diff --git a/armsrc/Makefile b/armsrc/Makefile index 86ac7b39f..f55f9bc8e 100644 --- a/armsrc/Makefile +++ b/armsrc/Makefile @@ -103,7 +103,7 @@ endif include Standalone/Makefile.inc #the FPGA bitstream files. Note: order matters! -FPGA_BITSTREAMS = fpga_lf.bit fpga_hf.bit fpga_felica.bit +FPGA_BITSTREAMS = fpga_lf.bit fpga_hf.bit fpga_felica.bit fpga_hf_15.bit #the lz4 source files required for decompressing the fpga config at run time SRC_LZ4 = lz4.c diff --git a/armsrc/fpgaloader.c b/armsrc/fpgaloader.c index 1b6360126..ab8d57f7d 100644 --- a/armsrc/fpgaloader.c +++ b/armsrc/fpgaloader.c @@ -162,7 +162,7 @@ void FpgaSetupSsc(uint16_t fpga_mode) { // 8, 16 or 32 bits per transfer, no loopback, MSB first, 1 transfer per sync // pulse, no output sync - if ((fpga_mode & FPGA_MAJOR_MODE_MASK) == FPGA_MAJOR_MODE_HF_READER && FpgaGetCurrent() == FPGA_BITSTREAM_HF) { + if ((fpga_mode & FPGA_MAJOR_MODE_MASK) == FPGA_MAJOR_MODE_HF_READER && (FpgaGetCurrent() == FPGA_BITSTREAM_HF || FpgaGetCurrent() == FPGA_BITSTREAM_HF_15)) { AT91C_BASE_SSC->SSC_RFMR = SSC_FRAME_MODE_BITS_IN_WORD(16) | AT91C_SSC_MSBF | SSC_FRAME_MODE_WORDS_PER_TRANSFER(0); } else { AT91C_BASE_SSC->SSC_RFMR = SSC_FRAME_MODE_BITS_IN_WORD(8) | AT91C_SSC_MSBF | SSC_FRAME_MODE_WORDS_PER_TRANSFER(0); @@ -612,7 +612,7 @@ void switch_off(void) { Dbprintf("switch_off"); } FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); - if (downloaded_bitstream == FPGA_BITSTREAM_HF) { + if (downloaded_bitstream == FPGA_BITSTREAM_HF || downloaded_bitstream == FPGA_BITSTREAM_HF_15) { FpgaDisableSscDma(); } set_tracing(false); diff --git a/armsrc/fpgaloader.h b/armsrc/fpgaloader.h index cff84c3e2..897031042 100644 --- a/armsrc/fpgaloader.h +++ b/armsrc/fpgaloader.h @@ -29,6 +29,7 @@ #define FPGA_BITSTREAM_LF 1 #define FPGA_BITSTREAM_HF 2 #define FPGA_BITSTREAM_HF_FELICA 3 +#define FPGA_BITSTREAM_HF_15 4 /* Communication between ARM / FPGA is done inside armsrc/fpgaloader.c (function FpgaSendCommand) @@ -77,6 +78,7 @@ thres| x x x x x x x x #define FPGA_MAJOR_MODE_HF_SNIFF (3<<6) // D #define FPGA_MAJOR_MODE_HF_ISO18092 (4<<6) // D #define FPGA_MAJOR_MODE_HF_GET_TRACE (5<<6) // D +#define FPGA_MAJOR_MODE_HF_FSK_READER (6<<6) // D // BOTH HF / LF #define FPGA_MAJOR_MODE_OFF (7<<6) // D @@ -105,6 +107,14 @@ thres| x x x x x x x x #define FPGA_HF_READER_SUBCARRIER_424_KHZ (1<<4) #define FPGA_HF_READER_SUBCARRIER_212_KHZ (2<<4) +#define FPGA_HF_FSK_READER_OUTPUT_1695_KHZ (0<<0) +#define FPGA_HF_FSK_READER_OUTPUT_848_KHZ (1<<0) +#define FPGA_HF_FSK_READER_OUTPUT_424_KHZ (2<<0) +#define FPGA_HF_FSK_READER_OUTPUT_212_KHZ (3<<0) + +#define FPGA_HF_FSK_READER_NOPOWER (0<<4) +#define FPGA_HF_FSK_READER_WITHPOWER (1<<4) + // Options for the HF simulated tag, how to modulate #define FPGA_HF_SIMULATOR_NO_MODULATION 0x0 // 0000 #define FPGA_HF_SIMULATOR_MODULATE_BPSK 0x1 // 0001 diff --git a/armsrc/iso15693.c b/armsrc/iso15693.c index c08d6130f..c41760e24 100644 --- a/armsrc/iso15693.c +++ b/armsrc/iso15693.c @@ -1204,7 +1204,7 @@ void AcquireRawAdcSamplesIso15693(void) { LEDsoff(); DbpString("Starting to acquire data..."); - FpgaDownloadAndGo(FPGA_BITSTREAM_HF); + FpgaDownloadAndGo(FPGA_BITSTREAM_HF_15); BigBuf_free(); clear_trace(); @@ -1259,12 +1259,274 @@ void AcquireRawAdcSamplesIso15693(void) { LEDsoff(); } +//============================================================================= +// An ISO 15693 decoder for tag responses in FSK (two subcarriers) mode. +// Subcarriers frequencies are 424kHz and 484kHz (fc/32 and fc/28), +// LED handling: +// LED C -> ON once we have received the SOF and are expecting the rest. +// LED C -> OFF once we have received EOF or are unsynced +// +// Returns: true if we received a EOF +// false if we are still waiting for some more +//============================================================================= +#define DEBUG 0 +#define FREQ_IS_484(f) (f >= 26 && f <= 30) +#define FREQ_IS_424(f) (f >= 30 && f <= 34) +#define FREQ_IS_0(f) (f <= 24 || f >= 36) +#define SEOF_COUNT(c, s) ((s) ? (c >= 11 && c <= 13) : (c >= 44 && c <= 52)) +#define LOGIC_COUNT(c, s) ((s) ? (c >= 3 && c <= 6) : (c >= 13 && c <= 21)) +#define MAX_COUNT(c, s) ((s) ? (c >= 13) : (c >= 52)) +#define MIN_COUNT(c, s) ((s) ? (c <= 2) : (c <= 4)) + +typedef struct DecodeTagFSK { + enum { + STATE_FSK_BEFORE_SOF, + STATE_FSK_SOF_484, + STATE_FSK_SOF_424, + STATE_FSK_SOF_END, + STATE_FSK_RECEIVING_DATA_484, + STATE_FSK_RECEIVING_DATA_424, + STATE_FSK_EOF, + STATE_FSK_ERROR + } state; + enum { + LOGIC0_PART1, + LOGIC1_PART1, + LOGIC0_PART2, + LOGIC1_PART2, + SOF + } lastBit; + uint8_t count; + uint8_t bitCount; + uint8_t shiftReg; + uint16_t len; + uint16_t max_len; + uint8_t *output; +} DecodeTagFSK_t; + +static void DecodeTagFSKReset(DecodeTagFSK_t *DecodeTag) { + DecodeTag->state = STATE_FSK_BEFORE_SOF; + DecodeTag->bitCount = 0; + DecodeTag->len = 0; + DecodeTag->shiftReg = 0; + DbpString("FSK tag reset"); +} + +static void DecodeTagFSKInit(DecodeTagFSK_t *DecodeTag, uint8_t *data, uint16_t max_len) { + DecodeTag->output = data; + DecodeTag->max_len = max_len; + DecodeTagFSKReset(DecodeTag); +} + +// Performances of this function are crutial for stability +// as it is called in real time for every samples +static int inline __attribute__((always_inline)) Handle15693FSKSamplesFromTag(uint8_t freq, DecodeTagFSK_t *DecodeTag, bool recv_speed) +{ + switch(DecodeTag->state) { + case STATE_FSK_BEFORE_SOF: + if (FREQ_IS_484(freq)) + { // possible SOF starting + DecodeTag->state = STATE_FSK_SOF_484; + DecodeTag->lastBit = LOGIC0_PART1; + DecodeTag->count = 1; + } + break; + + case STATE_FSK_SOF_484: + //DbpString("STATE_FSK_SOF_484"); + + if (FREQ_IS_484(freq) && !MAX_COUNT(DecodeTag->count, recv_speed)) // still in SOF at 484 + { + DecodeTag->count++; + } + else if (FREQ_IS_424(freq) && SEOF_COUNT(DecodeTag->count, recv_speed)) + { // SOF part1 continue at 424 + DecodeTag->state = STATE_FSK_SOF_424; + DecodeTag->count = 1; + } + else // SOF failed, roll back + { + DecodeTag->state = STATE_FSK_BEFORE_SOF; + } + break; + + case STATE_FSK_SOF_424: + //DbpString("STATE_FSK_SOF_424"); + + if (FREQ_IS_424(freq) && !MAX_COUNT(DecodeTag->count, recv_speed)) // still in SOF at 424 + DecodeTag->count++; + else if (FREQ_IS_484(freq) && SEOF_COUNT(DecodeTag->count, recv_speed)) + { // SOF part 1 finished + DecodeTag->state = STATE_FSK_SOF_END; + DecodeTag->count = 1; + } + else // SOF failed, roll back + { + if (DEBUG) + Dbprintf("SOF_424 failed: freq=%d, count=%d, recv_speed=%d", freq, DecodeTag->count, recv_speed); + DecodeTag->state = STATE_FSK_BEFORE_SOF; + } + break; + + case STATE_FSK_SOF_END: + if (FREQ_IS_484(freq) && !MAX_COUNT(DecodeTag->count, recv_speed)) // still in SOF_END (484) + DecodeTag->count++; + else if (FREQ_IS_424(freq) && LOGIC_COUNT(DecodeTag->count, recv_speed)) + { // SOF END finished or SOF END 1st part finished + DecodeTag->count = 0; + if (DecodeTag->lastBit == SOF) + { // SOF finished at 424 + if (DEBUG) + DbpString("Receiving data !"); + DecodeTag->state = STATE_FSK_RECEIVING_DATA_424; + LED_C_ON(); + } + DecodeTag->lastBit = SOF; + } + else if (FREQ_IS_424(freq) && !MAX_COUNT(DecodeTag->count, recv_speed)) // still in SOF_END (424) + DecodeTag->count++; + else if (DecodeTag->lastBit == SOF && FREQ_IS_484(freq) && + LOGIC_COUNT(DecodeTag->count, recv_speed)) + { // SOF finished at 484 + DecodeTag->state = STATE_FSK_RECEIVING_DATA_484; + DecodeTag->count = 1; + LED_C_ON(); + } + else // SOF failed, roll back + { + if (DEBUG) + Dbprintf("SOF_END failed: freq=%d, count=%d, recv_speed=%d", freq, DecodeTag->count, recv_speed); + DecodeTag->state = STATE_FSK_BEFORE_SOF; + } + break; + + + case STATE_FSK_RECEIVING_DATA_424: + if (DecodeTag->lastBit == LOGIC1_PART1 && + LOGIC_COUNT(DecodeTag->count, recv_speed)) + { // logic 1 finished + DecodeTag->lastBit = LOGIC1_PART2; + DecodeTag->count = 0; + + DecodeTag->shiftReg >>= 1; + DecodeTag->shiftReg |= 0x80; + DecodeTag->bitCount++; + if (DecodeTag->bitCount == 8) { + DecodeTag->output[DecodeTag->len++] = DecodeTag->shiftReg; + if (DecodeTag->len > DecodeTag->max_len) { + // buffer overflow, give up + LED_C_OFF(); + return true; + } + DecodeTag->bitCount = 0; + DecodeTag->shiftReg = 0; + } + } + else if (FREQ_IS_424(freq) && !MAX_COUNT(DecodeTag->count, recv_speed)) // still at 424 + DecodeTag->count++; + else if (FREQ_IS_484(freq) && LOGIC_COUNT(DecodeTag->count, recv_speed) && + DecodeTag->lastBit >= LOGIC0_PART2) + { // end