github/RRG-Proxmark3
1
0
Fork 0
mirror of https://github.com/RfidResearchGroup/proxmark3.git synced 2025-08-20 05:13:46 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

iso15 sniffing: add support for dual subcarriers tag answers

Browse source
This commit is contained in:
Yann GASCUEL 2022-02-08 14:47:06 +01:00
commit 1f7bce5580
9 changed files with 792 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

2
armsrc/Makefile
View file

@ -103,7 +103,7 @@ endif
include Standalone/Makefile.inc
#the FPGA bitstream files. Note: order matters!
FPGA_BITSTREAMS = fpga_lf.bit fpga_hf.bit fpga_felica.bit
FPGA_BITSTREAMS = fpga_lf.bit fpga_hf.bit fpga_felica.bit fpga_hf_15.bit
#the lz4 source files required for decompressing the fpga config at run time
SRC_LZ4 = lz4.c

4
armsrc/fpgaloader.c
View file

@ -162,7 +162,7 @@ void FpgaSetupSsc(uint16_t fpga_mode) {
// 8, 16 or 32 bits per transfer, no loopback, MSB first, 1 transfer per sync
// pulse, no output sync
if ((fpga_mode & FPGA_MAJOR_MODE_MASK) == FPGA_MAJOR_MODE_HF_READER && FpgaGetCurrent() == FPGA_BITSTREAM_HF) {
if ((fpga_mode & FPGA_MAJOR_MODE_MASK) == FPGA_MAJOR_MODE_HF_READER && (FpgaGetCurrent() == FPGA_BITSTREAM_HF || FpgaGetCurrent() == FPGA_BITSTREAM_HF_15)) {
AT91C_BASE_SSC->SSC_RFMR = SSC_FRAME_MODE_BITS_IN_WORD(16) | AT91C_SSC_MSBF | SSC_FRAME_MODE_WORDS_PER_TRANSFER(0);
} else {
AT91C_BASE_SSC->SSC_RFMR = SSC_FRAME_MODE_BITS_IN_WORD(8) | AT91C_SSC_MSBF | SSC_FRAME_MODE_WORDS_PER_TRANSFER(0);
@ -612,7 +612,7 @@ void switch_off(void) {
Dbprintf("switch_off");
}
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
if (downloaded_bitstream == FPGA_BITSTREAM_HF) {
if (downloaded_bitstream == FPGA_BITSTREAM_HF || downloaded_bitstream == FPGA_BITSTREAM_HF_15) {
FpgaDisableSscDma();
}
set_tracing(false);

10
armsrc/fpgaloader.h
View file

@ -29,6 +29,7 @@
#define FPGA_BITSTREAM_LF 1
#define FPGA_BITSTREAM_HF 2
#define FPGA_BITSTREAM_HF_FELICA 3
#define FPGA_BITSTREAM_HF_15 4
/*
Communication between ARM / FPGA is done inside armsrc/fpgaloader.c (function FpgaSendCommand)
@ -77,6 +78,7 @@ thres| x x x x x x x x
#define FPGA_MAJOR_MODE_HF_SNIFF (3<<6) // D
#define FPGA_MAJOR_MODE_HF_ISO18092 (4<<6) // D
#define FPGA_MAJOR_MODE_HF_GET_TRACE (5<<6) // D
#define FPGA_MAJOR_MODE_HF_FSK_READER (6<<6) // D
// BOTH HF / LF
#define FPGA_MAJOR_MODE_OFF (7<<6) // D
@ -105,6 +107,14 @@ thres| x x x x x x x x
#define FPGA_HF_READER_SUBCARRIER_424_KHZ (1<<4)
#define FPGA_HF_READER_SUBCARRIER_212_KHZ (2<<4)
#define FPGA_HF_FSK_READER_OUTPUT_1695_KHZ (0<<0)
#define FPGA_HF_FSK_READER_OUTPUT_848_KHZ (1<<0)
#define FPGA_HF_FSK_READER_OUTPUT_424_KHZ (2<<0)
#define FPGA_HF_FSK_READER_OUTPUT_212_KHZ (3<<0)
#define FPGA_HF_FSK_READER_NOPOWER (0<<4)
#define FPGA_HF_FSK_READER_WITHPOWER (1<<4)
// Options for the HF simulated tag, how to modulate
#define FPGA_HF_SIMULATOR_NO_MODULATION 0x0 // 0000
#define FPGA_HF_SIMULATOR_MODULATE_BPSK 0x1 // 0001

