/*

    commands.c: Commands sent to the card

    Copyright (C) 2003-2010   Ludovic Rousseau

    Copyright (C) 2005 Martin Paljak

    This library is free software; you can redistribute it and/or

    modify it under the terms of the GNU Lesser General Public

    License as published by the Free Software Foundation; either

    version 2.1 of the License, or (at your option) any later version.

    This library is distributed in the hope that it will be useful,

    but WITHOUT ANY WARRANTY; without even the implied warranty of

    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

    Lesser General Public License for more details.

	You should have received a copy of the GNU Lesser General Public License

	along with this library; if not, write to the Free Software Foundation,

	Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.

*/

#include <config.h>

#ifdef HAVE_STRING_H

#include <string.h>

#endif

#ifdef HAVE_STDLIB_H

#include <stdlib.h>

#endif

#ifdef HAVE_ERRNO_H

#include <errno.h>

#endif

#ifdef HAVE_UNISTD_H

#include <unistd.h>

#endif

#include <pcsclite.h>

#include <ifdhandler.h>

#include <reader.h>

#include "misc.h"

#include "commands.h"

#include "openct/proto-t1.h"

#include "ccid.h"

#include "defs.h"

#include "ccid_ifdhandler.h"

#include "debug.h"

#include "utils.h"

/* All the pinpad readers I used are more or less bogus

 * I use code to change the user command and make the firmware happy */

#define BOGUS_PINPAD_FIRMWARE

/* The firmware of SCM readers reports dwMaxCCIDMessageLength = 263

 * instead of 270 so this prevents from sending a full length APDU

 * of 260 bytes since the driver check this value */

#define BOGUS_SCM_FIRMWARE_FOR_dwMaxCCIDMessageLength

#ifndef offsetof

#define offsetof(TYPE, MEMBER) ((size_t) &((TYPE *)0)->MEMBER)

#endif

#ifndef BSWAP_16

#define BSWAP_8(x)  ((x) & 0xff)

#define BSWAP_16(x) ((BSWAP_8(x) << 8) | BSWAP_8((x) >> 8))

#define BSWAP_32(x) ((BSWAP_16(x) << 16) | BSWAP_16((x) >> 16))

#endif

#define CHECK_STATUS(res) \

	if (STATUS_NO_SUCH_DEVICE == res) \

		return IFD_NO_SUCH_DEVICE; \

	if (STATUS_SUCCESS != res) \

		return IFD_COMMUNICATION_ERROR;

/* internal functions */

static RESPONSECODE CmdXfrBlockAPDU_extended(unsigned int reader_index,

	unsigned int tx_length, unsigned char tx_buffer[], unsigned int *rx_length,

	unsigned char rx_buffer[]);

static RESPONSECODE CmdXfrBlockTPDU_T0(unsigned int reader_index,

	unsigned int tx_length, unsigned char tx_buffer[], unsigned int *rx_length,

	unsigned char rx_buffer[]);

static RESPONSECODE CmdXfrBlockCHAR_T0(unsigned int reader_index, unsigned int

	tx_length, unsigned char tx_buffer[], unsigned int *rx_length, unsigned

	char rx_buffer[]);

static RESPONSECODE CmdXfrBlockTPDU_T1(unsigned int reader_index,

	unsigned int tx_length, unsigned char tx_buffer[], unsigned int *rx_length,

	unsigned char rx_buffer[]);

static void i2dw(int value, unsigned char *buffer);

static unsigned int bei2i(unsigned char *buffer);

/*****************************************************************************

 *

 *					CmdPowerOn

 *

 ****************************************************************************/

RESPONSECODE CmdPowerOn(unsigned int reader_index, unsigned int * nlength,

	unsigned char buffer[], int voltage)

{

	unsigned char cmd[10];

	status_t res;

	int length, count = 1;

	unsigned int atr_len;

	int init_voltage;

	RESPONSECODE return_value = IFD_SUCCESS;

	_ccid_descriptor *ccid_descriptor = get_ccid_descriptor(reader_index);

#ifndef TWIN_SERIAL

	if (PROTOCOL_ICCD_A == ccid_descriptor->bInterfaceProtocol)

	{

		int r;

		unsigned char pcbuffer[SIZE_GET_SLOT_STATUS];