of LOGIC0_PART1 + DecodeTag->count = 1; + DecodeTag->state = STATE_FSK_RECEIVING_DATA_484; + DecodeTag->lastBit = LOGIC0_PART1; + } + else if (FREQ_IS_484(freq) && MIN_COUNT(DecodeTag->count, recv_speed)) + { // it was just the end of the previous block + DecodeTag->count = 1; + DecodeTag->state = STATE_FSK_RECEIVING_DATA_484; + } + else if (FREQ_IS_484(freq) && DecodeTag->lastBit == LOGIC0_PART2 && + SEOF_COUNT(DecodeTag->count, recv_speed)) + { // EOF has started + if (DEBUG) + Dbprintf("RECEIVING_DATA_424 failed: freq=%d, count=%d, recv_speed=%d", freq, DecodeTag->count, recv_speed); + DecodeTag->count = 1; + DecodeTag->state = STATE_FSK_EOF; + LED_C_OFF(); + } + else // error + { + if (DEBUG) + Dbprintf("RECEIVING_DATA_424 error: freq=%d, count=%d, recv_speed=%d", freq, DecodeTag->count, recv_speed); + DecodeTag->state = STATE_FSK_ERROR; + LED_C_OFF(); + return true; + } + break; + + case STATE_FSK_RECEIVING_DATA_484: + if (DecodeTag->lastBit == LOGIC0_PART1 && + LOGIC_COUNT(DecodeTag->count, recv_speed)) + { // logic 0 finished + DecodeTag->lastBit = LOGIC0_PART2; + DecodeTag->count = 0; + + DecodeTag->shiftReg >>= 1; + DecodeTag->bitCount++; + if (DecodeTag->bitCount == 8) { + DecodeTag->output[DecodeTag->len++] = DecodeTag->shiftReg; + if (DecodeTag->len > DecodeTag->max_len) { + // buffer overflow, give up + LED_C_OFF(); + return true; + } + DecodeTag->bitCount = 0; + DecodeTag->shiftReg = 0; + } + } + else if (FREQ_IS_484(freq) && !MAX_COUNT(DecodeTag->count, recv_speed)) // still at 484 + DecodeTag->count++; + else if (FREQ_IS_424(freq) && LOGIC_COUNT(DecodeTag->count, recv_speed) && + DecodeTag->lastBit >= LOGIC0_PART2) + { // end of LOGIC1_PART1 + DecodeTag->count = 1; + DecodeTag->state = STATE_FSK_RECEIVING_DATA_424; + DecodeTag->lastBit = LOGIC1_PART1; + } + else if (FREQ_IS_424(freq) && MIN_COUNT(DecodeTag->count, recv_speed)) + { // it was just the end of the previous block + DecodeTag->count = 1; + DecodeTag->state = STATE_FSK_RECEIVING_DATA_424; + } + else // error + { + if (DEBUG) + Dbprintf("RECEIVING_DATA_484 error: freq=%d, count=%d, recv_speed=%d", freq, DecodeTag->count, recv_speed); + LED_C_OFF(); + DecodeTag->state = STATE_FSK_ERROR; + return true; + } + break; + + case STATE_FSK_EOF: + if (FREQ_IS_484(freq) && !MAX_COUNT(DecodeTag->count, recv_speed)) // still at 484 + { + DecodeTag->count++; + if (SEOF_COUNT(DecodeTag->count, recv_speed)) + return true; // end of the transmission + } + else // error + { + if (DEBUG) + Dbprintf("EOF error: freq=%d, count=%d, recv_speed=%d", freq, DecodeTag->count, recv_speed); + DecodeTag->state = STATE_FSK_ERROR; + return true; + } + break; + case STATE_FSK_ERROR: + LED_C_OFF(); + return true; // error + break; + } + return false; +} void SniffIso15693(uint8_t jam_search_len, uint8_t *jam_search_string) { LEDsoff(); LED_A_ON(); - FpgaDownloadAndGo(FPGA_BITSTREAM_HF); + FpgaDownloadAndGo(FPGA_BITSTREAM_HF_15); DbpString("Starting to sniff. Press PM3 Button to stop."); @@ -1276,6 +1538,10 @@ void SniffIso15693(uint8_t jam_search_len, uint8_t *jam_search_string) { uint8_t response[ISO15693_MAX_RESPONSE_LENGTH] = {0}; DecodeTagInit(&dtag, response, sizeof(response)); + DecodeTagFSK_t dtagfsk = {0}; + uint8_t response2[ISO15693_MAX_RESPONSE_LENGTH] = {0}; + DecodeTagFSKInit(&dtagfsk, response2, sizeof(response2)); + DecodeReader_t dreader = {0}; uint8_t cmd[ISO15693_MAX_COMMAND_LENGTH] = {0}; DecodeReaderInit(&dreader, cmd, sizeof(cmd), jam_search_len, jam_search_string); @@ -1301,6 +1567,8 @@ void SniffIso15693(uint8_t jam_search_len, uint8_t *jam_search_string) { bool tag_is_active = false; bool reader_is_active = false; bool expect_tag_answer = false; + bool expect_fsk_answer = false; + bool expect_fast_answer = false; int dma_start_time = 0; // Count of samples received so far, so that we can include timing @@ -1361,13 +1629,20 @@ void SniffIso15693(uint8_t jam_search_len, uint8_t *jam_search_string) { - 32 * 16 // time for SOF transfer - 16 * 16; // time for EOF transfer LogTrace_ISO15693(dreader.output, dreader.byteCount, (sof_time * 4), (eof_time * 4), NULL, true); + + expect_fsk_answer = dreader.output[0] & ISO15_REQ_SUBCARRIER_TWO; + expect_fast_answer = dreader.output[0] & ISO15_REQ_DATARATE_HIGH; } // And