348
armsrc/iso15693.c
View file

@ -1204,7 +1204,7 @@ void AcquireRawAdcSamplesIso15693(void) {
LEDsoff();
DbpString("Starting to acquire data...");
FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
FpgaDownloadAndGo(FPGA_BITSTREAM_HF_15);
BigBuf_free();
clear_trace();
@ -1259,12 +1259,274 @@ void AcquireRawAdcSamplesIso15693(void) {
LEDsoff();
}
//=============================================================================
// An ISO 15693 decoder for tag responses in FSK (two subcarriers) mode.
// Subcarriers frequencies are 424kHz and 484kHz (fc/32 and fc/28),
// LED handling:
// LED C -> ON once we have received the SOF and are expecting the rest.
// LED C -> OFF once we have received EOF or are unsynced
//
// Returns: true if we received a EOF
// false if we are still waiting for some more
//=============================================================================
#define DEBUG 0
#define FREQ_IS_484(f) (f >= 26 && f <= 30)
#define FREQ_IS_424(f) (f >= 30 && f <= 34)
#define FREQ_IS_0(f) (f <= 24 || f >= 36)
#define SEOF_COUNT(c, s) ((s) ? (c >= 11 && c <= 13) : (c >= 44 && c <= 52))
#define LOGIC_COUNT(c, s) ((s) ? (c >= 3 && c <= 6) : (c >= 13 && c <= 21))
#define MAX_COUNT(c, s) ((s) ? (c >= 13) : (c >= 52))
#define MIN_COUNT(c, s) ((s) ? (c <= 2) : (c <= 4))
typedef struct DecodeTagFSK {
enum {
STATE_FSK_BEFORE_SOF,
STATE_FSK_SOF_484,
STATE_FSK_SOF_424,
STATE_FSK_SOF_END,
STATE_FSK_RECEIVING_DATA_484,
STATE_FSK_RECEIVING_DATA_424,
STATE_FSK_EOF,
STATE_FSK_ERROR
} state;
enum {
LOGIC0_PART1,
LOGIC1_PART1,
LOGIC0_PART2,
LOGIC1_PART2,
SOF
} lastBit;
uint8_t count;
uint8_t bitCount;
uint8_t shiftReg;
uint16_t len;
uint16_t max_len;
uint8_t *output;
} DecodeTagFSK_t;
static void DecodeTagFSKReset(DecodeTagFSK_t *DecodeTag) {
DecodeTag->state = STATE_FSK_BEFORE_SOF;
DecodeTag->bitCount = 0;
DecodeTag->len = 0;
DecodeTag->shiftReg = 0;
DbpString("FSK tag reset");
}
static void DecodeTagFSKInit(DecodeTagFSK_t *DecodeTag, uint8_t *data, uint16_t max_len) {
DecodeTag->output = data;
DecodeTag->max_len = max_len;
DecodeTagFSKReset(DecodeTag);
}
// Performances of this function are crutial for stability
// as it is called in real time for every samples
static int inline __attribute__((always_inline)) Handle15693FSKSamplesFromTag(uint8_t freq, DecodeTagFSK_t *DecodeTag, bool recv_speed)
{
switch(DecodeTag->state) {
case STATE_FSK_BEFORE_SOF:
if (FREQ_IS_484(freq))
{ // possible SOF starting
DecodeTag->state = STATE_FSK_SOF_484;
DecodeTag->lastBit = LOGIC0_PART1;
DecodeTag->count = 1;
}
break;
case STATE_FSK_SOF_484:
//DbpString("STATE_FSK_SOF_484");
if (FREQ_IS_484(freq) && !MAX_COUNT(DecodeTag->count, recv_speed)) // still in SOF at 484
{
DecodeTag->count++;
}
else if (FREQ_IS_424(freq) && SEOF_COUNT(DecodeTag->count, recv_speed))
{ // SOF part1 continue at 424
DecodeTag->state = STATE_FSK_SOF_424;
DecodeTag->count = 1;
}
else // SOF failed, roll back
{
DecodeTag->state = STATE_FSK_BEFORE_SOF;
}
break;
case STATE_FSK_SOF_424:
//DbpString("STATE_FSK_SOF_424");
if (FREQ_IS_424(freq) && !MAX_COUNT(DecodeTag->count, recv_speed)) // still in SOF at 424
DecodeTag->count++;
else if (FREQ_IS_484(freq) && SEOF_COUNT(DecodeTag->count, recv_speed))
{ // SOF part 1 finished
DecodeTag->state = STATE_FSK_SOF_END;
DecodeTag->count = 1;
}
else // SOF failed, roll back
{
if (DEBUG)
Dbprintf("SOF_424 failed: freq=%d, count=%d, recv_speed=%d", freq, DecodeTag->count, recv_speed);
DecodeTag->state = STATE_FSK_BEFORE_SOF;
}
break;
case STATE_FSK_SOF_END:
if (FREQ_IS_484(freq) && !MAX_COUNT(DecodeTag->count, recv_speed)) // still in SOF_END (484)
DecodeTag->count++;
else if (FREQ_IS_424(freq) && LOGIC_COUNT(DecodeTag->count, recv_speed))
{ // SOF END finished or SOF END 1st part finished
DecodeTag->count = 0;
if (DecodeTag->lastBit == SOF)
{ // SOF finished at 424
if (DEBUG)
DbpString("Receiving data !");
DecodeTag->state = STATE_FSK_RECEIVING_DATA_424;
LED_C_ON();
}
DecodeTag->lastBit = SOF;
}
else if (FREQ_IS_424(freq) && !MAX_COUNT(DecodeTag->count, recv_speed)) // still in SOF_END (424)
DecodeTag->count++;
else if (DecodeTag->lastBit == SOF && FREQ_IS_484(freq) &&
LOGIC_COUNT(DecodeTag->count, recv_speed))
{ // SOF finished at 484
DecodeTag->state = STATE_FSK_RECEIVING_DATA_484;
DecodeTag->count = 1;
LED_C_ON();
}
else // SOF failed, roll back
{
if (DEBUG)
Dbprintf("SOF_END failed: freq=%d, count=%d, recv_speed=%d", freq, DecodeTag->count, recv_speed);
DecodeTag->state = STATE_FSK_BEFORE_SOF;
}
break;
case STATE_FSK_RECEIVING_DATA_424:
if (DecodeTag->lastBit == LOGIC1_PART1 &&
LOGIC_COUNT(DecodeTag->count, recv_speed))
{ // logic 1 finished
DecodeTag->lastBit = LOGIC1_PART2;
DecodeTag->count = 0;
DecodeTag->shiftReg >>= 1;
DecodeTag->shiftReg |= 0x80;
DecodeTag->bitCount++;
if (DecodeTag->bitCount == 8) {
DecodeTag->output[DecodeTag->len++] = DecodeTag->shiftReg;
if (DecodeTag->len > DecodeTag->max_len) {
