on the QMOD board the VCC signal from the modem is measured using
an ADC (SIMtrace board just use card detect).
the threshold to consider VCC as activated was set to 2.8V, which
gives a bit of margin for the expected 3.0V.
still, we had one board where the voltage was 2.8V.
to be resilient against lower than expected voltages from
modems (or boards), we lowered the threshold to 2.5V.
this is still save for the SAM3S to correctly identify high/low
levels.
Change-Id: Iac2778903690045e4e63fef29f812205d00c28ed
when the reader sends APDU headers (e.g. after multiple reset),
messages are queued for USB transmission.
but if no host software is connected to SIMtrace in card emulation
mode, the USB message queue is not emptied, leading to the memory
getting full and preventing allocation for newer messages (e.g.
more recent APDU).
in this case the oldest queued message is now dropped to free some
memory.
Change-Id: Ie9ebdd2ff966f67c9afd1ed760f106558f0091ad
in case flashing the main application firmware using DFU failed,
the main application might be broken and not allow to switch again
to DFU mode to re-flash it correctly.
the other board have a way to force entering (e.g. staying in) the
bootloader using an external signal (e.g. a switch on the SIMtrace
board).
the OWHW DFU firmware did not have this functionality implemented.
the design (e.g. schematic) already has the SIMTRACE_BOOTLOADER
signal (on PA31) for this purpose.
now the DFU bootloader will start the DFU mode when the
SIMTRACE_BOOTLOADER is high.
this change has been tested on OWHWv2.
Change-Id: Iefff51a811ad0f3bf3a46b8e256b905d11344bea
as for the main application firmware, the DFU bootloader firmware
now also has the unique chip ID as iSerial in the USB description,
and an additional empty USB configuration indicates the firmware
version (e.g. DFU bootloader version).
these are only visible when the device is in DFU mode.
Change-Id: I11a2cd8079fda374d816da180f39f1c33d10af60
ISO-7816 specifies a card activation sequence: VCC on, CLK active, then RST
release.
we now check for the end state at every state of the activation in case the
reader does not strictly follows the sequence.
change has been tested on OWHW slot 1.
Change-Id: Ie55505ab3a70cbd64281af40af53d5e120313228
previously the card RST, VCC, and CLK signal states have been initialized with
default values corresponding to an inactive reader.
this worked fine for actual inactive readers since the default values match
and would be updated when the signal changes (edge detection).
but if the reader is in another state, card activation detection could fail.
this is fixed since the actual signal values are now used during initialisation.
at the same time I changed the variable type from uint8_t to boolean since they
have only two possible states, and understanding the actual state when coding
is simpler (no need to check which integer corresponds to which state).
this change has been successfully tested on the 2 slots of OWHW board.
Change-Id: Ie9245d75d48ae93d16f97897d4fa5ad6cd402e73
the OctSIM tester has only one amber LED.
this is now mapped to the normally green LED, used for activity.
because the LED is driven by an NPN transistor (as open collector)
instead of being directly connected to the pin (as open collector)
like on the other boards, the logic is inverted.
since normally the LED is on on idle and blinks during activity,
it will now be off on idle an only blink on activity (unless the
code is extended to cope with the possible inverted logic).
because there is no second LED but the current code requires one,
I mapped is to an unused pin.
the octosimtest target still does not compile completely, but at
least the LED issue is fixed.
Change-Id: I1296833bef2804c611640fcf4756e47905660e7b
the LEDs (2 of them) were connected to the same pins on all
boards, up to the octsim-tester.
to be able to have board specific LEDs the definitions have moved
from common to the each board.
at the same time I added a bit of documentation what the LEDs are
used for.
Change-Id: I3226a9187a8d0b657ccf5dcd8f3586b2578f96d2
SIM_PWEN and VCC_FWD are signals specific to the simtrace boards.
the corresponding pins PA5 and PA26 are used for other signal
on the octsim-tester.
Change-Id: I51f37dd112cf681f4b1dbb3d2320ff9a697eaa08
previously the version string was in the iConfiguration field of a
dedicated USB configuration.
this configuration had no interface, but the USB specification
requires at least one interface.
an interface has been added to this configuration.
the version string is now in the iInterface field, and the
iConfiguration field contains "firmware version".
the USB specification does not require an end-point, and none are
present.
Change-Id: I99361e313979711f4f45ad424a52faa3ddd7c558
disabling the ERASE pin prevents accidental erase for the flash
memory while the board is powered on (e.g. in case the user
overcomes the weak 100 kOhm pull-down for more than 220 ms by
touching or shorting the pin).
the flash is still erasable using the ERASE pin during power up.
it is only disabled after boot completed.