ready to receive another command. DecodeReaderReset(&dreader); DecodeTagReset(&dtag); + DecodeTagFSKReset(&dtagfsk); reader_is_active = false; expect_tag_answer = true; - + if (expect_fsk_answer) + { + FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_FSK_READER | FPGA_HF_FSK_READER_OUTPUT_212_KHZ | FPGA_HF_FSK_READER_NOPOWER); + } } else if (Handle15693SampleFromReader(sniffdata & 0x01, &dreader)) { uint32_t eof_time = dma_start_time + (samples * 16) + 16 - DELAY_READER_TO_ARM_SNIFF; // end of EOF @@ -1377,13 +1652,21 @@ void SniffIso15693(uint8_t jam_search_len, uint8_t *jam_search_string) { - 32 * 16 // time for SOF transfer - 16 * 16; // time for EOF transfer LogTrace_ISO15693(dreader.output, dreader.byteCount, (sof_time * 4), (eof_time * 4), NULL, true); + + expect_fsk_answer = dreader.output[0] & ISO15_REQ_SUBCARRIER_TWO; + expect_fast_answer = dreader.output[0] & ISO15_REQ_DATARATE_HIGH; } // And ready to receive another command DecodeReaderReset(&dreader); DecodeTagReset(&dtag); + DecodeTagFSKReset(&dtagfsk); reader_is_active = false; expect_tag_answer = true; + if (expect_fsk_answer) + { + FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_FSK_READER | FPGA_HF_FSK_READER_OUTPUT_212_KHZ | FPGA_HF_FSK_READER_NOPOWER); + } } else { reader_is_active = (dreader.state >= STATE_READER_RECEIVE_DATA_1_OUT_OF_4); } @@ -1391,25 +1674,77 @@ void SniffIso15693(uint8_t jam_search_len, uint8_t *jam_search_string) { if (reader_is_active == false && expect_tag_answer) { // no need to try decoding tag data if the reader is currently sending or no answer expected yet - if (Handle15693SamplesFromTag(sniffdata >> 2, &dtag)) { + if (!expect_fsk_answer) + { + if (Handle15693SamplesFromTag(sniffdata >> 2, &dtag)) { - uint32_t eof_time = dma_start_time + (samples * 16) - DELAY_TAG_TO_ARM_SNIFF; // end of EOF - if (dtag.lastBit == SOF_PART2) { - eof_time -= (8 * 16); // needed 8 additional samples to confirm single SOF (iCLASS) + uint32_t eof_time = dma_start_time + (samples * 16) - DELAY_TAG_TO_ARM_SNIFF; // end of EOF + if (dtag.lastBit == SOF_PART2) { + eof_time -= (8 * 16); // needed 8 additional samples to confirm single SOF (iCLASS) + } + uint32_t sof_time = eof_time + - dtag.len * 8 * 8 * 16 // time for byte transfers + - (32 * 16) // time for SOF transfer + - (dtag.lastBit != SOF_PART2 ? (32 * 16) : 0); // time for EOF transfer + + LogTrace_ISO15693(dtag.output, dtag.len, (sof_time * 4), (eof_time * 4), NULL, false); + // And ready to receive another response. + DecodeTagReset(&dtag); + DecodeTagFSKReset(&dtagfsk); + DecodeReaderReset(&dreader); + expect_tag_answer = false; + tag_is_active = false; + } else { + tag_is_active = (dtag.state >= STATE_TAG_RECEIVING_DATA); } - uint32_t sof_time = eof_time - - dtag.len * 8 * 8 * 16 // time for byte transfers - - (32 * 16) // time for SOF transfer - - (dtag.lastBit != SOF_PART2 ? (32 * 16) : 0); // time for EOF transfer + } + else + { + if (Handle15693FSKSamplesFromTag(sniffdata >> 8, &dtagfsk, expect_fast_answer)) { + uint32_t eof_time = dma_start_time + (samples * 16) - DELAY_TAG_TO_ARM_SNIFF; // end of EOF + if (dtagfsk.lastBit == SOF) { + eof_time -= (8 * 16); // needed 8 additional samples to confirm single SOF (iCLASS) + } + uint32_t sof_time = eof_time + - dtagfsk.len * 8 * 8 * 16 // time for byte transfers + - (32 * 16) // time for SOF transfer + - (dtagfsk.lastBit != SOF ? (32 * 16) : 0); // time for EOF transfer - LogTrace_ISO15693(dtag.output, dtag.len, (sof_time * 4), (eof_time * 4), NULL, false); - // And ready to receive another response. - DecodeTagReset(&dtag); - DecodeReaderReset(&dreader); - expect_tag_answer = false; - tag_is_active = false; - } else { - tag_is_active = (dtag.state >= STATE_TAG_RECEIVING_DATA); + LogTrace_ISO15693(dtagfsk.output, dtagfsk.len, (sof_time * 4), (eof_time * 4), NULL, false); + // And ready to receive another response. + DecodeTagFSKReset(&dtagfsk); + DecodeTagReset(&dtag); + DecodeReaderReset(&dreader); + expect_tag_answer = false; + tag_is_active = false; + expect_fsk_answer = false; + + FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER | FPGA_HF_READER_MODE_SNIFF_AMPLITUDE); + } + else if (Handle15693FSKSamplesFromTag(sniffdata & 