// buffer overflow, give up
LED_C_OFF();
return true;
}
DecodeTag->bitCount = 0;
DecodeTag->shiftReg = 0;
}
}
else if (FREQ_IS_424(freq) && !MAX_COUNT(DecodeTag->count, recv_speed)) // still at 424
DecodeTag->count++;
else if (FREQ_IS_484(freq) && LOGIC_COUNT(DecodeTag->count, recv_speed) &&
DecodeTag->lastBit >= LOGIC0_PART2)
{ // end of LOGIC0_PART1
DecodeTag->count = 1;
DecodeTag->state = STATE_FSK_RECEIVING_DATA_484;
DecodeTag->lastBit = LOGIC0_PART1;
}
else if (FREQ_IS_484(freq) && MIN_COUNT(DecodeTag->count, recv_speed))
{ // it was just the end of the previous block
DecodeTag->count = 1;
DecodeTag->state = STATE_FSK_RECEIVING_DATA_484;
}
else if (FREQ_IS_484(freq) && DecodeTag->lastBit == LOGIC0_PART2 &&
SEOF_COUNT(DecodeTag->count, recv_speed))
{ // EOF has started
if (DEBUG)
Dbprintf("RECEIVING_DATA_424 failed: freq=%d, count=%d, recv_speed=%d", freq, DecodeTag->count, recv_speed);
DecodeTag->count = 1;
DecodeTag->state = STATE_FSK_EOF;
LED_C_OFF();
}
else // error
{
if (DEBUG)
Dbprintf("RECEIVING_DATA_424 error: freq=%d, count=%d, recv_speed=%d", freq, DecodeTag->count, recv_speed);
DecodeTag->state = STATE_FSK_ERROR;
LED_C_OFF();
return true;
}
break;
case STATE_FSK_RECEIVING_DATA_484:
if (DecodeTag->lastBit == LOGIC0_PART1 &&
LOGIC_COUNT(DecodeTag->count, recv_speed))
{ // logic 0 finished
DecodeTag->lastBit = LOGIC0_PART2;
DecodeTag->count = 0;
DecodeTag->shiftReg >>= 1;
DecodeTag->bitCount++;
if (DecodeTag->bitCount == 8) {
DecodeTag->output[DecodeTag->len++] = DecodeTag->shiftReg;
if (DecodeTag->len > DecodeTag->max_len) {
// buffer overflow, give up
LED_C_OFF();
return true;
}
DecodeTag->bitCount = 0;
DecodeTag->shiftReg = 0;
}
}
else if (FREQ_IS_484(freq) && !MAX_COUNT(DecodeTag->count, recv_speed)) // still at 484
DecodeTag->count++;
else if (FREQ_IS_424(freq) && LOGIC_COUNT(DecodeTag->count, recv_speed) &&
DecodeTag->lastBit >= LOGIC0_PART2)
{ // end of LOGIC1_PART1
DecodeTag->count = 1;
DecodeTag->state = STATE_FSK_RECEIVING_DATA_424;
DecodeTag->lastBit = LOGIC1_PART1;
}
else if (FREQ_IS_424(freq) && MIN_COUNT(DecodeTag->count, recv_speed))
{ // it was just the end of the previous block
DecodeTag->count = 1;
DecodeTag->state = STATE_FSK_RECEIVING_DATA_424;
}
else // error
{
if (DEBUG)
Dbprintf("RECEIVING_DATA_484 error: freq=%d, count=%d, recv_speed=%d", freq, DecodeTag->count, recv_speed);
LED_C_OFF();
DecodeTag->state = STATE_FSK_ERROR;
return true;
}
break;
case STATE_FSK_EOF:
if (FREQ_IS_484(freq) && !MAX_COUNT(DecodeTag->count, recv_speed)) // still at 484
{
DecodeTag->count++;
if (SEOF_COUNT(DecodeTag->count, recv_speed))
return true; // end of the transmission
}
else // error
{
if (DEBUG)
Dbprintf("EOF error: freq=%d, count=%d, recv_speed=%d", freq, DecodeTag->count, recv_speed);
DecodeTag->state = STATE_FSK_ERROR;
return true;
}
break;
case STATE_FSK_ERROR:
LED_C_OFF();
return true; // error
break;
}
return false;
}
void SniffIso15693(uint8_t jam_search_len, uint8_t *jam_search_string) {
LEDsoff();
LED_A_ON();
FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
FpgaDownloadAndGo(FPGA_BITSTREAM_HF_15);
DbpString("Starting to sniff. Press PM3 Button to stop.");
@ -1276,6 +1538,10 @@ void SniffIso15693(uint8_t jam_search_len, uint8_t *jam_search_string) {
uint8_t response[ISO15693_MAX_RESPONSE_LENGTH] = {0};
DecodeTagInit(&dtag, response, sizeof(response));
DecodeTagFSK_t dtagfsk = {0};
uint8_t response2[ISO15693_MAX_RESPONSE_LENGTH] = {0};
DecodeTagFSKInit(&dtagfsk, response2, sizeof(response2));
DecodeReader_t dreader = {0};
uint8_t cmd[ISO15693_MAX_COMMAND_LENGTH] = {0};
DecodeReaderInit(&dreader, cmd, sizeof(cmd), jam_search_len, jam_search_string);
@ -1301,6 +1567,8 @@ void SniffIso15693(uint8_t jam_search_len, uint8_t *jam_search_string) {
bool tag_is_active = false;
bool reader_is_active = false;
bool expect_tag_answer = false;
bool expect_fsk_answer = false;
bool expect_fast_answer = false;
int dma_start_time = 0;
// Count of samples received so far, so that we can include timing
@ -1361,13 +1629,20 @@ void SniffIso15693(uint8_t jam_search_len, uint8_t *jam_search_string) {
- 32 * 16 // time for SOF transfer
- 16 * 16; // time for EOF transfer
LogTrace_ISO15693(dreader.output, dreader.byteCount, (sof_time * 4), (eof_time * 4), NULL, true);
expect_fsk_answer = dreader.output[0] & ISO15_REQ_SUBCARRIER_TWO;
expect_fast_answer = dreader.output[0] & ISO15_REQ_DATARATE_HIGH;
}
// And ready to receive another command.
DecodeReaderReset(&dreader);
DecodeTagReset(&dtag);
DecodeTagFSKReset(&dtagfsk);
reader_is_active = false;
expect_tag_answer = true;
if (expect_fsk_answer)
{
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_FSK_READER | FPGA_HF_FSK_READER_OUTPUT_212_KHZ | FPGA_HF_FSK_READER_NOPOWER);
}
} else if (Handle15693SampleFromReader(sniffdata & 0x01, &dreader)) {
uint32_t eof_time = dma_start_time + (samples * 16) + 16 - DELAY_READER_TO_ARM_SNIFF; // end of EOF
