Add osmo_apdu_segment_in2() to ensure correct parsing of GP GET DATA

osmo_apdu_segment_in() doesn't have the context of the previous APDU,
for nearly all calls this is fine, except for GP GET DATA, which can be
a case 2 or case 4 APDU.
GP GET DATA defines the Le field as 0x00 which is used by osmo_apdu_segment_in
to detect if it is a case 2 or case 4.
However a card can respond with the SW 6cXX, which means the previous
command must be resend with a Le field XX, which got misinterpreted by
the osmo_apdu_segment_in() as a case 4 resulting in a timeout waiting for
more data.

Modem <-> Card
81cadf2000 ->
 <- 6c0b
81cadf200b ->
 -- Simtrace waits for more data because it wrongly decodes it as APDU case 4
    instead of case 2.

Related: SYS#8147
Change-Id: Ie238662e7e6a10dd4283ede0c8d8d73bc375c247
This commit is contained in:
Alexander Couzens authored and lynxis lazus committed 2026-08-18 15:31:43 +00:00
1 parent 9f85d1e15b
commit 63a61bfdaf
10 files changed
+197 -1

No files matched your search

+38
View File
@@ -77,15 +77,53 @@ const char *osmo_apdu_dump_context_buf(char *buf, unsigned int buf_len,
*/
int osmo_apdu_segment_in(struct osmo_apdu_context *ac, const uint8_t *apdu_buf,
unsigned int apdu_len, bool new_apdu)
{
return osmo_apdu_segment_in2(ac, NULL, apdu_buf, apdu_len, new_apdu);
}
/*! \brief input function for APDU segmentation
* \param ac APDU context across successive calls
* \param prev_ac Previous APDU context across successive calls
* \param[in] apdu_buf APDU input data buffer
* \param[in] apdu_len Length of apdu_buf
* \param[in] new_apdu Is this the beginning of a new APDU?
*
* The function returns APDU_ACT_TX_CAPDU_TO_CARD once there is
* sufficient data of the APDU received to transmit the command-APDU to
* the actual card.
*
* The function returns APDU_ACT_RX_MORE_CAPDU_FROM_READER when there
* is more data to be received from the card reader (GSM Phone).
*/
int osmo_apdu_segment_in2(struct osmo_apdu_context *ac, struct osmo_apdu_context *prev_ac,
const uint8_t *apdu_buf, unsigned int apdu_len,
bool new_apdu)
{
int rc = 0;
if (new_apdu) {
if (prev_ac)
memcpy(prev_ac, ac, sizeof(*ac));
/* initialize the apdu context structure */
memset(ac, 0, sizeof(*ac));
/* copy APDU header over */
memcpy(&ac->hdr, apdu_buf, sizeof(ac->hdr));
ac->apdu_case = osim_determine_apdu_case(&osim_uicc_sim_cic_profile, apdu_buf);
/* Corner case when card returns SW 6CXX (resend previous command with Le = XX).
* Especial GP APDU defines Le to be 0x00, except if card returned SW 6cXX,
* Le must be set to XX. osim_determine_apdu_case() might return the wrong
* APDU case because osim_determine_apdu_case() uses the Le field to determine if the APDU
*/
if (prev_ac && prev_ac->sw[0] == 0x6c && /* check if Le was invalid and must be set to sw[1] */
(prev_ac->apdu_case >= 1 && prev_ac->apdu_case < 4) && /* handling only valid for apdu case 1..3 */
ac->hdr.cla == prev_ac->hdr.cla && /* check if CLA, INS, P1, P2 are equal */
ac->hdr.ins == prev_ac->hdr.ins &&
ac->hdr.p1 == prev_ac->hdr.p1 &&
ac->hdr.p2 == prev_ac->hdr.p2) {
ac->apdu_case = prev_ac->apdu_case;
}
switch (ac->apdu_case) {
case 1: /* P3 == 0, No Lc/Le */
ac->le.tot = ac->lc.tot = 0;