0xFF, &dtagfsk, expect_fast_answer)) { + + uint32_t eof_time = dma_start_time + (samples * 16) - DELAY_TAG_TO_ARM_SNIFF; // end of EOF + if (dtagfsk.lastBit == SOF) { + eof_time -= (8 * 16); // needed 8 additional samples to confirm single SOF (iCLASS) + } + uint32_t sof_time = eof_time + - dtagfsk.len * 8 * 8 * 16 // time for byte transfers + - (32 * 16) // time for SOF transfer + - (dtagfsk.lastBit != SOF ? (32 * 16) : 0); // time for EOF transfer + + LogTrace_ISO15693(dtagfsk.output, dtagfsk.len, (sof_time * 4), (eof_time * 4), NULL, false); + // And ready to receive another response. + DecodeTagFSKReset(&dtagfsk); + DecodeTagReset(&dtag); + DecodeReaderReset(&dreader); + expect_tag_answer = false; + tag_is_active = false; + expect_fsk_answer = false; + + FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER | FPGA_HF_READER_MODE_SNIFF_AMPLITUDE); + } else { + tag_is_active = (dtagfsk.state >= STATE_FSK_RECEIVING_DATA_484); + } } } @@ -1424,6 +1759,9 @@ void SniffIso15693(uint8_t jam_search_len, uint8_t *jam_search_string) { Dbprintf(" DecodeTag State........%d", dtag.state); Dbprintf(" DecodeTag byteCnt......%d", dtag.len); Dbprintf(" DecodeTag posCount.....%d", dtag.posCount); + Dbprintf(" DecodeTagFSK State........%d", dtagfsk.state); + Dbprintf(" DecodeTagFSK byteCnt......%d", dtagfsk.len); + Dbprintf(" DecodeTagFSK count.....%d", dtagfsk.count); Dbprintf(" DecodeReader State.....%d", dreader.state); Dbprintf(" DecodeReader byteCnt...%d", dreader.byteCount); Dbprintf(" DecodeReader posCount..%d", dreader.posCount); @@ -1436,7 +1774,7 @@ void SniffIso15693(uint8_t jam_search_len, uint8_t *jam_search_string) { void Iso15693InitReader(void) { LEDsoff(); - FpgaDownloadAndGo(FPGA_BITSTREAM_HF); + FpgaDownloadAndGo(FPGA_BITSTREAM_HF_15); // Start from off (no field generated) FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); @@ -1679,7 +2017,7 @@ void ReaderIso15693(uint32_t parameter, iso15_card_select_t *p_card) { // When SIM: initialize the Proxmark3 as ISO15693 tag void Iso15693InitTag(void) { - FpgaDownloadAndGo(FPGA_BITSTREAM_HF); + FpgaDownloadAndGo(FPGA_BITSTREAM_HF_15); // Start from off (no field generated) FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); diff --git a/fpga-xc2s30/Makefile b/fpga-xc2s30/Makefile index 9b1f7a5ca..59eaf8b79 100644 --- a/fpga-xc2s30/Makefile +++ b/fpga-xc2s30/Makefile @@ -5,9 +5,9 @@ RMDIR = rm -rf # rmdir only if dir is empty, tolerate failure RMDIR_SOFT = -rmdir # -all: fpga_lf.bit fpga_hf.bit fpga_felica.bit +all: fpga_lf.bit fpga_hf.bit fpga_felica.bit fpga_hf_15.bit clean: - $(Q)$(RM) *.bgn *.drc *.ncd *.ngd *_par.xrpt *-placed.* *-placed_pad.* *_usage.xml xst_hf.srp xst_lf.srp xst_felica.srp + $(Q)$(RM) *.bgn *.drc *.ncd *.ngd *_par.xrpt *-placed.* *-placed_pad.* *_usage.xml xst_hf.srp xst_lf.srp xst_felica.srp xst_hf_15.srp $(Q)$(RM) *.map *.ngc *.xrpt *.pcf *.rbt *.bld *.mrp *.ngm *.unroutes *_summary.xml netlist.lst $(Q)$(RMDIR) *_auto_* xst @@ -22,6 +22,11 @@ fpga_felica.ngc: fpga_felica.v fpga.ucf xst_felica.scr util.v hi_simulate.v hi_r $(info [-] XST $@) $(Q)$(XILINX_TOOLS_PREFIX)xst -ifn xst_felica.scr +fpga_hf_15.ngc: fpga_hf_15.v fpga.ucf xst_hf.scr util.v hi_simulate.v hi_reader.v hi_iso14443a.v hi_sniffer.v hi_get_trace.v hi_read_fsk.v + $(Q)$(RM) $@ + $(info [-] XST $@) + $(Q)$(XILINX_TOOLS_PREFIX)xst -ifn xst_hf_15.scr + fpga_lf.ngc: fpga_lf.v fpga.ucf xst_lf.scr util.v clk_divider.v lo_edge_detect.v lo_read.v lo_passthru.v lp20khz_1MSa_iir_filter.v min_max_tracker.v lf_edge_detect.v $(Q)$(RM) $@ $(info [-] XST $@) diff --git a/fpga-xc2s30/fpga_hf_15.bit b/fpga-xc2s30/fpga_hf_15.bit new file mode 100644 index 000000000..916d84340 Binary files /dev/null and b/fpga-xc2s30/fpga_hf_15.bit differ diff --git a/fpga-xc2s30/fpga_hf_15.v b/fpga-xc2s30/fpga_hf_15.v new file mode 100644 index 000000000..59118ef33 --- /dev/null +++ b/fpga-xc2s30/fpga_hf_15.v @@ -0,0 +1,260 @@ +//----------------------------------------------------------------------------- +// The FPGA is responsible for interfacing between the A/D, the coil drivers, +// and the ARM. In the low-frequency modes it passes the data straight +// through, so that the ARM gets raw A/D samples over the SSP. In the high- +// frequency modes, the