		/* first power off to reset the ICC state machine */

		r = CmdPowerOff(reader_index);

		if (r != IFD_SUCCESS)

			return r;

		/* wait for ready */

		r = CmdGetSlotStatus(reader_index, pcbuffer);

		if (r != IFD_SUCCESS)

			return r;

		/* Power On */

		r = ControlUSB(reader_index, 0xA1, 0x62, 0, buffer, *nlength);

		/* we got an error? */

		if (r < 0)

		{

			DEBUG_INFO2("ICC Power On failed: %s", strerror(errno));

			return IFD_COMMUNICATION_ERROR;

		}

		*nlength = r;

		return IFD_SUCCESS;

	}

	if (PROTOCOL_ICCD_B == ccid_descriptor->bInterfaceProtocol)

	{

		int r;

		unsigned char tmp[MAX_ATR_SIZE+1];

		/* first power off to reset the ICC state machine */

		r = CmdPowerOff(reader_index);

		if (r != IFD_SUCCESS)

			return r;

		/* Power On */

		r = ControlUSB(reader_index, 0x21, 0x62, 1, NULL, 0);

		/* we got an error? */

		if (r < 0)

		{

			DEBUG_INFO2("ICC Power On failed: %s", strerror(errno));

			return IFD_COMMUNICATION_ERROR;

		}

		/* Data Block */

		r = ControlUSB(reader_index, 0xA1, 0x6F, 0, tmp, sizeof(tmp));

		/* we got an error? */

		if (r < 0)

		{

			DEBUG_INFO2("ICC Data Block failed: %s", strerror(errno));

			return IFD_COMMUNICATION_ERROR;

		}

		if (tmp[0] != 0x00)

		{

			DEBUG_CRITICAL2("bResponseType: 0x%02X", tmp[0]);

			/* Status Information? */

			if (0x40 == tmp[0])

				ccid_error(PCSC_LOG_ERROR, tmp[2], __FILE__, __LINE__, __FUNCTION__);

			return IFD_COMMUNICATION_ERROR;

		}

		DEBUG_INFO_XXD("Data Block: ", tmp, r);

		if ((int)*nlength > r-1)

			*nlength = r-1;

		memcpy(buffer, tmp+1, *nlength);

		return IFD_SUCCESS;

	}

#endif

	/* store length of buffer[] */

	length = *nlength;

	if ((ccid_descriptor->dwFeatures & CCID_CLASS_AUTO_VOLTAGE)

		|| (ccid_descriptor->dwFeatures & CCID_CLASS_AUTO_ACTIVATION))

		voltage = 0;	/* automatic voltage selection */

	else

	{

		int bVoltageSupport = ccid_descriptor->bVoltageSupport;

check_again:

		if ((1 == voltage) && !(bVoltageSupport & 1))

		{

			DEBUG_INFO1("5V requested but not support by reader");

			voltage = 2;	/* 3V */

		}

		if ((2 == voltage) && !(bVoltageSupport & 2))

		{

			DEBUG_INFO1("3V requested but not support by reader");

			voltage = 3;	/* 1.8V */

		}

		if ((3 == voltage) && !(bVoltageSupport & 4))

		{

			DEBUG_INFO1("1.8V requested but not support by reader");

			voltage = 1;	/* 5V */

			goto check_again;

		}

	}

	init_voltage = voltage;

again:

	cmd[0] = 0x62; /* IccPowerOn */

	cmd[1] = cmd[2] = cmd[3] = cmd[4] = 0;	/* dwLength */

	cmd[5] = ccid_descriptor->bCurrentSlotIndex;	/* slot number */

	cmd[6] = (*ccid_descriptor->pbSeq)++;

	cmd[7] = voltage;

	cmd[8] = cmd[9] = 0; /* RFU */

	res = WritePort(reader_index, sizeof(cmd), cmd);

	CHECK_STATUS(res)

	/* reset available buffer size */

	/* needed if we go back after a switch to ISO mode */

	*nlength = length;

	res = ReadPort(reader_index, nlength, buffer);

	CHECK_STATUS(res)

	if (*nlength < STATUS_OFFSET+1)

	{

		DEBUG_CRITICAL2("Not enough data received: %d bytes", *nlength);

		return IFD_COMMUNICATION_ERROR;

