The first FPGA gateware function to be implemented in the SIMtrace-ice project
is the passive sniffer: receiving level-shifted SIM RST, CLK and I/O signals
from the 74LVC4T3144 buffer and capturing all exchanges that happen on the SIM
interface between a DUS and a SIM.

The sniffer FPGA logic function will be implemented on the inexpensive off-the-
shelf Icestick board, featuring an iCE40HX1K FPGA and an FT2232H-based USB host
interface.  This FPGA logic function will operate principally as a byte
forwarder from the ISO 7816-3 sniffer block to the FT2232H UART: every time the
bus sniffer block captures a character (in ISO 7816-3 terminology) being passed
on the SIM electrical interface in either direction (the two directions of
transmission are indistinguishable to a tap sniffer that does not actively
participate in the protocol), the FPGA will forward this character to the
connected host computer (by way of FT2232H UART) for further processing in
software.  The UART data line going from the FPGA to the FT2232H will be the
sole functional output from this FPGA, beyond debug outputs being added during
logic development and troubleshooting.  The other UART data line going the
opposite direction (output from FT2232H) will remain unused, i.e., the host
software application will only read/receive from the ttyUSBx FPGA device and
won't send anything to it.  All modem control lines on this UART interface will
likewise remain unused.

Serial interface format
=======================

For every ISO 7816-3 character captured by the sniffer, two back-to-back UART
bytes will be transferred from the FPGA to the host computer; more generally,
the FPGA will only transmit pairs of back-to-back bytes on this UART and no
singletons or other arrangements - thus the host receiver can always recover
synchronization by dropping any partially received two-byte message (the first
byte of an expected pair) during prolonged pauses.  The FPGA will transmit the
two back-to-back UART bytes as a single shift-out of 20 bits, conveying two
bytes in 8N1 framing.

Why are we turning every captured ISO 7816-3 character into a pair of bytes on
our internal UART interface, why not simply forward it as a single byte?  The
reason is that we need to pass some additional bits beyond the 8 that comprise
the ISO 7816-3 character payload; the additional bits which we need to pass are
as follows:

- the received parity bit;
- a flag indicating whether or not an error signal (ISO 7816-3 section 7.3)
  was seen;
- additional flag bits communicating SIM RST assertion and negation events,
  as distinct from ISO 7816-3 characters;
- an additional flag indicating an action of the integrated PPS catcher state
  machine, to be described later in this document.

Assertion or negation of SIM RST is the only other possible event (besides ISO
7816-3 character capture, with or without attendant PPS catcher state machine
action) that can cause the FPGA to send a byte-pair UART message to the host
computer.  One bit in the 16-bit message will distinguish between characters
and RST events, another bit will indicate the state of RST at the time of the
event (new RST for transitions, 1 for characters), and all other bits are
meaningful only for characters.

Clocking design
===============

The FPGA on the Icestick board receives a 12 MHz clock input; the on-chip PLL
will be used to multiply this clock by 4, producing a 48 MHz system clock.
This 48 MHz SYSCLK will be used for the entirety of the present logic design -
a single-clock fully synchronous design is the best current practice.

The 3 inputs to the FPGA coming from the SIM electrical sniffer (buffered and
level-shifted SIM RST, CLK and I/O lines) will pass through two cascaded DFFs,
bringing them into our internal clock domain.  The delay added by these cascaded
DFFs is not a concern: we are a passive sniffer without any output back to the
SIM interface, and all 3 signal inputs will be subject to the same delay.

The baud rate on the UART interface between the FPGA and the FT2232H converter
will be 3000000 bps.  The UART output block in the FPGA will use a simple /16
divider from SYSCLK to time its output bits; future derivative designs that will
use the UART interface bidirectionally (such as the planned card emulator FPGA
design) will use SYSCLK directly as the 16x clock for UART reception.  This
high (and very non-RS232-standard) UART baud rate was chosen for the following
reasons:

* Our UART interface is totally private, going nowhere but the on-board FT2232H,
  thus it doesn't matter if the baud rate is standard-ish or totally
  non-standard.

* No cables of any kind are used, instead the UART interface is confined to
  short PCB traces running between the FPGA and the FTDI chip on the same board
  - hence high baud rates are not a problem.

* Our UART baud rate needs to be high enough to provide good margin, despite
  our 2x expansion, at the highest possible effective bps rate on the SIM
  interface, meaning the highest possible SIM CLK frequency and the most
  aggressive F/D ratio.  The combination of SIM CLK at 5 MHz, F=512 and D=64
  corresponds to 625000 bps effective on the SIM interface; running our UART at
  3 Mbps provides sufficient margin.

