Hi Gabriel,

Thanks for the detailed description. This is exactly how we would like to see reports. You invested quite some time in understanding how and what to compile and flash. Sadly the cardem firmware (used by the remsim host software) is not yet ready for the SIMtrace hardware. But the good news is that this is currently what we are working on. The cardem is mainly intended for the sysmoqmod hardware (and was initially developed for it). Since yesterday it seems to run smoothly. We will have to do some more test to be sure of that. Then it will be ported to the SIMtrace hardware.

As the firmware/functionalities are completed, they will be documented in the wiki: https://osmocom.org/projects/simtrace2/wiki If you want to follow the cardem/remsim functioannlity on SIMtrace in particular, you can watch this ticket: https://osmocom.org/issues/1704

On Thu, Aug 02, 2018 at 03:11:47PM +0200, Gabriel K. Gegenhuber wrote:

Hi all,

I've got my hands on a simtrace2 device - first of all thanks for your great work and thanks for making this project open source!

So far I've tried out the sniffing functionality which is working flawlessly - however I struggle to get the remote-sim functionality working.

I've built (make BOARD=simtrace APP=cardem) the cardemulation-firmware of the current master-branch (0.4.131-8f70) and flashed the resulting simtrace-cardem-dfu.bin using dfu-util.

Furthermore I compiled the host binaries, triggered a reset on my simtrace2 device to make sure it's in runtime mode and then executed the remote-sim program (sudo ./simtrace2-remsim -V 1d50 -P 60e3 -C 1 -I 0 -A `sudo ./simtrace2-list | cut -d = -f 2 | cut -d , -f 1 | tail -1`). The simtrace2 device, as well as an USB-CCID compliant omnikey cardreader are attached to my linux computer as described in the QMOD manual. During runtime mode the red LED on the simtrace2 is blinking, while the green LED is off.

I noticed that when the simtrace2-remsim program tries to send an ATR to the simtrace2 device via usb (cardem_request_set_atr), the libusb_bulk_transfer function is blocking, before returning LIBUSB_ERROR_TIMEOUT. The serial debugging-output I got on the simtrace2 doesn't show any futher information (last state is "-I- USB is now configured").

When I reset the usb-modem that is connected to the simtrace2 device I get the following messages on the debug-serial: -I- Changed to ISO 7816-3 state 1 reset de-asserted -I- WT updated to 9600 -I- Changed to ISO 7816-3 state 0 reset asserted -I- Changed to ISO 7816-3 state 1 reset de-asserted [...]

while the simtrace2-remsim program is also receiving some garbage: URB: -> 03 00 00 00 00 00 0c 00 04 00 00 00 unknown simtrace msg type 0x00 URB: -> 03 00 00 00 00 00 0c 00 08 00 00 00 unknown simtrace msg type 0x00 URB: -> 03 00 00 00 00 00 0c 00 04 00 00 00 unknown simtrace msg type 0x00 [...]

I've also tried several older versions/commits - however I didn't get any of them working properly. When using version 0.4.13-ba2a (from this commit: https://git.osmocom.org/simtrace2/commit/?id=ba2ad563cc0e389213a3f6f6ebe79dc...) I was able to send the ATR to the simtrace and directly entered the main loop on the host program. The serial debugging-output (after a manual modem-reset) also looked somehow more promising, but didn't work either: -I- 0: VCC activated -I- 0: CLK activated -I- 0: RST released -I- 0: computed Fi(1) Di(1) ratio: 372 -I- 0: send_tpdu_header: 00 a4 00 04 02 -I- 0: VCC deactivated -I- 0: CLK deactivated -I- 0: VCC activated -I- 0: CLK activated -I- 0: VCC deactivated -I- 0: CLK deactivated [...]

I've also tried a few different modems/dongles (Huawei, ZTE) which also didn't really change anything.

Am I missing something? Is the remote-sim functionality supposed to work on the current master branch? If not, could anyone hint me to a version/commit that should work? Would love to get some feedback - thanks in advance and keep up the good work!

Greetings from Vienna, Gabriel