	}

	if (buffer[STATUS_OFFSET] & CCID_COMMAND_FAILED)

	{

		ccid_error(PCSC_LOG_ERROR, buffer[ERROR_OFFSET], __FILE__, __LINE__, __FUNCTION__);    /* bError */

		if (0xBB == buffer[ERROR_OFFSET] &&	/* Protocol error in EMV mode */

			((GEMPC433 == ccid_descriptor->readerID)

			|| (CHERRYXX33 == ccid_descriptor->readerID)))

		{

			unsigned char cmd_tmp[] = {0x1F, 0x01};

			unsigned char res_tmp[1];

			unsigned int res_length = sizeof(res_tmp);

			if ((return_value = CmdEscape(reader_index, cmd_tmp,

				sizeof(cmd_tmp), res_tmp, &res_length, 0)) != IFD_SUCCESS)

				return return_value;

			/* avoid looping if we can't switch mode */

			if (count--)

				goto again;

			else

				DEBUG_CRITICAL("Can't set reader in ISO mode");

		}

		/* continue with other voltage values */

		if (voltage)

		{

#ifndef NO_LOG

			const char *voltage_code[] = { "auto", "5V", "3V", "1.8V" };

#endif

			DEBUG_INFO3("Power up with %s failed. Try with %s.",

				voltage_code[voltage], voltage_code[voltage-1]);

			voltage--;

			/* loop from 5V to 1.8V */

			if (0 == voltage)

				voltage = 3;

			/* continue until we tried every values */

			if (voltage != init_voltage)

				goto again;

		}

		return IFD_COMMUNICATION_ERROR;

	}

	/* extract the ATR */

	atr_len = dw2i(buffer, 1);	/* ATR length */

	if (atr_len > *nlength)

		atr_len = *nlength;

	else

		*nlength = atr_len;

	memmove(buffer, buffer+10, atr_len);

	return return_value;

} /* CmdPowerOn */

/*****************************************************************************

 *

 *					SecurePINVerify

 *

 ****************************************************************************/

RESPONSECODE SecurePINVerify(unsigned int reader_index,

	unsigned char TxBuffer[], unsigned int TxLength,

	unsigned char RxBuffer[], unsigned int *RxLength)

{

	unsigned char cmd[11+14+TxLength];

	unsigned int a, b;

	PIN_VERIFY_STRUCTURE *pvs;

	_ccid_descriptor *ccid_descriptor = get_ccid_descriptor(reader_index);

	int old_read_timeout;

	RESPONSECODE ret;

	status_t res;

	pvs = (PIN_VERIFY_STRUCTURE *)TxBuffer;

	cmd[0] = 0x69;	/* Secure */

	cmd[5] = ccid_descriptor->bCurrentSlotIndex;	/* slot number */

	cmd[6] = (*ccid_descriptor->pbSeq)++;

	cmd[7] = 0;		/* bBWI */

	cmd[8] = 0;		/* wLevelParameter */

	cmd[9] = 0;

	cmd[10] = 0;	/* bPINOperation: PIN Verification */

	if (TxLength < 19+4 /* 4 = APDU size */)	/* command too short? */

	{

		DEBUG_INFO3("Command too short: %d < %d", TxLength, 19+4);

		return IFD_NOT_SUPPORTED;

	}

	/* On little endian machines we are all set. */

	/* If on big endian machine and caller is using host byte order */

	if ((pvs->ulDataLength + 19  == TxLength) &&

		(bei2i((unsigned char*)(&pvs->ulDataLength)) == pvs->ulDataLength))

	{

		DEBUG_INFO1("Reversing order from big to little endian");

		/* If ulDataLength is big endian, assume others are too */

		/* reverse the byte order for 3 fields */

		pvs->wPINMaxExtraDigit = BSWAP_16(pvs->wPINMaxExtraDigit);

		pvs->wLangId = BSWAP_16(pvs->wLangId);

		pvs->ulDataLength = BSWAP_32(pvs->ulDataLength);

	}

	/* At this point we now have the above 3 variables in little endian */

	if (dw2i(TxBuffer, 15) + 19 != TxLength) /* ulDataLength field coherency */

	{

		DEBUG_INFO3("Wrong lengths: %d %d", dw2i(TxBuffer, 15) + 19, TxLength);

		return IFD_NOT_SUPPORTED;

