERRUN Error\r\n");
-		if (entry & RBUF16_F_BREAK)
-			TRACE_ERROR("USART BREAK Error\r\n");
 	}

 	/* Handle flags */
@@ -1170,6 +1063,30 @@ void Sniffer_run(void)
 				printf("reset de-asserted\n\r");
 			}
 		}
+		if (change_flags & SNIFF_CHANGE_FLAG_TIMEOUT_WT) {
+			/* Use timeout to detect interrupted data transmission */
+			switch (iso_state) {
+			case ISO7816_S_IN_ATR:
+				led_blink(LED_RED, BLINK_2F_O); /* indicate error to user */
+				usb_send_atr(SNIFF_DATA_FLAG_ERROR_INCOMPLETE); /* send incomplete ATR to host software using USB */
+				change_state(ISO7816_S_WAIT_ATR);
+				break;
+			case ISO7816_S_IN_TPDU:
+				led_blink(LED_RED, BLINK_2F_O); /* indicate error to user */
+				usb_send_tpdu(SNIFF_DATA_FLAG_ERROR_INCOMPLETE); /* send incomplete PPS to host software using USB */
+				change_state(ISO7816_S_WAIT_TPDU);
+				break;
+			case ISO7816_S_IN_PPS_REQ:
+			case ISO7816_S_IN_PPS_RSP:
+				led_blink(LED_RED, BLINK_2F_O); /* indicate error to user */
+				usb_send_pps(SNIFF_DATA_FLAG_ERROR_INCOMPLETE); /* send incomplete TPDU to host software using USB */
+				change_state(ISO7816_S_WAIT_TPDU);
+				break;
+			default:
+				change_flags &= ~SNIFF_CHANGE_FLAG_TIMEOUT_WT; /* We don't care about the timeout is all other cases */
+				break;
+			}
+		}
 		if (change_flags) {
 			usb_send_change(change_flags); /* send timeout to host software over USB */
 			change_flags = 0; /* Reset flags */
--- a/firmware/libcommon/source/usb.c
+++ b/firmware/libcommon/source/usb.c
@@ -689,7 +689,6 @@ void SIMtrace_USB_Initialize(void)
 {
 	unsigned int i;
 	/* Signal USB reset by disabling the pull-up on USB D+ for at least 10 ms */
-	USBD_HAL_Disconnect();
 	USBD_HAL_Suspend();
 	mdelay(500);
 	USBD_HAL_Activate();
--- a/host/include/osmocom/simtrace2/simtrace2_api.h
+++ b/host/include/osmocom/simtrace2/simtrace2_api.h
@@ -44,7 +44,6 @@ struct osmo_st2_cardem_inst {
 int osmo_st2_slot_tx_msg(struct osmo_st2_slot *slot, struct msgb *msg,
                         uint8_t msg_class, uint8_t msg_type);

-int osmo_st2_generic_request_board_info(struct osmo_st2_slot *slot);

 int osmo_st2_cardem_request_card_insert(struct osmo_st2_cardem_inst *ci, bool inserted);
 int osmo_st2_cardem_request_pb_and_rx(struct osmo_st2_cardem_inst *ci, uint8_t pb, uint8_t le);
--- a/host/lib/simtrace2_api.c
+++ b/host/lib/simtrace2_api.c
@@ -154,19 +154,6 @@ int osmo_st2_slot_tx_msg(struct osmo_st2_slot *slot, struct msgb *msg,
 	return rc;
 }

-/***********************************************************************
- * Generic protocol
- ***********************************************************************/
-
-/*! \brief Requeset the SIMtrace2 board information structure from the device */
-int osmo_st2_generic_request_board_info(struct osmo_st2_slot *slot)
-{
-	struct msgb *msg = st_msgb_alloc();
-
-	return osmo_st2_slot_tx_msg(slot, msg, SIMTRACE_MSGC_GENERIC, SIMTRACE_CMD_BD_BOARD_INFO);
-}
-
-
 /***********************************************************************
 * Card Emulation protocol
 ***********************************************************************/
--- a/host/src/simtrace2-cardem-pcsc.c
+++ b/host/src/simtrace2-cardem-pcsc.c
@@ -106,9 +106,6 @@ static void update_status_flags(struct osmo_st2_cardem_inst *ci, uint32_t flags)
 		LOGCI(ci, LOGL_NOTICE, "%s Resetting card in reader...\n",
 			reset == COLD_RESET ? "Cold" : "Warm");
 		osim_card_reset(card, reset == COLD_RESET ? true : false);
-
-		/* Mark reset event in GSMTAP wireshark trace */
-		osmo_st2_gsmtap_send_apdu(GSMTAP_SIM_ATR, card->atr, card->atr_len);
 	}