FPGA might perform some demodulation first, to +// reduce the amount of data that we must send to the ARM. +// +// I am not really an FPGA/ASIC designer, so I am sure that a lot of this +// could be improved. +// +// Jonathan Westhues, March 2006 +// Added ISO14443-A support by Gerhard de Koning Gans, April 2008 +// iZsh , June 2014 +// Piwi, Feb 2019 +//----------------------------------------------------------------------------- + + +// Defining commands, modes and options. This must be aligned to the definitions in fpgaloader.h +// Note: the definitions here are without shifts + +// Commands: +`define FPGA_CMD_SET_CONFREG 1 +`define FPGA_CMD_TRACE_ENABLE 2 + +// Major modes: +`define FPGA_MAJOR_MODE_HF_READER 0 +`define FPGA_MAJOR_MODE_HF_SIMULATOR 1 +`define FPGA_MAJOR_MODE_HF_ISO14443A 2 +`define FPGA_MAJOR_MODE_HF_SNIFF 3 +`define FPGA_MAJOR_MODE_HF_ISO18092 4 +`define FPGA_MAJOR_MODE_HF_GET_TRACE 5 +`define FPGA_MAJOR_MODE_HF_FSK_READER 6 +`define FPGA_MAJOR_MODE_OFF 7 + +// Options for the generic HF reader +`define FPGA_HF_READER_MODE_RECEIVE_IQ 0 +`define FPGA_HF_READER_MODE_RECEIVE_AMPLITUDE 1 +`define FPGA_HF_READER_MODE_RECEIVE_PHASE 2 +`define FPGA_HF_READER_MODE_SEND_FULL_MOD 3 +`define FPGA_HF_READER_MODE_SEND_SHALLOW_MOD 4 +`define FPGA_HF_READER_MODE_SNIFF_IQ 5 +`define FPGA_HF_READER_MODE_SNIFF_AMPLITUDE 6 +`define FPGA_HF_READER_MODE_SNIFF_PHASE 7 +`define FPGA_HF_READER_MODE_SEND_JAM 8 + +`define FPGA_HF_READER_SUBCARRIER_848_KHZ 0 +`define FPGA_HF_READER_SUBCARRIER_424_KHZ 1 +`define FPGA_HF_READER_SUBCARRIER_212_KHZ 2 + +`define FPGA_HF_FSK_READER_OUTPUT_1695_KHZ 0 +`define FPGA_HF_FSK_READER_OUTPUT_848_KHZ 1 +`define FPGA_HF_FSK_READER_OUTPUT_424_KHZ 2 +`define FPGA_HF_FSK_READER_OUTPUT_212_KHZ 3 + +`define FPGA_HF_FSK_READER_NOPOWER 0 +`define FPGA_HF_FSK_READER_WITHPOWER 1 + +// Options for the HF simulated tag, how to modulate +`define FPGA_HF_SIMULATOR_NO_MODULATION 0 +`define FPGA_HF_SIMULATOR_MODULATE_BPSK 1 +`define FPGA_HF_SIMULATOR_MODULATE_212K 2 +`define FPGA_HF_SIMULATOR_MODULATE_424K 4 +`define FPGA_HF_SIMULATOR_MODULATE_424K_8BIT 5 + +// Options for ISO14443A +`define FPGA_HF_ISO14443A_SNIFFER 0 +`define FPGA_HF_ISO14443A_TAGSIM_LISTEN 1 +`define FPGA_HF_ISO14443A_TAGSIM_MOD 2 +`define FPGA_HF_ISO14443A_READER_LISTEN 3 +`define FPGA_HF_ISO14443A_READER_MOD 4 + +//options for ISO18092 / Felica +`define FPGA_HF_ISO18092_FLAG_NOMOD 1 // 0001 disable modulation module +`define FPGA_HF_ISO18092_FLAG_424K 2 // 0010 should enable 414k mode (untested). No autodetect +`define FPGA_HF_ISO18092_FLAG_READER 4 // 0100 enables antenna power, to act as a reader instead of tag + +`include "hi_reader.v" +`include "hi_simulate.v" +//`include "hi_iso14443a.v" +`include "hi_sniffer.v" +`include "util.v" +// `include "hi_flite.v" +`include "hi_get_trace.v" +`include "hi_read_fsk.v" + +module fpga_hf_15( + input spck, output miso, input mosi, input ncs, + input pck0, input ck_1356meg, input ck_1356megb, + output pwr_lo, output pwr_hi, + output pwr_oe1, output pwr_oe2, output pwr_oe3, output pwr_oe4, + input [7:0] adc_d, output adc_clk, output adc_noe, + output ssp_frame, output ssp_din, input ssp_dout, output ssp_clk, + input cross_hi, input cross_lo, + output dbg +); + +//----------------------------------------------------------------------------- +// The SPI receiver. This sets up the configuration word, which the rest of +// the logic looks at to determine how to connect the A/D and the coil +// drivers (i.e., which section gets it). Also assign some symbolic names +// to the configuration bits, for use below. +//----------------------------------------------------------------------------- + +/* + Attempt to write up how its hooked up. + / Iceman, 2020 + + Communication between ARM / FPGA is done inside armsrc/fpgaloader.c see: function FpgaSendCommand() + Send 16 bit command / data pair to FPGA + The bit format is: C3 C2 C1 C0 D11 D10 D9 D8 D7 D6 D5 D4 D3 D2 D1 D0 + where + C is 4bit command + D is 12bit data + + shift_reg receive this 16bit frame + + +-----+--------- frame layout -------------------- +bit | 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 +-----+------------------------------------------- +cmd | x x x x +major| x