	}

	/* make sure bEntryValidationCondition is valid

	 * The Cherry XX44 reader crashes with a wrong value */

	if ((0x00 == TxBuffer[7]) || (TxBuffer[7] > 0x07))

	{

		DEBUG_INFO2("Correct bEntryValidationCondition (was 0x%02X)",

			TxBuffer[7]);

		TxBuffer[7] = 0x02;

	}

#ifdef BOGUS_PINPAD_FIRMWARE

	/* bug circumvention for the GemPC Pinpad */

	if ((GEMPCPINPAD == ccid_descriptor->readerID)

		|| (VEGAALPHA == ccid_descriptor->readerID))

	{

		/* the firmware reject the cases: 00h No string and FFh default

		 * CCID message. The only value supported is 01h (display 1 message) */

		if (0x01 != TxBuffer[8])

		{

			DEBUG_INFO2("Correct bNumberMessage for GemPC Pinpad (was %d)",

				TxBuffer[8]);

			TxBuffer[8] = 0x01;

		}

		/* The reader does not support, and actively reject, "max size reached"

		 * and "timeout occured" validation conditions */

		if (0x02 != TxBuffer[7])

		{

			DEBUG_INFO2("Correct bEntryValidationCondition for GemPC Pinpad (was %d)",

				TxBuffer[7]);

			TxBuffer[7] = 0x02;	/* validation key pressed */

		}

	}

	if ((DELLSCRK == ccid_descriptor->readerID)

		|| (DELLSK == ccid_descriptor->readerID))

	{

		/* the firmware rejects the cases: 01h-FEh and FFh default

		 * CCID message. The only value supported is 00h (no message) */

		if (0x00 != TxBuffer[8])

		{

			DEBUG_INFO2("Correct bNumberMessage for Dell keyboard (was %d)",

				TxBuffer[8]);

			TxBuffer[8] = 0x00;

		}

		/* avoid the command rejection because the Enter key is still

		 * pressed. Wait a bit for the key to be released */

		(void)usleep(250*1000);

	}

	if (DELLSK == ccid_descriptor->readerID)

	{

		/* the 2 bytes of wPINMaxExtraDigit are reversed */

		int tmp;

		tmp = TxBuffer[6];

		TxBuffer[6] = TxBuffer[5];

		TxBuffer[5] = tmp;

		DEBUG_INFO1("Correcting wPINMaxExtraDigit for Dell keyboard");

	}

#endif

	/* T=1 Protocol Management for a TPDU reader */

	if ((SCARD_PROTOCOL_T1 == ccid_descriptor->cardProtocol)

		&& (CCID_CLASS_TPDU == (ccid_descriptor->dwFeatures & CCID_CLASS_EXCHANGE_MASK)))

	{

		ct_buf_t sbuf;

		unsigned char sdata[T1_BUFFER_SIZE];

		/* Initialize send buffer with the APDU */

		ct_buf_set(&sbuf,

			(void *)(TxBuffer + offsetof(PIN_VERIFY_STRUCTURE, abData)),

			TxLength - offsetof(PIN_VERIFY_STRUCTURE, abData));

		/* Create T=1 block */

		(void)t1_build(&((get_ccid_slot(reader_index))->t1),

			sdata, 0, T1_I_BLOCK, &sbuf, NULL);

		/* Increment the sequence numbers  */

		get_ccid_slot(reader_index)->t1.ns ^= 1;

		get_ccid_slot(reader_index)->t1.nr ^= 1;

		/* Copy the generated T=1 block prologue into the teoprologue

		 * of the CCID command */

		memcpy(TxBuffer + offsetof(PIN_VERIFY_STRUCTURE, bTeoPrologue),

			sdata, 3);

	}

	/* Build a CCID block from a PC/SC V2.02.05 Part 10 block */

	for (a = 11, b = 0; b < TxLength; b++)

	{

		if (1 == b) /* bTimeOut2 field */

			/* Ignore the second timeout as there's nothing we can do with

			 * it currently */

			continue;

		if ((b >= 15) && (b <= 18)) /* ulDataLength field (4 bytes) */

			/* the ulDataLength field is not present in the CCID frame

			 * so do not copy */

			continue;