@ -1377,13 +1652,21 @@ void SniffIso15693(uint8_t jam_search_len, uint8_t *jam_search_string) {
- 32 * 16 // time for SOF transfer
- 16 * 16; // time for EOF transfer
LogTrace_ISO15693(dreader.output, dreader.byteCount, (sof_time * 4), (eof_time * 4), NULL, true);
expect_fsk_answer = dreader.output[0] & ISO15_REQ_SUBCARRIER_TWO;
expect_fast_answer = dreader.output[0] & ISO15_REQ_DATARATE_HIGH;
}
// And ready to receive another command
DecodeReaderReset(&dreader);
DecodeTagReset(&dtag);
DecodeTagFSKReset(&dtagfsk);
reader_is_active = false;
expect_tag_answer = true;
if (expect_fsk_answer)
{
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_FSK_READER | FPGA_HF_FSK_READER_OUTPUT_212_KHZ | FPGA_HF_FSK_READER_NOPOWER);
}
} else {
reader_is_active = (dreader.state >= STATE_READER_RECEIVE_DATA_1_OUT_OF_4);
}
@ -1391,6 +1674,8 @@ void SniffIso15693(uint8_t jam_search_len, uint8_t *jam_search_string) {
if (reader_is_active == false && expect_tag_answer) { // no need to try decoding tag data if the reader is currently sending or no answer expected yet
if (!expect_fsk_answer)
{
if (Handle15693SamplesFromTag(sniffdata >> 2, &dtag)) {
uint32_t eof_time = dma_start_time + (samples * 16) - DELAY_TAG_TO_ARM_SNIFF; // end of EOF
@ -1405,6 +1690,7 @@ void SniffIso15693(uint8_t jam_search_len, uint8_t *jam_search_string) {
LogTrace_ISO15693(dtag.output, dtag.len, (sof_time * 4), (eof_time * 4), NULL, false);
// And ready to receive another response.
DecodeTagReset(&dtag);
DecodeTagFSKReset(&dtagfsk);
DecodeReaderReset(&dreader);
expect_tag_answer = false;
tag_is_active = false;
@ -1412,6 +1698,55 @@ void SniffIso15693(uint8_t jam_search_len, uint8_t *jam_search_string) {
tag_is_active = (dtag.state >= STATE_TAG_RECEIVING_DATA);
}
}
else
{
if (Handle15693FSKSamplesFromTag(sniffdata >> 8, &dtagfsk, expect_fast_answer)) {
uint32_t eof_time = dma_start_time + (samples * 16) - DELAY_TAG_TO_ARM_SNIFF; // end of EOF
if (dtagfsk.lastBit == SOF) {
eof_time -= (8 * 16); // needed 8 additional samples to confirm single SOF (iCLASS)
}
uint32_t sof_time = eof_time
- dtagfsk.len * 8 * 8 * 16 // time for byte transfers
- (32 * 16) // time for SOF transfer
- (dtagfsk.lastBit != SOF ? (32 * 16) : 0); // time for EOF transfer
LogTrace_ISO15693(dtagfsk.output, dtagfsk.len, (sof_time * 4), (eof_time * 4), NULL, false);
// And ready to receive another response.
DecodeTagFSKReset(&dtagfsk);
DecodeTagReset(&dtag);
DecodeReaderReset(&dreader);
expect_tag_answer = false;
tag_is_active = false;
expect_fsk_answer = false;
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER | FPGA_HF_READER_MODE_SNIFF_AMPLITUDE);
}
else if (Handle15693FSKSamplesFromTag(sniffdata & 0xFF, &dtagfsk, expect_fast_answer)) {
uint32_t eof_time = dma_start_time + (samples * 16) - DELAY_TAG_TO_ARM_SNIFF; // end of EOF
if (dtagfsk.lastBit == SOF) {
eof_time -= (8 * 16); // needed 8 additional samples to confirm single SOF (iCLASS)
}
uint32_t sof_time = eof_time
- dtagfsk.len * 8 * 8 * 16 // time for byte transfers
- (32 * 16) // time for SOF transfer
- (dtagfsk.lastBit != SOF ? (32 * 16) : 0); // time for EOF transfer
LogTrace_ISO15693(dtagfsk.output, dtagfsk.len, (sof_time * 4), (eof_time * 4), NULL, false);
// And ready to receive another response.
DecodeTagFSKReset(&dtagfsk);
DecodeTagReset(&dtag);
DecodeReaderReset(&dreader);
expect_tag_answer = false;
tag_is_active = false;
expect_fsk_answer = false;
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER | FPGA_HF_READER_MODE_SNIFF_AMPLITUDE);
} else {
tag_is_active = (dtagfsk.state >= STATE_FSK_RECEIVING_DATA_484);
}
}
}
}
@ -1424,6 +1759,9 @@ void SniffIso15693(uint8_t jam_search_len, uint8_t *jam_search_string) {
Dbprintf(" DecodeTag State........%d", dtag.state);
Dbprintf(" DecodeTag byteCnt......%d", dtag.len);
Dbprintf(" DecodeTag posCount.....%d", dtag.posCount);
Dbprintf(" DecodeTagFSK State........%d", dtagfsk.state);
Dbprintf(" DecodeTagFSK byteCnt......%d", dtagfsk.len);
Dbprintf(" DecodeTagFSK count.....%d", dtagfsk.count);
Dbprintf(" DecodeReader State.....%d", dreader.state);
Dbprintf(" DecodeReader byteCnt...%d", dreader.byteCount);
Dbprintf(" DecodeReader posCount..%d", dreader.posCount);
@ -1436,7 +1774,7 @@ void SniffIso15693(uint8_t jam_search_len, uint8_t *jam_search_string) {
void Iso15693InitReader(void) {
LEDsoff();
FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
FpgaDownloadAndGo(FPGA_BITSTREAM_HF_15);
// Start from off (no field generated)
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
@ -1679,7 +2017,7 @@ void ReaderIso15693(uint32_t parameter, iso15_card_select_t *p_card) {
// When SIM: initialize the Proxmark3 as ISO15693 tag
void Iso15693InitTag(void) {
FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
FpgaDownloadAndGo(FPGA_BITSTREAM_HF_15);
// Start from off (no field generated)
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);