Change-Id: Ic3332eb1d4247a07988b2fd841f40e79862d06a7
the device ID (unique to the micro-controller) is now displayed in
the USB iSerial descriptor.
the git version is now also displayed in iConfiguration in an
additional (empty) configuration descriptor.
this allows the user to quickly get the device hardware serial and
firmware version just by using lsusb (no need for a custom USB
software).
Change-Id: If9fadecc097ca3e006990160936bf11b22eae4e0
the jenkins script will now upload the versioned output to the
all directory, and a copy named "latest" in the latest directory.
Change-Id: I70114ef8414779e369da5cbf945854c9ace3464e
adds command 'a' to allow setting/asserting the peer SAM3S ERASE
line on the next command.
this prevents against accidental erase since only the command 'y'
was required, without confirmation.
this could happen not only through accidental user input, but
noise on the serial line (noise would still cause other issues,
but at least now it will not "brick" the device).
now the sequence 'ay' is required, as any other command following
'a' would clear the permission again.
note: since ERASE is only setting a GPIO within this command
parsing function, not accidental function pointer problem calling
'board_exec_dbg_cmd' should cause accidental ERASE since it would
need to be called two times with the exact sequence
Change-Id: I06bfeaef09a397bd554bec84321e0dd64ccc3aac
this just adds the name of the TPDU state on top of the state number.
the ISO state is cleaned up accordingly
Change-Id: Id5104a2c3579dedb092c179748e9ed525673841c
the TDPU response data size can be up to 256.
this length cannot be stored in a uint8_t, which would cause the
length to become 0, no data being send, and the reader reset the
card because of misbehaviour of the card (i.e. no/malformed
response leading to the timeout of the waiting time).
Change-Id: Iae7671085aaa3115a02d82530dd7a0e7e2d4155e
remsim also needs libpcsclite
`pkg-config --libs libosmocore` and -losmocore are duplicates
`pkg-config --libs libosmosim` is equivalent to -losmosim
pthread it needed (by most applications) for static compilation
LDFLAGS+= allows static compilation when running
LDFLAGS="-static" make
Change-Id: Ic7bd6f2be074d6f652d4f84f4996c8588ea5f851
the EEPROM byte output was causing data loss on the serial output,
resulting is automatic tests failing.
instead an end text will be output to detect the end of the procedure.
Change-Id: Ib8d3cbd01d0e34432d424355f4fafb24bc5273a1
the error code returned by vsnprintf was ignored,
resulting in printing the string from a previous print.
Change-Id: I8506b05d56da55d1357a1234917adf341b46e1db
Wformat requires uint32_t to be used in format string with the 'l'
qualifier (l = long = at least 32 bits).
this qualifier was not handled before.
since on ARM 32-bit int == long we can simply ignore it (stdio
already does not support 64-bit data).
Change-Id: Ib506a66f68712c6b3eeb5129a39abf47ec86a2a7
the higher baud rate allows for more debugging (without dropping
data) and is well supported by USB for UART adapters (this
standard baud rate is 8 x 115200).
the closest matching integer value is calculated for UART CR.
no floating point calculation can be used since this would
increase the size of the resulting binary by ~ 2kB (for the
softfp). this is not possible for the DFU since it already is
close to the maximum size of 16 kB.
Change-Id: I82b74f697342d580ccb79ada4715f35f4e8cca86
UART baud rate is main clock (MCK) divided by CR*16.
The MCK values are chosen >= 48 MHz and <= 64 MHz to have a near
integer value CR for a baud rate of 921600 bps.
The end MCK frequency between simtrace and qmod differ slightly
but are close to 58 MHz.
Change-Id: Iaa4a97fc68494c93b9d128503515d88049de506c
the upload failed because after the firmware were built (make),
they where removed (make clean).
now they are removed only after the upload.
Change-Id: Ie4421a6fa9207eb541107de9c14f265626f6be96
repeating the EEPROM erase (byte write) in case of byte write failure
could lead in an infinite loop.
log the error an return error code instead.
Change-Id: Id6f3654d877ca772ba04237da91a6e86e3f441ec
the script argument was not saved in the publish variable used later
to decide if publishing/uploading is needed.
Change-Id: Ic768a8e96e5e4d72acf3979da1412d683f79ec55
USB reset can be signaled by pulling low USB D+ for at least 10 ms,
according to the USB specification. This force a re-enumeration.
This time is increased to 20 ms to work with more USB HUBs.
Some SAM3S based board have external D+ pull-up mechanism (such as
SIMtrace) which needs to be used to pull D+ low.
This is a legacy mechanism from SAM7S history.
This mechanism is not required anymore on the SAM3S, and the qmod
does not use it. When the USB HAL is suspended, the transceiver is
disabled, causing D+ and D- to be pulled low. Then the HAL is activated
again. This is particularly required when DFU is started (and
enumerated), and after flashing the SAM3S switched to the main
application (without reset), so it can properly re-enumerate.