		/* copy the CCID block 'verbatim' */

		cmd[a] = TxBuffer[b];

		a++;

	}

	/* SPR532 and Case 1 APDU */

	if ((SPR532 == ccid_descriptor->readerID)

		/* bmPINBlockString = 0 => PIN length not inserted in APDU */

		&& (0 == TxBuffer[3])

		/* case 1 APDU */

		&& (4 == TxBuffer[15]))

	{

		RESPONSECODE return_value;

		unsigned char cmd_tmp[] = { 0x80, 0x02, 0x00 };

		unsigned char res_tmp[1];

		unsigned int res_length = sizeof(res_tmp);

		/* the SPR532 will append the PIN code without any padding */

		return_value = CmdEscape(reader_index, cmd_tmp, sizeof(cmd_tmp),

			res_tmp, &res_length, 0);

		if (return_value != IFD_SUCCESS)

			return return_value;

		/* we need to set bSeq again to avoid a "Duplicate frame detected"

		 * error since the bSeq of CmdEscape is now greater than bSeq set at

		 * the beginning of this function */

		cmd[6] = (*ccid_descriptor->pbSeq)++;

	}

	i2dw(a - 10, cmd + 1);  /* CCID message length */

	old_read_timeout = ccid_descriptor -> readTimeout;

	ccid_descriptor -> readTimeout = max(90, TxBuffer[0]+10)*1000;	/* at least 90 seconds */

	res = WritePort(reader_index, a, cmd);

	if (STATUS_SUCCESS != res)

	{

		if (STATUS_NO_SUCH_DEVICE == res)

			ret = IFD_NO_SUCH_DEVICE;

		else

			ret = IFD_COMMUNICATION_ERROR;

		goto end;

	}

	ret = CCID_Receive(reader_index, RxLength, RxBuffer, NULL);

	/* T=1 Protocol Management for a TPDU reader */

	if ((SCARD_PROTOCOL_T1 == ccid_descriptor->cardProtocol)

		&& (CCID_CLASS_TPDU == (ccid_descriptor->dwFeatures & CCID_CLASS_EXCHANGE_MASK)))

	{

		/* timeout and cancel cases are faked by CCID_Receive() */

		if ((2 == *RxLength)

			/* the CCID command is rejected or failed */

		   || (IFD_SUCCESS != ret))

		{

			/* Decrement the sequence numbers since no TPDU was sent */

			get_ccid_slot(reader_index)->t1.ns ^= 1;

			get_ccid_slot(reader_index)->t1.nr ^= 1;

		}

		else

		{

			/* FIXME: manage T=1 error blocks */

			/* defines from openct/proto-t1.c */

			#define PCB 1

			#define DATA 3

			#define T1_S_BLOCK		0xC0

			#define T1_S_RESPONSE		0x20

			#define T1_S_TYPE(pcb)		((pcb) & 0x0F)

			#define T1_S_WTX		0x03

			/* WTX S-block */

			if ((T1_S_BLOCK | T1_S_WTX) == RxBuffer[PCB])

			{

/*

 * The Swiss health care card sends a WTX request before returning the

 * SW code. If the reader is in TPDU the driver must manage the request

 * itself.

 *

 * received: 00 C3 01 09 CB

 * openct/proto-t1.c:432:t1_transceive() S-Block request received

 * openct/proto-t1.c:489:t1_transceive() CT sent S-block with wtx=9

 * sending: 00 E3 01 09 EB

 * openct/proto-t1.c:667:t1_xcv() New timeout at WTX request: 23643 sec

 * received: 00 40 02 90 00 D2

*/

				ct_buf_t tbuf;

				unsigned char sblk[1]; /* we only need 1 byte of data */

				t1_state_t *t1 = &get_ccid_slot(reader_index)->t1;

				unsigned int slen;

				int oldReadTimeout;

				DEBUG_COMM2("CT sent S-block with wtx=%u", RxBuffer[DATA]);

				t1->wtx = RxBuffer[DATA];

				oldReadTimeout = ccid_descriptor->readTimeout;

				if (t1->wtx > 1)

				{

					/* set the new temporary timeout at WTX card request */

					ccid_descriptor->readTimeout *= t1->wtx;