9
fpga-xc2s30/Makefile
View file

@ -5,9 +5,9 @@ RMDIR = rm -rf
# rmdir only if dir is empty, tolerate failure
RMDIR_SOFT = -rmdir
#
all: fpga_lf.bit fpga_hf.bit fpga_felica.bit
all: fpga_lf.bit fpga_hf.bit fpga_felica.bit fpga_hf_15.bit
clean:
$(Q)$(RM) *.bgn *.drc *.ncd *.ngd *_par.xrpt *-placed.* *-placed_pad.* *_usage.xml xst_hf.srp xst_lf.srp xst_felica.srp
$(Q)$(RM) *.bgn *.drc *.ncd *.ngd *_par.xrpt *-placed.* *-placed_pad.* *_usage.xml xst_hf.srp xst_lf.srp xst_felica.srp xst_hf_15.srp
$(Q)$(RM) *.map *.ngc *.xrpt *.pcf *.rbt *.bld *.mrp *.ngm *.unroutes *_summary.xml netlist.lst
$(Q)$(RMDIR) *_auto_* xst
@ -22,6 +22,11 @@ fpga_felica.ngc: fpga_felica.v fpga.ucf xst_felica.scr util.v hi_simulate.v hi_r
$(info [-] XST $@)
$(Q)$(XILINX_TOOLS_PREFIX)xst -ifn xst_felica.scr
fpga_hf_15.ngc: fpga_hf_15.v fpga.ucf xst_hf.scr util.v hi_simulate.v hi_reader.v hi_iso14443a.v hi_sniffer.v hi_get_trace.v hi_read_fsk.v
$(Q)$(RM) $@
$(info [-] XST $@)
$(Q)$(XILINX_TOOLS_PREFIX)xst -ifn xst_hf_15.scr
fpga_lf.ngc: fpga_lf.v fpga.ucf xst_lf.scr util.v clk_divider.v lo_edge_detect.v lo_read.v lo_passthru.v lp20khz_1MSa_iir_filter.v min_max_tracker.v lf_edge_detect.v
$(Q)$(RM) $@
$(info [-] XST $@)

BIN
fpga-xc2s30/fpga_hf_15.bit Normal file
View file

Binary file not shown.