This board difference is now defined on the board header.
Change-Id: I9b58d8101c2fcf5595026b675728826af26127a3
moving the define after the header fixes the following warning:
from ./atmel_softpack_libraries/libchip_sam3s/source/exceptions.c:46:
libcommon/include/stdio.h:63:12: warning: redundant redeclaration of 'printf_sync' [-Wredundant-decls]
signed int printf_sync(const char *pFormat, ...);
^~~~~~~~~~~
./atmel_softpack_libraries/libchip_sam3s/source/exceptions.c:45:16: note: previous declaration of 'printf_sync' was here
#define printf printf_sync
^~~~~~~~~~~
libcommon/include/stdio.h:51:12: note: in expansion of macro 'printf'
signed int printf(const char *pFormat, ...);
Change-Id: I21a8de325e8f8b91297dd157f2d6a0f64434bb28
firmware binaries should be uploaded to
https://ftp.osmocom.org/binaries/simtrace2/firmware/
this directory wiki be documented in the SIMtrace 2 wiki for users
to get the latest firmware images without having to cross-compile
themselves.
Change-Id: I589531f59e54a0997b012bdd91e3bef9f847f517
After a couple of seconds of USB data exchange between remsim and
cardem, the USB transfer hangs.
On host side (remsim) I can see the USB BULK IN request.
On device side (cardem) I see that data has been submitted and
"sent" over USB, but on wireshark with USBmon I don't see the
corresponding USB BULK IN response.
When exiting remsim or just after powering of qmod (causing an
error in remsim) the USB BULK IN is show in wireshark. Thus it
must have been in a buffer, but not read by libusb_bulk_transfer.
By shortening the timeout a new libusb_bulk_transfer is made more
frequently, and the data gets read successfully.
T;his change also fixes the URB data display.
Change-Id: I1d124a41cc90893506933f6d76dc7331e52a74f9
osmo_hexdump is particularly useful.
previously it was only defined, but not implemented.
this cause random behaviour upon call, often resulting in
memory corruption.
Change-Id: Ifd9120fa951f41693903fb657d10826959f1599f
The default ISR (particularly the HardFault handler) print information,
but this information was not displayed on the console because the UART
IRQ is lower than some default blocking IRQ.
Allowing to set synchronous transfer corrects this.
The underlying Atmel exception library had to be modified to use the
synchronous output.
Making UART_PutChar always synchronous when called from an ISR is not
desired because we use TRACE_ macros is some ISR. The synchronous
output must be set explicitly.
Change-Id: I1b4ace5185cf2dc32684934ed12bf6a8682e9bad
The slot number is in the header, and correctly set in st_push_hdr.
Setting the slot in st_slot_tx_msg will overwrite the payload data.
This caused bytes three of the ATR to be changed from 0x96 to 0x00,
corrupting the ATR. This corruption is caught by the ATR checksum,
and the modem would reset the card (2 additional times) to try to
get correct ATR.
Change-Id: If971699993617fc50557d20582c344ea06645a3f
this changes how ATR is handled.
the ATR is also printed when set (as important debug information).
the test is also updated to correspond to the new mechanism (
simulating the timeout before sending the ATR)
Change-Id: I69df797e2feadffa9f5f977cb71b69386cee7cd0
a lot of the procedures are done in ISRs, but the watchdog is only
reset in the main loop.
this causes frequent reset, particularly at the beginning were
states have to the initialized.
Change-Id: Iad364444fca9d18f9a8cf47d5e0840ccd7bac2ef
In case of error it also ensures the returned value is NULL.
Else a segfault would occur because the caller (e.g. remsim)
continued on with a free handler.
Change-Id: Ie7f20e3eff03acf77eb08283747ca8e032b9b4c8
The previous mechanism of retrying a failed write could become a
infinite blocking loop (until watchdog tiemout).
Also the array size is used to know how much data to write and verify
instead of a constant.
Change-Id: I8d2d090c5f4d1195f4c7eb29b3958a7bb05f56ec
The Atmel AT24C02 defines a maximum tWR waiting time after a byte
write of 5 ms before a next write.
Enforcing this wait time also fixed the failed verification in qmod,
where it was reading 0xffff instead of the written value.
Change-Id: I42c90b8d0329e425f275067e87d584212a43a90b
the msg->l2h pointer was not set but used later on, e.g. in
dispatch_usb_command_cardem, case SIMTRACE_MSGT_DT_CEMU_SET_ATR):
> case SIMTRACE_MSGT_DT_CEMU_SET_ATR:
> > atr = (struct cardemu_usb_msg_set_atr *) msg->l2h;
> > card_emu_set_atr(ci->ch, atr->atr, atr->atr_len);
l2h is by default 0, thus not pointing to the actual message l2h.
I wonder how cardem worked worked before with this issue though.
Change-Id: Ifbb53dbf478d8dade82251f769e78e1306e77434
when building the cardem application GCC would output the following warning:
libcommon/source/card_emu.c: In function 'card_emu_process_rx_byte':
libcommon/source/card_emu.c:764:2: warning: enumeration value 'ISO_S_IN_ATR' not handled in switch [-Wswitch]
switch (ch->state) {
^~~~~~
in card emulation the reader should not send data while the card is
sending its ATR.
this is true for other states already handled (RESET, ...). in
these cases an error message is output.
this behaviour is now the default case as data from the reader is
only expected in 3 cases: ISO_S_WAIT_TPDU, ISO_S_IN_TPDU, and
ISO_S_IN_PTS.
Change-Id: Ifbc8dbe1c9f176343304f211c7e6068fb977961e
when building the trace app for the simtrace board gcc was outputing
the following error:
libboard/common/source/boardver_adc.c:20:17: warning: 'adc2uv' defined but not used [-Wunused-function]
static uint32_t adc2uv(uint16_t adc)
adc2uv is used by qmod, and defined in two places:
in boardver_adc.c and mode_cardemu.c.
this change will have adc2uv only defined in boardver_adc.c and make
available in the header to be used by mode_cardemu.c.
Change-Id: I8a772638fa8dd02d8bc8b7631de5af5a22647c55
When the host does not retrieved the USB messages, they keep getting
queue in the firmware, filling the RAM, and preventing further memory
to be allocated.
Change-Id: I0e447acdf757dcb5dc5c4d8b84a4235866914cad
linker warning:
obj/simtrace/dfu_sniffer.o: In function `usb_send_data':
/media/data/work/simtrace2/simtrace2/firmware/libcommon/source/sniffer.c:338: warning: undefined reference to `putchar'
Change-Id: I934f3fcb474d4046e921511a024c3a0b8533c782
The red and green LEDs are now used as follows:
- red on = power (firmware is running)
- red blink = error detected (e.g. during ISO-7816 parsing)
- green on = running (sniffer mode is running)
- green blink = activity (e.g. USB message sent)
Change-Id: Ib1b6ff87fb92d6ed3ecae4bc89386206aaab508e
when the host software does not retrieve the USB messages the memory
is filled and no new USB messages can be allocated, preventing the
following code to print the message
Change-Id: Ie8946894a84cb853b45555f7abb1ca6f32111425
TRACE_INFO will also provide the DFU start reason, but TRACE_INFO
(TRACE_LEVEL >= 4) should only be used for debugging.
WARNING: With TRACE_LEVEL >= 4 the DFU binary is over the maximum of
16 kiB allocated for the DFU bootloader.
Thus make combined will not boot the main application because its
start if after the expecte 16 kiB address; and flashing using DFU
will overwrite the DFU bootloader itself.
Change-Id: I82323e0f76c03f67df7dc8f2b6783166cc25f3aa
The qmod does not have a separate force button as simtrace has.
Instead it check is TX and RX of UART are shorted using PIO.
If the pins are not set back to the UART peripheral, the TRACE/debug
console output will not work anymore.
Change-Id: Id434b49909d6395a2f93a00f39d2d770a5725466
The DFU uses the UART peripheral (with IRQ/ISR) for the debug output
console. Before starting the main application we should make sure
this configuration is reset to avoid interference (particularly the
IRQ/ISR).
This is not too important though since the main application
reconfigures the UART for console output.
Other peripheral could also be disabled (e.g. all other PIO used
by DFU), but most of them also get configured by the main application.
Change-Id: I8234d1b85938ad6393094c08183f613ad09ee01b
The stack size is fixed. The linker script puts the stack section
after the bss section. The initial stack pointer is not at the
end of the RAM (as often seen).
Thus the initial stack pointer address of the main application
is different than the one from DFU. When starting the main
application the stack pointer needs to be set to the new value.
If this is not done the main application stack may overwrite the
data in bss, even without exceeding the fixed stack size.
Change-Id: Ie354d603fe302d3d5bdfa9c31575411de722323b
Handling the USB message queue is done in an ISR and take quite some time.
This can cause a USART/SIM sniffing buffer overrun, resulting in data loss.
By setting the USB IRQ lower than the USART IRQ, the USB ISR can be
interrupted (for short) and no data gets lost.
Change-Id: I870a0aa8e251bbb53249c54bfcaa45de5b5a9486
don't wait for space to be available in the buffer since since would
prevent from processing non-console (e.g. debug) more important data
Change-Id: Ia625b09eb30bb7b43edd3989f697d8ef33200f28
Kévin Redon