					DEBUG_INFO2("New timeout at WTX request: %d sec",

							ccid_descriptor->readTimeout);

				}

				ct_buf_init(&tbuf, sblk, sizeof(sblk));

				t1->wtx = RxBuffer[DATA];

				ct_buf_putc(&tbuf, RxBuffer[DATA]);

				slen = t1_build(t1, RxBuffer, 0,

					T1_S_BLOCK | T1_S_RESPONSE | T1_S_TYPE(RxBuffer[PCB]),

					&tbuf, NULL);

				ret = CCID_Transmit(t1 -> lun, slen, RxBuffer, 0, t1->wtx);

				if (ret != IFD_SUCCESS)

					return ret;

				/* I guess we have at least 6 bytes in RxBuffer */

				*RxLength = 6;

				ret = CCID_Receive(reader_index, RxLength, RxBuffer, NULL);

				if (ret != IFD_SUCCESS)

					return ret;

				/* Restore initial timeout */

				ccid_descriptor->readTimeout = oldReadTimeout;

			}

			/* get only the T=1 data */

			memmove(RxBuffer, RxBuffer+3, *RxLength -4);

			*RxLength -= 4;	/* remove NAD, PCB, LEN and CRC */

		}

	}

end:

	ccid_descriptor -> readTimeout = old_read_timeout;

	return ret;

} /* SecurePINVerify */

#ifdef BOGUS_PINPAD_FIRMWARE

/*****************************************************************************

 *

 *					has_gemalto_modify_pin_bug

 *

 ****************************************************************************/

static int has_gemalto_modify_pin_bug(_ccid_descriptor *ccid_descriptor)

{

	/* Bug not present by default */

	int has_bug = 0;

	/* Covadis Véga-Alpha reader */

	if (VEGAALPHA == ccid_descriptor->readerID)

	{

		/* This reader has the bug (uses a Gemalto firmware) */

		has_bug = 1;

	}

	else

	{

		/* Gemalto reader */

		if ((GET_VENDOR(ccid_descriptor->readerID) == VENDOR_GEMALTO))

		{

			has_bug = 1; /* assume it has the bug */

			if (ccid_descriptor->gemalto_firmware_features &&

				ccid_descriptor->gemalto_firmware_features->bNumberMessageFix)

			{

				/* A Gemalto reader has the ModifyPIN structure bug */

				/* unless it explicitly reports it has been fixed */

				has_bug = 0;

			}

		}

	}

	return has_bug;

} /* has_gemalto_modify_pin_bug */

#endif

/*****************************************************************************

 *

 *					SecurePINModify

 *

 ****************************************************************************/

RESPONSECODE SecurePINModify(unsigned int reader_index,

	unsigned char TxBuffer[], unsigned int TxLength,

	unsigned char RxBuffer[], unsigned int *RxLength)

{

	unsigned char cmd[11+19+TxLength];

	unsigned int a, b;

	PIN_MODIFY_STRUCTURE *pms;

	_ccid_descriptor *ccid_descriptor = get_ccid_descriptor(reader_index);

	int old_read_timeout;

	RESPONSECODE ret;

	status_t res;

#ifdef BOGUS_PINPAD_FIRMWARE

	int bNumberMessage = 0; /* for GemPC Pinpad */

	int gemalto_modify_pin_bug;

#endif

	pms = (PIN_MODIFY_STRUCTURE *)TxBuffer;

	cmd[0] = 0x69;	/* Secure */

	cmd[5] = ccid_descriptor->bCurrentSlotIndex;	/* slot number */

	cmd[6] = (*ccid_descriptor->pbSeq)++;

	cmd[7] = 0;		/* bBWI */

	cmd[8] = 0;		/* wLevelParameter */

	cmd[9] = 0;

	cmd[10] = 1;	/* bPINOperation: PIN Modification */

	if (TxLength < 24+4 /* 4 = APDU size */) /* command too short? */

	{

		DEBUG_INFO3("Command too short: %d < %d", TxLength, 24+4);

		return IFD_NOT_SUPPORTED;

	}

	/* On little endian machines we are all set. */

	/* If on big endian machine and caller is using host byte order */

	if ((pms->ulDataLength + 24  == TxLength) &&

		(bei2i((unsigned char*)(&pms->ulDataLength)) == pms->ulDataLength))