ISO 7816-3 sniffer block
========================

Our ISO 7816-3 receiver will trigger on the falling edge of the I/O line.  Once
it detects a high-to-low transition on the SYSCLK-synchronized SIM_IO input, it
will start counting SIM CLK cycles - we are arbitrarily choosing low-to-high
transition of SYSCLK-synchronized SIM_CLK input as the trigger point.  (This
choice is arbitrary because per the spec there is no defined phase relation
between SIM CLK and SIM I/O transitions.)  Our ISO 7816-3 receiver will need to
know how many SIM CLK cycles constitute one etu - or more precisely, our
sniffing receiver will operate in half-etu counts, as we need to measure 0.5 etu
to get from the initial falling edge on the I/O line to the mid-etu data
sampling point.  Following the session-opening low-to-high transition on the RST
line, our half-etu register will be set to 8'd186, corresponding to F/D=372.
Our PPS catcher state machine will then overwrite this register with a smaller
value based on the captured PPS exchange.

Direct and inverse coding conventions
=====================================

Only the card and not the DUS (interface device in ISO 7816-3 terminology)
determines which coding convention is used, direct or inverse.  So far we
(FreeCalypso) have not yet encountered a real-life SIM that uses the inverse
convention, only the direct convention kind.  In the sniffer function of
SIMtrace-ice, we are going to keep our FPGA gateware simple in this regard and
punt all inverse convention handling to the software application on the host
computer: the FPGA will pass the 9 received bits (8 data bits and 1 parity bit)
to the 16-bit UART message as-is, without inverting or reordering them.

Integrated PPS catcher
======================

The logic described so far will be sufficient to capture all exchanges on the
SIM interface between a DUS and a SIM *if* the etu-defining F/D ratio is never
switched from the basic default of 372.  However, given that most SIM cards of
interest to us (our own FCSIM1, as well as SIMs issued by various commercial
operators) support Fi=512 Di=8 or higher, and given that even very classic
implementations of GSM ME (including our dear Calypso) support this F=512 D=8
speed enhancement mode endorsed by GSM 11.11 spec, many real-life DUS-to-SIM
sessions (which we would like to sniff and trace) will include a PPS exchange
switching to a smaller number of SIM CLK cycles per etu.

The main difficulty with capturing SIM interface sessions that use speed
enhancement is as follows: in order for the session capture to be complete,
without any lost bits, the sniffing receiver's knowledge of how many SIM CLK
cycles constitute a half-etu needs to change to the new value at exactly the
correct moment in time, which is the moment immediately after the last byte
(PCK) of the SIM's PPS response passes across the wire.  If we were to rely on
host software to decode all byte exchanges up to this point (ATR from the SIM,
PPS request from the DUS, then PPS response) and command the FPGA (UART in the
other direction, or a modem control line) to switch the half-etu counter, we
stand very little chance of getting this command to the FPGA in time, before
the DUS starts transmitting its next command to the SIM using the new etu
definition.

The Mother's proposed solution is to embed a PPS catcher state machine in the
sniffer FPGA.  This state machine will be set to its initial state upon the
session-opening low-to-high transition on the RST line, and it will look at
every ISO 7816-3 character received by the sniffer.  The machine will need to
step through the following states between this starting point and the final
action of changing the half-etu count register:

* As the ATR bytes are transferred, the state machine will need to understand
  enough of ATR format to know which byte constitutes the end of ATR.  A fatal
  error in ATR real-time parsing (if the first byte is anything other than
  8'h3B) will put the machine into its inactive state for the remainder of the
  session until next reset.

* If the byte following ATR is 8'hFF, the machine will proceed into PPS request
  real-time parsing state.  If this byte equals any other value, go to the
  inactive state for the remainder of the session.

* In the PPS request real-time parsing series of states, the state machine will
  need to catch the PPS0 byte and based on this byte, figure out how many bytes
  it needs to skip.

* Following the PPS request, the machine will need to real-time-parse the PPS
  response.  Any invalid conditions will take it to the inactive state; however,
  if the PPS exchange is valid, the machine will need to capture the PPS1 byte
  and then step through states until the final PCK byte of the PPS response.

* Upon receiving that last PCK byte after all prior bytes following the expected
  protocol, effect the half-etu count change.  Either way, the inactive state
  is entered at this point, and the state machine will take no further action
  for the remainder of the session.

This state machine is of course going to be very complicated, as evident from
the functional requirements listed above.  The first version of SIMtrace-ice
sniffer FPGA will omit this block altogether, and we will get the rest of the
system working for DUS-to-SIM sessions that stick with F/D=372 - a good test
configuration would be to use a FreeCalypso GSM ME as DUS, with SIM speed
enhancement disabled via AT@SPENH=0.  Then we shall embark on implementing this
proposed PPS catcher state machine.

The addition of this PPS catcher state machine may increase the complexity of
our logic beyond the capacity of the iCE40HX1K FPGA on the Icestick board.  If
we run into this problem, we'll have to look for a board with a bigger FPGA -
but we'll try to fit into the Icestick first.