x x +opt | x x x x +sub | x x +divi | x x x x x x x x +thres| x x x x x x x x +-----+------------------------------------------- +*/ + +reg [15:0] shift_reg; +reg [8:0] conf_word; +reg trace_enable; + +// We switch modes between transmitting to the 13.56 MHz tag and receiving +// from it, which means that we must make sure that we can do so without +// glitching, or else we will glitch the transmitted carrier. +always @(posedge ncs) +begin + case(shift_reg[15:12]) + `FPGA_CMD_SET_CONFREG: conf_word <= shift_reg[8:0]; + `FPGA_CMD_TRACE_ENABLE: trace_enable <= shift_reg[0]; + endcase +end + +always @(posedge spck) +begin + if(~ncs) + begin + shift_reg[15:1] <= shift_reg[14:0]; + shift_reg[0] <= mosi; + end +end + +// select module (outputs) based on major mode +wire [2:0] major_mode = conf_word[8:6]; + +// configuring the HF reader +wire [1:0] subcarrier_frequency = conf_word[5:4]; +wire [3:0] minor_mode = conf_word[3:0]; + +//----------------------------------------------------------------------------- +// And then we instantiate the modules corresponding to each of the FPGA's +// major modes, and use muxes to connect the outputs of the active mode to +// the output pins. +//----------------------------------------------------------------------------- + +// 000 - HF reader +hi_reader hr( + ck_1356megb, + hr_pwr_lo, hr_pwr_hi, hr_pwr_oe1, hr_pwr_oe2, hr_pwr_oe3, hr_pwr_oe4, + adc_d, hr_adc_clk, + hr_ssp_frame, hr_ssp_din, ssp_dout, hr_ssp_clk, + hr_dbg, + subcarrier_frequency, minor_mode +); + +// 001 - HF simulated tag +hi_simulate hs( + ck_1356meg, + hs_pwr_lo, hs_pwr_hi, hs_pwr_oe1, hs_pwr_oe2, hs_pwr_oe3, hs_pwr_oe4, + adc_d, hs_adc_clk, + hs_ssp_frame, hs_ssp_din, ssp_dout, hs_ssp_clk, + hs_dbg, + minor_mode +); + +/*// 010 - HF ISO14443-A +hi_iso14443a hisn( + ck_1356meg, + hisn_pwr_lo, hisn_pwr_hi, hisn_pwr_oe1, hisn_pwr_oe2, hisn_pwr_oe3, hisn_pwr_oe4, + adc_d, hisn_adc_clk, + hisn_ssp_frame, hisn_ssp_din, ssp_dout, hisn_ssp_clk, + hisn_dbg, + minor_mode +);*/ + +// 011 - HF sniff +hi_sniffer he( + ck_1356megb, + he_pwr_lo, he_pwr_hi, he_pwr_oe1, he_pwr_oe2, he_pwr_oe3, he_pwr_oe4, + adc_d, he_adc_clk, + he_ssp_frame, he_ssp_din, he_ssp_clk +); + +// 100 - HF ISO18092 FeliCa +/* +hi_flite hfl( + ck_1356megb, + hfl_pwr_lo, hfl_pwr_hi, hfl_pwr_oe1, hfl_pwr_oe2, hfl_pwr_oe3, hfl_pwr_oe4, + adc_d, hfl_adc_clk, + hfl_ssp_frame, hfl_ssp_din, ssp_dout, hfl_ssp_clk, + hfl_dbg, + minor_mode +); +*/ + +// 101 - HF get trace +hi_get_trace gt( + ck_1356megb, + adc_d, trace_enable, major_mode, + gt_ssp_frame, gt_ssp_din, gt_ssp_clk +); + +// 110 - HF Read FSK +hi_read_fsk hrf( + ck_1356meg, + hrf_pwr_lo, hrf_pwr_hi, hrf_pwr_oe1, hrf_pwr_oe2, hrf_pwr_oe3, hrf_pwr_oe4, + adc_d, hrf_adc_clk, + hrf_ssp_frame, hrf_ssp_din, hrf_ssp_clk, + subcarrier_frequency, minor_mode +); + +// Major modes: +// 000 -- HF reader; subcarrier frequency and modulation depth selectable +// 001 -- HF simulated tag +// 010 -- HF ISO14443-A +// 011 -- HF sniff +// 100 -- HF ISO18092 FeliCa +// 101 -- HF get trace +// 110 -- HF Read FSK +// 111 -- FPGA_MAJOR_MODE_OFF + +// 000 001 010 011 100 101 110 111 + +mux8 mux_ssp_clk (major_mode, ssp_clk, hr_ssp_clk, hs_ssp_clk, 1'b0, he_ssp_clk, hfl_ssp_clk, gt_ssp_clk, hrf_ssp_clk, 1'b0); +mux8 mux_ssp_din (major_mode, ssp_din, hr_ssp_din, hs_ssp_din, 1'b0, he_ssp_din, hfl_ssp_din, gt_ssp_din, hrf_ssp_din, 1'b0); +mux8 mux_ssp_frame (major_mode, ssp_frame, hr_ssp_frame, hs_ssp_frame, 1'b0, he_ssp_frame, hfl_ssp_frame, gt_ssp_frame, hrf_ssp_frame, 1'b0); +mux8 mux_pwr_oe1 (major_mode, pwr_oe1, hr_pwr_oe1, hs_pwr_oe1, 1'b0, he_pwr_oe1, hfl_pwr_oe1, 1'b0, hrf_pwr_oe1, 1'b0); +mux8 mux_pwr_oe2 (major_mode, pwr_oe2, hr_pwr_oe2, hs_pwr_oe2, 1'b0, he_pwr_oe2, hfl_pwr_oe2, 1'b0, hrf_pwr_oe2, 1'b0); +mux8 mux_pwr_oe3 (major_mode, pwr_oe3, hr_pwr_oe3, hs_pwr_oe3, 1'b0, he_pwr_oe3, hfl_pwr_oe3, 1'b0, hrf_pwr_oe3, 1'b0); +mux8 mux_pwr_oe4 (major_mode, pwr_oe4, hr_pwr_oe4, hs_pwr_oe4, 1'b0, he_pwr_oe4, hfl_pwr_oe4, 1'b0, hrf_pwr_oe4, 1'b0); +mux8 mux_pwr_lo (major_mode, pwr_lo, hr_pwr_lo, hs_pwr_lo, 1'b0, he_pwr_lo, hfl_pwr_lo, 1'b0, hrf_pwr_lo, 1'b0); +mux8 mux_pwr_hi (major_mode, pwr_hi, hr_pwr_hi, hs_pwr_hi, 1'b0, he_pwr_hi, hfl_pwr_hi, 1'b0, hrf_pwr_hi, 1'b0); +mux8 