260
fpga-xc2s30/fpga_hf_15.v Normal file
View file

@ -0,0 +1,260 @@
//-----------------------------------------------------------------------------
// The FPGA is responsible for interfacing between the A/D, the coil drivers,
// and the ARM. In the low-frequency modes it passes the data straight
// through, so that the ARM gets raw A/D samples over the SSP. In the high-
// frequency modes, the FPGA might perform some demodulation first, to
// reduce the amount of data that we must send to the ARM.
//
// I am not really an FPGA/ASIC designer, so I am sure that a lot of this
// could be improved.
//
// Jonathan Westhues, March 2006
// Added ISO14443-A support by Gerhard de Koning Gans, April 2008
// iZsh <izsh at fail0verflow.com>, June 2014
// Piwi, Feb 2019
//-----------------------------------------------------------------------------
// Defining commands, modes and options. This must be aligned to the definitions in fpgaloader.h
// Note: the definitions here are without shifts
// Commands:
`define FPGA_CMD_SET_CONFREG 1
`define FPGA_CMD_TRACE_ENABLE 2
// Major modes:
`define FPGA_MAJOR_MODE_HF_READER 0
`define FPGA_MAJOR_MODE_HF_SIMULATOR 1
`define FPGA_MAJOR_MODE_HF_ISO14443A 2
`define FPGA_MAJOR_MODE_HF_SNIFF 3
`define FPGA_MAJOR_MODE_HF_ISO18092 4
`define FPGA_MAJOR_MODE_HF_GET_TRACE 5
`define FPGA_MAJOR_MODE_HF_FSK_READER 6
`define FPGA_MAJOR_MODE_OFF 7
// Options for the generic HF reader
`define FPGA_HF_READER_MODE_RECEIVE_IQ 0
`define FPGA_HF_READER_MODE_RECEIVE_AMPLITUDE 1
`define FPGA_HF_READER_MODE_RECEIVE_PHASE 2
`define FPGA_HF_READER_MODE_SEND_FULL_MOD 3
`define FPGA_HF_READER_MODE_SEND_SHALLOW_MOD 4
`define FPGA_HF_READER_MODE_SNIFF_IQ 5
`define FPGA_HF_READER_MODE_SNIFF_AMPLITUDE 6
`define FPGA_HF_READER_MODE_SNIFF_PHASE 7
`define FPGA_HF_READER_MODE_SEND_JAM 8
`define FPGA_HF_READER_SUBCARRIER_848_KHZ 0
`define FPGA_HF_READER_SUBCARRIER_424_KHZ 1
`define FPGA_HF_READER_SUBCARRIER_212_KHZ 2
`define FPGA_HF_FSK_READER_OUTPUT_1695_KHZ 0
`define FPGA_HF_FSK_READER_OUTPUT_848_KHZ 1
`define FPGA_HF_FSK_READER_OUTPUT_424_KHZ 2
`define FPGA_HF_FSK_READER_OUTPUT_212_KHZ 3
`define FPGA_HF_FSK_READER_NOPOWER 0
`define FPGA_HF_FSK_READER_WITHPOWER 1
// Options for the HF simulated tag, how to modulate
`define FPGA_HF_SIMULATOR_NO_MODULATION 0
`define FPGA_HF_SIMULATOR_MODULATE_BPSK 1
`define FPGA_HF_SIMULATOR_MODULATE_212K 2
`define FPGA_HF_SIMULATOR_MODULATE_424K 4
`define FPGA_HF_SIMULATOR_MODULATE_424K_8BIT 5
// Options for ISO14443A
`define FPGA_HF_ISO14443A_SNIFFER 0
`define FPGA_HF_ISO14443A_TAGSIM_LISTEN 1
`define FPGA_HF_ISO14443A_TAGSIM_MOD 2
`define FPGA_HF_ISO14443A_READER_LISTEN 3
`define FPGA_HF_ISO14443A_READER_MOD 4
//options for ISO18092 / Felica
`define FPGA_HF_ISO18092_FLAG_NOMOD 1 // 0001 disable modulation module
`define FPGA_HF_ISO18092_FLAG_424K 2 // 0010 should enable 414k mode (untested). No autodetect
`define FPGA_HF_ISO18092_FLAG_READER 4 // 0100 enables antenna power, to act as a reader instead of tag
`include "hi_reader.v"
`include "hi_simulate.v"
//`include "hi_iso14443a.v"
`include "hi_sniffer.v"
`include "util.v"
// `include "hi_flite.v"
`include "hi_get_trace.v"
`include "hi_read_fsk.v"
module fpga_hf_15(
input spck, output miso, input mosi, input ncs,
input pck0, input ck_1356meg, input ck_1356megb,
output pwr_lo, output pwr_hi,
output pwr_oe1, output pwr_oe2, output pwr_oe3, output pwr_oe4,
input [7:0] adc_d, output adc_clk, output adc_noe,
output ssp_frame, output ssp_din, input ssp_dout, output ssp_clk,
input cross_hi, input cross_lo,
output dbg
);
//-----------------------------------------------------------------------------
// The SPI receiver. This sets up the configuration word, which the rest of
// the logic looks at to determine how to connect the A/D and the coil
// drivers (i.e., which section gets it). Also assign some symbolic names
// to the configuration bits, for use below.
//-----------------------------------------------------------------------------
/*
Attempt to write up how its hooked up.
/ Iceman, 2020
Communication between ARM / FPGA is done inside armsrc/fpgaloader.c see: function FpgaSendCommand()
Send 16 bit command / data pair to FPGA
The bit format is: C3 C2 C1 C0 D11 D10 D9 D8 D7 D6 D5 D4 D3 D2 D1 D0
where
C is 4bit command
D is 12bit data
shift_reg receive this 16bit frame
-----+--------- frame layout --------------------
bit | 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
-----+-------------------------------------------
cmd | x x x x
major| x x x
opt | x x x x
sub | x x
divi | x x x x x x x x
thres| x x x x x x x x
-----+-------------------------------------------
*/
reg [15:0] shift_reg;
reg [8:0] conf_word;
reg trace_enable;
// We switch modes between transmitting to the 13.56 MHz tag and receiving
// from it, which means that we must make sure that we can do so without
// glitching, or else we will glitch the transmitted carrier.
always @(posedge ncs)
begin
case(shift_reg[15:12])
`FPGA_CMD_SET_CONFREG: conf_word <= shift_reg[8:0];
`FPGA_CMD_TRACE_ENABLE: trace_enable <= shift_reg[0];
endcase
end
always @(posedge spck)
begin
if(~ncs)
begin
shift_reg[15:1] <= shift_reg[14:0];
shift_reg[0] <= mosi;
end
end
// select module (outputs) based on major mode
wire [2:0] major_mode = conf_word[8:6];
// configuring the HF reader
wire [1:0] subcarrier_frequency = conf_word[5:4];
wire [3:0] minor_mode = conf_word[3:0];
//-----------------------------------------------------------------------------
// And then we instantiate the modules corresponding to each of the FPGA's
// major modes, and use muxes to connect the outputs of the active mode to
// the output pins.
//-----------------------------------------------------------------------------
// 000 - HF reader
hi_reader hr(
ck_1356megb,
hr_pwr_lo, hr_pwr_hi, hr_pwr_oe1, hr_pwr_oe2, hr_pwr_oe3, hr_pwr_oe4,
adc_d, hr_adc_clk,
hr_ssp_frame, hr_ssp_din, ssp_dout, hr_ssp_clk,
hr_dbg,
subcarrier_frequency, minor_mode
);
// 001 - HF simulated tag
hi_simulate hs(
ck_1356meg,
hs_pwr_lo, hs_pwr_hi, hs_pwr_oe1, hs_pwr_oe2, hs_pwr_oe3, hs_pwr_oe4,
adc_d, hs_adc_clk,
hs_ssp_frame, hs_ssp_din, ssp_dout, hs_ssp_clk,
hs_dbg,
minor_mode
);
/*// 010 - HF ISO14443-A
hi_iso14443a hisn(
ck_1356meg,
hisn_pwr_lo, hisn_pwr_hi, hisn_pwr_oe1, hisn_pwr_oe2, hisn_pwr_oe3, hisn_pwr_oe4,
adc_d, hisn_adc_clk,
hisn_ssp_frame, hisn_ssp_din, ssp_dout, hisn_ssp_clk,
hisn_dbg,
minor_mode
);*/
// 011 - HF sniff
hi_sniffer he(
ck_1356megb,
he_pwr_lo, he_pwr_hi, he_pwr_oe1, he_pwr_oe2, he_pwr_oe3, he_pwr_oe4,
adc_d, he_adc_clk,
he_ssp_frame, he_ssp_din, he_ssp_clk
);
// 100 - HF ISO18092 FeliCa
/*
hi_flite hfl(
ck_1356megb,
hfl_pwr_lo, hfl_pwr_hi, hfl_pwr_oe1, hfl_pwr_oe2, hfl_pwr_oe3, hfl_pwr_oe4,
adc_d, hfl_adc_clk,
hfl_ssp_frame, hfl_ssp_din, ssp_dout, hfl_ssp_clk,
hfl_dbg,
minor_mode
);
*/
// 101 - HF get trace
hi_get_trace gt(
ck_1356megb,
adc_d, trace_enable, major_mode,
gt_ssp_frame, gt_ssp_din, gt_ssp_clk
);
// 110 - HF Read FSK
hi_read_fsk hrf(
ck_1356meg,
hrf_pwr_lo, hrf_pwr_hi, hrf_pwr_oe1, hrf_pwr_oe2, hrf_pwr_oe3, hrf_pwr_oe4,
adc_d, hrf_adc_clk,
hrf_ssp_frame, hrf_ssp_din, hrf_ssp_clk,
subcarrier_frequency, minor_mode
);
// Major modes:
// 000 -- HF reader; subcarrier frequency and modulation depth selectable
// 001 -- HF simulated tag
// 010 -- HF ISO14443-A
// 011 -- HF sniff
// 100 -- HF ISO18092 FeliCa
// 101 -- HF get trace
// 110 -- HF Read FSK
// 111 -- FPGA_MAJOR_MODE_OFF
// 000 001 010 011 100 101 110 111
mux8 mux_ssp_clk (major_mode, ssp_clk, hr_ssp_clk, hs_ssp_clk, 1'b0, he_ssp_clk, hfl_ssp_clk, gt_ssp_clk, hrf_ssp_clk, 1'b0);
mux8 mux_ssp_din (major_mode, ssp_din, hr_ssp_din, hs_ssp_din, 1'b0, he_ssp_din, hfl_ssp_din, gt_ssp_din, hrf_ssp_din, 1'b0);
mux8 mux_ssp_frame (major_mode, ssp_frame, hr_ssp_frame, hs_ssp_frame, 1'b0, he_ssp_frame, hfl_ssp_frame, gt_ssp_frame, hrf_ssp_frame, 1'b0);
mux8 mux_pwr_oe1 (major_mode, pwr_oe1, hr_pwr_oe1, hs_pwr_oe1, 1'b0, he_pwr_oe1, hfl_pwr_oe1, 1'b0, hrf_pwr_oe1, 1'b0);
mux8 mux_pwr_oe2 (major_mode, pwr_oe2, hr_pwr_oe2, hs_pwr_oe2, 1'b0, he_pwr_oe2, hfl_pwr_oe2, 1'b0, hrf_pwr_oe2, 1'b0);
mux8 mux_pwr_oe3 (major_mode, pwr_oe3, hr_pwr_oe3, hs_pwr_oe3, 1'b0, he_pwr_oe3, hfl_pwr_oe3, 1'b0, hrf_pwr_oe3, 1'b0);
mux8 mux_pwr_oe4 (major_mode, pwr_oe4, hr_pwr_oe4, hs_pwr_oe4, 1'b0, he_pwr_oe4, hfl_pwr_oe4, 1'b0, hrf_pwr_oe4, 1'b0);
mux8 mux_pwr_lo (major_mode, pwr_lo, hr_pwr_lo, hs_pwr_lo, 1'b0, he_pwr_lo, hfl_pwr_lo, 1'b0, hrf_pwr_lo, 1'b0);
mux8 mux_pwr_hi (major_mode, pwr_hi, hr_pwr_hi, hs_pwr_hi, 1'b0, he_pwr_hi, hfl_pwr_hi, 1'b0, hrf_pwr_hi, 1'b0);
mux8 mux_adc_clk (major_mode, adc_clk, hr_adc_clk, hs_adc_clk, 1'b0, he_adc_clk, hfl_adc_clk, 1'b0, hrf_adc_clk, 1'b0);
mux8 mux_dbg (major_mode, dbg, hr_dbg, hs_dbg, 1'b0, he_dbg, hfl_dbg, 1'b0, 1'b0, 1'b0);
// In all modes, let the ADC's outputs be enabled.
assign adc_noe = 1'b0;
endmodule

152
fpga-xc2s30/hi_read_fsk.v Normal file
View file

@ -0,0 +1,152 @@
// lnv42, Jan 2020
// reworked && integrated to RRG in Fev 2022
// HF FSK reader (used for iso15 sniffing/reading)
// output is the frequence divider from 13,56 MHz
// (eg. for iso 15 two subcarriers mode (423,75 khz && 484,28 khz): it return 32 or 28)
// (423,75k = 13.56M / 32 and 484.28k = 13,56M / 28)
module hi_read_fsk(
ck_1356meg,
pwr_lo, pwr_hi, pwr_oe1, pwr_oe2, pwr_oe3, pwr_oe4,
adc_d, adc_clk,
ssp_frame, ssp_din, ssp_clk,
subcarrier_frequency, minor_mode
);
input ck_1356meg;
output pwr_lo, pwr_hi, pwr_oe1, pwr_oe2, pwr_oe3, pwr_oe4;
input [7:0] adc_d;
output adc_clk;
output ssp_frame, ssp_din, ssp_clk;
input [1:0]subcarrier_frequency;
input [3:0] minor_mode;
assign adc_clk = ck_1356meg; // input sample frequency is 13,56 MHz
assign power = subcarrier_frequency[0];
// Carrier is on if power is on, else is 0
reg pwr_hi;
always @(ck_1356meg)
begin
if (power == `FPGA_HF_FSK_READER_WITHPOWER)
pwr_hi <= ck_1356meg;
else
pwr_hi <= 'b0;
end
reg [7:0] adc_cnt = 8'd0;
reg [7:0] out1 = 8'd0;
reg [7:0] old = 8'd0;
reg [7:0] edge_id = 8'd0;
reg edge_started = 1'd0;
// Count clock edge between two signal edges
always @(negedge adc_clk)
begin
adc_cnt <= adc_cnt + 1'd1;
if (& adc_d[7:5] && !(& old[7:5])) // up
begin
if (edge_started == 1'd0) // new edge starting
begin
if (edge_id <= adc_cnt)
out1 <= adc_cnt - edge_id;
else
out1 <= adc_cnt + 9'h100 - edge_id;
edge_id <= adc_cnt;
edge_started = 1'd1;
end
end
else
begin
edge_started = 1'd0;
if (edge_id <= adc_cnt)
begin
if (adc_cnt - edge_id > 8'd40)
begin
out1 <= 8'd0;
end
end
else
begin
if (adc_cnt + 9'h100 - edge_id > 8'd40)
begin
out1 <= 8'd0;
end
end
end
old <= adc_d;
end
// agregate out values (depending on selected output frequency)
reg [10:0] out_tmp = 11'd0;
reg [7:0] out = 8'd0;
always @(negedge adc_clk)
begin
out_tmp <= out_tmp + out1;
if (minor_mode == `FPGA_HF_FSK_READER_OUTPUT_848_KHZ && adc_cnt[0] == 1'd0)
begin // average on 2 values
out <= out_tmp[8:1];
out_tmp <= 12'd0;
end
else if (minor_mode == `FPGA_HF_FSK_READER_OUTPUT_424_KHZ && adc_cnt[1:0] == 2'd0)
begin // average on 4 values
out <= out_tmp[9:2];
out_tmp <= 12'd0;
end
else if (minor_mode == `FPGA_HF_FSK_READER_OUTPUT_212_KHZ && adc_cnt[2:0] == 3'd0)
begin // average on 8 values
out <= out_tmp[10:3];
out_tmp <= 12'd0;
end
else // 1695_KHZ
out <= out1;
end
// Set output (ssp) clock
(* clock_signal = "yes" *) reg ssp_clk;
always @(ck_1356meg)
begin
if (minor_mode == `FPGA_HF_FSK_READER_OUTPUT_1695_KHZ)
ssp_clk <= ~ck_1356meg;
else if (minor_mode == `FPGA_HF_FSK_READER_OUTPUT_848_KHZ)
ssp_clk <= ~adc_cnt[0];
else if (minor_mode == `FPGA_HF_FSK_READER_OUTPUT_424_KHZ)
ssp_clk <= ~adc_cnt[1];
else // 212 KHz
ssp_clk <= ~adc_cnt[2];
end
// Transmit output
reg ssp_frame;
reg [7:0] ssp_out = 8'd0;
reg [2:0] ssp_cnt = 4'd0;
always @(posedge ssp_clk)
begin
ssp_cnt <= ssp_cnt + 1'd1;
if(ssp_cnt == 3'd15)
begin
ssp_out <= out;
ssp_frame <= 1'b1;
end
else
begin
ssp_out <= {ssp_out[6:0], 1'b0};
ssp_frame <= 1'b0;
end
end
assign ssp_din = ssp_out[7];
// Unused.
assign pwr_oe4 = 1'b0;
assign pwr_oe1 = 1'b0;
assign pwr_oe3 = 1'b0;
assign pwr_lo = 1'b0;
assign pwr_oe2 = 1'b0;
endmodule

1
fpga-xc2s30/xst_hf_15.scr Normal file
View file

@ -0,0 +1 @@
run -ifn fpga_hf_15.v -ifmt Verilog -ofn fpga_hf_15.ngc -ofmt NGC -p xc2s30-5-vq100 -top fpga_hf_15 -opt_mode area -opt_level 2 -resource_sharing yes -fsm_style bram -fsm_encoding compact