 	last_status_flags = flags;
@@ -170,13 +167,6 @@ static int process_do_rx_da(struct osmo_st2_cardem_inst *ci, uint8_t *buf, int l

 	rc = osmo_apdu_segment_in(&ac, data->data, data->data_len,
 				  data->flags & CEMU_DATA_F_TPDU_HDR);
-	if (rc < 0) {
-		/* At this point the communication is broken.  We cannot keep running, as we
-		 * don't know if we should continue transmitting or receiving.  Only a successful
-		 * return value by osmo_apdu_segment_in() would allow us to know this. */
-		LOGCI(ci, LOGL_FATAL, "Failed to recognize APDU, terminating\n");
-		exit(1);
-	}

 	if (rc & APDU_ACT_TX_CAPDU_TO_CARD) {
 		struct msgb *tmsg = msgb_alloc(1024, "TPDU");
@@ -199,9 +189,6 @@ static int process_do_rx_da(struct osmo_st2_cardem_inst *ci, uint8_t *buf, int l
 			msgb_free(tmsg);
 			return rc;
 		}
-		/* send via GSMTAP for wireshark tracing */
-		osmo_st2_gsmtap_send_apdu(GSMTAP_SIM_APDU, tmsg->data, msgb_length(tmsg));
-
 		msgb_apdu_sw(tmsg) = msgb_get_u16(tmsg);
 		ac.sw[0] = msgb_apdu_sw(tmsg) >> 8;
 		ac.sw[1] = msgb_apdu_sw(tmsg) & 0xff;
@@ -292,6 +279,7 @@ static void usb_in_xfer_cb(struct libusb_transfer *xfer)
 		process_usb_msg(ci, xfer->buffer, xfer->actual_length);
 		break;
 	case LIBUSB_TRANSFER_ERROR:
+	case LIBUSB_TRANSFER_STALL:
 		LOGCI(ci, LOGL_FATAL, "USB IN transfer error, trying resubmit\n");
 		break;
 	case LIBUSB_TRANSFER_NO_DEVICE:
@@ -346,6 +334,7 @@ static void usb_irq_xfer_cb(struct libusb_transfer *xfer)
 		process_usb_msg_irq(ci, xfer->buffer, xfer->actual_length);
 		break;
 	case LIBUSB_TRANSFER_ERROR:
+	case LIBUSB_TRANSFER_STALL:
 		LOGCI(ci, LOGL_FATAL, "USB INT transfer error, trying resubmit\n");
 		break;
 	case LIBUSB_TRANSFER_NO_DEVICE:
--- a/host/src/simtrace2-tool.c
+++ b/host/src/simtrace2-tool.c
@@ -63,7 +63,6 @@ static void print_help(void)
 		"\n"
 		);
 	printf( "Commands:\n"
-		"\tgeneric board-info\n"
 		"\tmodem reset (enable|disable|cycle)\n"
 		"\tmodem sim-switch (local|remote)\n"
 		"\tmodem sim-card (insert|remove)\n"
@@ -99,15 +98,9 @@ static void run_mainloop(struct osmo_st2_cardem_inst *ci)
 			fprintf(stderr, "BULK IN transfer error; rc=%d\n", rc);
 			return;
 		}
-		if (rc >= 0) {
-			printf("Rx(%u): %s\n", xfer_len, osmo_hexdump(buf, xfer_len));
-			osmo_st2_generic_request_board_info(ci->slot);
-		}
-#if 0
 		/* break the loop if no new messages arrive within 100ms */
 		if (rc == LIBUSB_ERROR_TIMEOUT)
 			return;
-#endif
 	}
 }

@@ -223,36 +216,6 @@ static int do_subsys_modem(int argc, char **argv)
 	return rc;
 }