	{

		DEBUG_INFO1("Reversing order from big to little endian");

		/* If ulDataLength is big endian, assume others are too */

		/* reverse the byte order for 3 fields */

		pms->wPINMaxExtraDigit = BSWAP_16(pms->wPINMaxExtraDigit);

		pms->wLangId = BSWAP_16(pms->wLangId);

		pms->ulDataLength = BSWAP_32(pms->ulDataLength);

	}

	/* At this point we now have the above 3 variables in little endian */

	if (dw2i(TxBuffer, 20) + 24 != TxLength) /* ulDataLength field coherency */

	{

		DEBUG_INFO3("Wrong lengths: %d %d", dw2i(TxBuffer, 20) + 24, TxLength);

		return IFD_NOT_SUPPORTED;

	}

	/* Make sure in the beginning if bNumberMessage is valid or not.

	 * 0xFF is the default value. */

	if ((TxBuffer[11] > 3) && (TxBuffer[11] != 0xFF))

	{

		DEBUG_INFO2("Wrong bNumberMessage: %d", TxBuffer[11]);

		return IFD_NOT_SUPPORTED;

	}

	/* Make sure bEntryValidationCondition is valid

	 * The Cherry XX44 reader crashes with a wrong value */

	if ((0x00 == TxBuffer[10]) || (TxBuffer[10] > 0x07))

	{

		DEBUG_INFO2("Correct bEntryValidationCondition (was 0x%02X)",

			TxBuffer[10]);

		TxBuffer[10] = 0x02;

	}

#ifdef BOGUS_PINPAD_FIRMWARE

	/* some firmwares are buggy so we try to "correct" the frame */

	/*

	 * SPR 532 and Cherry ST 2000C has no display but requires _all_

	 * bMsgIndex fields with bNumberMessage set to 0.

	 */

	if ((SPR532 == ccid_descriptor->readerID)

		|| (CHERRYST2000 == ccid_descriptor->readerID))

	{

		TxBuffer[11] = 0x03; /* set bNumberMessage to 3 so that

								all bMsgIndex123 are filled */

		TxBuffer[14] = TxBuffer[15] = TxBuffer[16] = 0;	/* bMsgIndex123 */

	}

	/* the bug is a bit different than for the Cherry ST 2000C

	 * with bNumberMessage < 3 the command seems to be accepted

	 * and the card sends 6B 80 */

	if (CHERRYXX44 == ccid_descriptor->readerID)

	{

		TxBuffer[11] = 0x03; /* set bNumberMessage to 3 so that

								all bMsgIndex123 are filled */

	}

	/* bug circumvention for the GemPC Pinpad */

	if ((GEMPCPINPAD == ccid_descriptor->readerID)

		|| (VEGAALPHA == ccid_descriptor->readerID))

	{

		/* The reader does not support, and actively reject, "max size reached"

		 * and "timeout occured" validation conditions */

		if (0x02 != TxBuffer[10])

		{

			DEBUG_INFO2("Correct bEntryValidationCondition for GemPC Pinpad (was %d)",

				TxBuffer[10]);

			TxBuffer[10] = 0x02;	/* validation key pressed */

		}

	}

	gemalto_modify_pin_bug = has_gemalto_modify_pin_bug(ccid_descriptor);

	if (gemalto_modify_pin_bug)

	{

		DEBUG_INFO1("Gemalto CCID Modify Pin Bug");

		/* The reader requests a value for bMsgIndex2 and bMsgIndex3

		 * even if they should not be present. So we fake

		 * bNumberMessage=3.  The real number of messages will be

		 * corrected later in the code */

		bNumberMessage = TxBuffer[11];

		if (0x03 != TxBuffer[11])

		{

			DEBUG_INFO2("Correct bNumberMessage for GemPC Pinpad (was %d)",

				TxBuffer[11]);

			TxBuffer[11] = 0x03; /* 3 messages */

		}

	}

#endif

	/* T=1 Protocol Management for a TPDU reader */

	if ((SCARD_PROTOCOL_T1 == ccid_descriptor->cardProtocol)

		&& (CCID_CLASS_TPDU == (ccid_descriptor->dwFeatures & CCID_CLASS_EXCHANGE_MASK)))