mux_adc_clk (major_mode, adc_clk, hr_adc_clk, hs_adc_clk, 1'b0, he_adc_clk, hfl_adc_clk, 1'b0, hrf_adc_clk, 1'b0); +mux8 mux_dbg (major_mode, dbg, hr_dbg, hs_dbg, 1'b0, he_dbg, hfl_dbg, 1'b0, 1'b0, 1'b0); + +// In all modes, let the ADC's outputs be enabled. +assign adc_noe = 1'b0; + +endmodule diff --git a/fpga-xc2s30/hi_read_fsk.v b/fpga-xc2s30/hi_read_fsk.v new file mode 100644 index 000000000..e45162111 --- /dev/null +++ b/fpga-xc2s30/hi_read_fsk.v @@ -0,0 +1,152 @@ +// lnv42, Jan 2020 +// reworked && integrated to RRG in Fev 2022 +// HF FSK reader (used for iso15 sniffing/reading) + +// output is the frequence divider from 13,56 MHz + +// (eg. for iso 15 two subcarriers mode (423,75 khz && 484,28 khz): it return 32 or 28) +// (423,75k = 13.56M / 32 and 484.28k = 13,56M / 28) + +module hi_read_fsk( + ck_1356meg, + pwr_lo, pwr_hi, pwr_oe1, pwr_oe2, pwr_oe3, pwr_oe4, + adc_d, adc_clk, + ssp_frame, ssp_din, ssp_clk, + subcarrier_frequency, minor_mode +); + + input ck_1356meg; + output pwr_lo, pwr_hi, pwr_oe1, pwr_oe2, pwr_oe3, pwr_oe4; + input [7:0] adc_d; + output adc_clk; + output ssp_frame, ssp_din, ssp_clk; + input [1:0]subcarrier_frequency; + input [3:0] minor_mode; + +assign adc_clk = ck_1356meg; // input sample frequency is 13,56 MHz + +assign power = subcarrier_frequency[0]; + +// Carrier is on if power is on, else is 0 +reg pwr_hi; +always @(ck_1356meg) +begin + if (power == `FPGA_HF_FSK_READER_WITHPOWER) + pwr_hi <= ck_1356meg; + else + pwr_hi <= 'b0; +end + +reg [7:0] adc_cnt = 8'd0; +reg [7:0] out1 = 8'd0; +reg [7:0] old = 8'd0; +reg [7:0] edge_id = 8'd0; +reg edge_started = 1'd0; +// Count clock edge between two signal edges +always @(negedge adc_clk) +begin + adc_cnt <= adc_cnt + 1'd1; + + if (& adc_d[7:5] && !(& old[7:5])) // up + begin + if (edge_started == 1'd0) // new edge starting + begin + if (edge_id <= adc_cnt) + out1 <= adc_cnt - edge_id; + else + out1 <= adc_cnt + 9'h100 - edge_id; + edge_id <= adc_cnt; + edge_started = 1'd1; + end + end + else + begin + edge_started = 1'd0; + if (edge_id <= adc_cnt) + begin + if (adc_cnt - edge_id > 8'd40) + begin + out1 <= 8'd0; + end + end + else + begin + if (adc_cnt + 9'h100 - edge_id > 8'd40) + begin + out1 <= 8'd0; + end + end + end + + old <= adc_d; +end + +// agregate out values (depending on selected output frequency) +reg [10:0] out_tmp = 11'd0; +reg [7:0] out = 8'd0; +always @(negedge adc_clk) +begin + out_tmp <= out_tmp + out1; + if (minor_mode == `FPGA_HF_FSK_READER_OUTPUT_848_KHZ && adc_cnt[0] == 1'd0) + begin // average on 2 values + out <= out_tmp[8:1]; + out_tmp <= 12'd0; + end + else if (minor_mode == `FPGA_HF_FSK_READER_OUTPUT_424_KHZ && adc_cnt[1:0] == 2'd0) + begin // average on 4 values + out <= out_tmp[9:2]; + out_tmp <= 12'd0; + end + else if (minor_mode == `FPGA_HF_FSK_READER_OUTPUT_212_KHZ && adc_cnt[2:0] == 3'd0) + begin // average on 8 values + out <= out_tmp[10:3]; + out_tmp <= 12'd0; + end + else // 1695_KHZ + out <= out1; +end + +// Set output (ssp) clock +(* clock_signal = "yes" *) reg ssp_clk; +always @(ck_1356meg) +begin + if (minor_mode == `FPGA_HF_FSK_READER_OUTPUT_1695_KHZ) + ssp_clk <= ~ck_1356meg; + else if (minor_mode == `FPGA_HF_FSK_READER_OUTPUT_848_KHZ) + ssp_clk <= ~adc_cnt[0]; + else if (minor_mode == `FPGA_HF_FSK_READER_OUTPUT_424_KHZ) + ssp_clk <= ~adc_cnt[1]; + else // 212 KHz + ssp_clk <= ~adc_cnt[2]; +end + +// Transmit output +reg ssp_frame; +reg [7:0] ssp_out = 8'd0; +reg [2:0] ssp_cnt = 4'd0; +always @(posedge ssp_clk) +begin + ssp_cnt <= ssp_cnt + 1'd1; + if(ssp_cnt == 3'd15) + begin + ssp_out <= out; + ssp_frame <= 1'b1; + end + else + begin + ssp_out <= {ssp_out[6:0], 1'b0}; + ssp_frame <= 1'b0; + end +end + +assign ssp_din = ssp_out[7]; + +// Unused. +assign pwr_oe4 = 1'b0; +assign pwr_oe1 = 1'b0; +assign pwr_oe3 = 1'b0; +assign pwr_lo = 1'b0; +assign pwr_oe2 = 1'b0; + +endmodule + diff --git a/fpga-xc2s30/xst_hf_15.scr b/fpga-xc2s30/xst_hf_15.scr new file mode 100644 index 000000000..d8bb5ae7c --- /dev/null +++ b/fpga-xc2s30/xst_hf_15.scr @@ -0,0 +1 @@ +run -ifn fpga_hf_15.v -ifmt Verilog -ofn fpga_hf_15.ngc -ofmt NGC -p xc2s30-5-vq100 -top fpga_hf_15 -opt_mode area -opt_level 2 -resource_sharing yes -fsm_style bram -fsm_encoding compact