-
-static int do_generic_board_info(int argc, char **argv)
-{
-	printf("ci: %p\n", ci);
-	printf("ci->slot: %p\n", ci->slot);
-	printf("ci->slot->transp: %p\n", ci->slot->transp);
-	return osmo_st2_generic_request_board_info(ci->slot);
-}
-
-static int do_subsys_generic(int argc, char **argv)
-{
-	char *command;
-	int rc;
-
-	if (argc < 1)
-		return -EINVAL;
-	command = argv[0];
-	argc--;
-	argv++;
-
-	if (!strcmp(command, "board-info")) {
-		rc = do_generic_board_info(argc, argv);
-	} else {
-		fprintf(stderr, "Unsupported command for subsystem generic: '%s'\n", command);
-		return -EINVAL;
-	}
-
-	return rc;
-}
-
 static int do_command(int argc, char **argv)
 {
 	char *subsys;
@@ -264,9 +227,7 @@ static int do_command(int argc, char **argv)
 	argc--;
 	argv++;

-	if (!strcmp(subsys, "generic")) {
-		rc= do_subsys_generic(argc, argv);
-	} else if (!strcmp(subsys, "modem"))
+	if (!strcmp(subsys, "modem"))
 		rc = do_subsys_modem(argc, argv);
 	else {
 		fprintf(stderr, "Unsupported subsystem '%s'\n", subsys);
--- a/host/src/simtrace2_usb.c
+++ b/host/src/simtrace2_usb.c
@@ -78,7 +78,7 @@ static struct log_info log_info = {};
 int main(int argc, char **argv)
 {
 	osmo_init_logging2(NULL, &log_info);
-	OSMO_ASSERT(osmo_libusb_init(NULL) == 0);
+	osmo_libusb_init(NULL);
 	find_devices();
 	return 0;
 }
Author	SHA1	Message	Date
Harald Welte	050b9dde68	HACK: Solve weird problem with lost OUT transfer on ping-pong endpoint This adds an unconditional endpoint reset procedure to every SET_FEATURE(UnHalt). It doesn't really make sense that this is required, particularly as we MUST NOT set bEndpoint->bank to 0 here. Without this patch, I'm observing the following problem: Every first OUT transfer after a SET_INTERFACE + UNHALT on a bulk endpoint is lost. "lost" means that it completes successfully on the host, can be seen completing successfully with an ACK on a USB bus analyzer, but still doesn't show up in the firmware. No Endpoint Interrupt is generated. This can be reproduced by calling libusb_set_interface_alt_setting() from the host and then submitting a single OUT transfer. Change-Id: I18ed530e617baddf76e8f9829512443ce2a76e0d	2022-03-03 19:06:12 +01:00
Harald Welte	f1a0ed905b	WIP: ignore STALL Change-Id: I53741f265f71797c0594a818f5a1d37534fa3774	2022-03-03 19:06:12 +01:00
Harald Welte	874a1a2d64	HACK: dump enabled interrupts and priorities during startup Change-Id: I6a19aaa8674fa510e4e346cd14a3545f7bfcc838	2022-03-03 19:06:12 +01:00
Harald Welte	b07131f2a5	HACK: cardem: Don't reset on watchdog, but panic. This should help debug watchdog triggers. Also reduce the timer to 1s to hopefully increase the chance of triggering it. Change-Id: Ie3f47e5612cdf501abff8cb6954600b785b3a3fa	2022-03-03 19:06:12 +01:00
Harald Welte	7783cd7a28	fw/qmod: enable modem RESET by default at boot When the uC firmware starts, assert the (high-active) _RESET GPIOs, which will cause the transistors to drive the mPCIe slot !PERST low. There is of course a short instance of time between the uC reset until it executes wwan_perst_init(). To avoid this, a hardware pull-up would have to be re-worked onto the _RESET[1..4] signals on the PCBA Change-Id: I8742fefa4bf02e728e34d5d8cbc0fda771e78ffb	2022-03-03 19:06:12 +01:00
Harald Welte	09c279874e	simtrace: Enable VCC detection via ADC (voltage dependent) SIMtrace should reject any card activation at 1.8V as it is a 3[.3]V device without level shifters. For this, we must include the ADC in determining the VCC voltage. Change-Id: Ic76f06037590ff1c0dae818d5eb2c2019dd75f2d FIXME: reporting uses raw ADC voltage, not the voltage before divider	2022-03-03 19:06:12 +01:00
				`@@ -1 +0,0 @@`
				`--exclude ^firmware/atmel_softpack_libraries/.*$`