	{

		ct_buf_t sbuf;

		unsigned char sdata[T1_BUFFER_SIZE];

		/* Initialize send buffer with the APDU */

		ct_buf_set(&sbuf,

			(void *)(TxBuffer + offsetof(PIN_MODIFY_STRUCTURE, abData)),

			TxLength - offsetof(PIN_MODIFY_STRUCTURE, abData));

		/* Create T=1 block */

		(void)t1_build(&((get_ccid_slot(reader_index))->t1),

			sdata, 0, T1_I_BLOCK, &sbuf, NULL);

		/* Increment the sequence numbers  */

		get_ccid_slot(reader_index)->t1.ns ^= 1;

		get_ccid_slot(reader_index)->t1.nr ^= 1;

		/* Copy the generated T=1 block prologue into the teoprologue

		 * of the CCID command */

		memcpy(TxBuffer + offsetof(PIN_MODIFY_STRUCTURE, bTeoPrologue),

			sdata, 3);

	}

	/* Build a CCID block from a PC/SC V2.02.05 Part 10 block */

	/* Do adjustments as needed - CCID spec is not exact with some

	 * details in the format of the structure, per-reader adaptions

	 * might be needed.

	 */

	for (a = 11, b = 0; b < TxLength; b++)

	{

		if (1 == b) /* bTimeOut2 */

			/* Ignore the second timeout as there's nothing we can do with it

			 * currently */

			continue;

		if (15 == b) /* bMsgIndex2 */

		{

			/* in CCID the bMsgIndex2 is present only if bNumberMessage != 0 */

			if (0 == TxBuffer[11])

				continue;

		}

		if (16 == b) /* bMsgIndex3 */

		{

			/* in CCID the bMsgIndex3 is present only if bNumberMessage == 3 */

			if (TxBuffer[11] < 3)

				continue;

		}

		if ((b >= 20) && (b <= 23)) /* ulDataLength field (4 bytes) */

			/* the ulDataLength field is not present in the CCID frame

			 * so do not copy */

			continue;

		/* copy to the CCID block 'verbatim' */

		cmd[a] = TxBuffer[b];

		a++;

	}

#ifdef BOGUS_PINPAD_FIRMWARE

	if ((SPR532 == ccid_descriptor->readerID)

		|| (CHERRYST2000 == ccid_descriptor->readerID))

	{

		cmd[21] = 0x00; /* set bNumberMessage to 0 */

	}

	if (gemalto_modify_pin_bug)

		cmd[21] = bNumberMessage;	/* restore the real value */

#endif

	/* We know the size of the CCID message now */

	i2dw(a - 10, cmd + 1);	/* command length (includes bPINOperation) */

	old_read_timeout = ccid_descriptor -> readTimeout;

	ccid_descriptor -> readTimeout = max(90, TxBuffer[0]+10)*1000;	/* at least 90 seconds */

	res = WritePort(reader_index, a, cmd);

	if (STATUS_SUCCESS != res)

	{

		if (STATUS_NO_SUCH_DEVICE == res)

			ret = IFD_NO_SUCH_DEVICE;

		else

			ret = IFD_COMMUNICATION_ERROR;

		goto end;

	}

	ret = CCID_Receive(reader_index, RxLength, RxBuffer, NULL);

	/* T=1 Protocol Management for a TPDU reader */

	if ((SCARD_PROTOCOL_T1 == ccid_descriptor->cardProtocol)

		&& (CCID_CLASS_TPDU == (ccid_descriptor->dwFeatures & CCID_CLASS_EXCHANGE_MASK)))

	{

		/* timeout and cancel cases are faked by CCID_Receive() */

		if ((2 == *RxLength)

			/* the CCID command is rejected or failed */

			|| (IFD_SUCCESS != ret))

		{

			/* Decrement the sequence numbers since no TPDU was sent */

			get_ccid_slot(reader_index)->t1.ns ^= 1;

			get_ccid_slot(reader_index)->t1.nr ^= 1;

		}

		else

		{

			/* get only the T=1 data */

			/* FIXME: manage T=1 error blocks */

			memmove(RxBuffer, RxBuffer+3, *RxLength -4);

			*RxLength -= 4;	/* remove NAD, PCB, LEN and CRC */

		}

	}

end: