]>
Commit | Line | Data |
---|---|---|
6658905f | 1 | //----------------------------------------------------------------------------- |
2 | // ISO14443-A support for the Proxmark III | |
3 | // Gerhard de Koning Gans, April 2008 | |
4 | //----------------------------------------------------------------------------- | |
5 | ||
7bc95e2e | 6 | // constants for the different modes: |
7 | `define SNIFFER 3'b000 | |
8 | `define TAGSIM_LISTEN 3'b001 | |
9 | `define TAGSIM_MOD 3'b010 | |
10 | `define READER_LISTEN 3'b011 | |
11 | `define READER_MOD 3'b100 | |
12 | ||
6658905f | 13 | module hi_iso14443a( |
14 | pck0, ck_1356meg, ck_1356megb, | |
15 | pwr_lo, pwr_hi, pwr_oe1, pwr_oe2, pwr_oe3, pwr_oe4, | |
16 | adc_d, adc_clk, | |
17 | ssp_frame, ssp_din, ssp_dout, ssp_clk, | |
18 | cross_hi, cross_lo, | |
19 | dbg, | |
20 | mod_type | |
21 | ); | |
22 | input pck0, ck_1356meg, ck_1356megb; | |
23 | output pwr_lo, pwr_hi, pwr_oe1, pwr_oe2, pwr_oe3, pwr_oe4; | |
24 | input [7:0] adc_d; | |
25 | output adc_clk; | |
26 | input ssp_dout; | |
27 | output ssp_frame, ssp_din, ssp_clk; | |
28 | input cross_hi, cross_lo; | |
29 | output dbg; | |
30 | input [2:0] mod_type; | |
31 | ||
32 | reg ssp_clk; | |
33 | reg ssp_frame; | |
34 | ||
6658905f | 35 | wire adc_clk; |
36 | assign adc_clk = ck_1356meg; | |
37 | ||
7bc95e2e | 38 | reg after_hysteresis, after_hysteresis_prev1, after_hysteresis_prev2, after_hysteresis_prev3, after_hysteresis_prev4; |
6658905f | 39 | reg [11:0] has_been_low_for; |
40 | reg [8:0] saw_deep_modulation; | |
41 | reg [2:0] deep_counter; | |
42 | reg deep_modulation; | |
7bc95e2e | 43 | |
6658905f | 44 | always @(negedge adc_clk) |
45 | begin | |
7bc95e2e | 46 | if(& adc_d[7:6]) after_hysteresis <= 1'b1; // adc_d >= 196 (U >= 3,28V) -> after_hysteris = 1 |
47 | else if(~(| adc_d[7:4])) after_hysteresis <= 1'b0; // if adc_d <= 15 (U <= 1,13V) -> after_hysteresis = 0 | |
6658905f | 48 | |
7bc95e2e | 49 | if(~(| adc_d[7:0])) // if adc_d == 0 (U <= 0,94V) |
6658905f | 50 | begin |
7bc95e2e | 51 | if(deep_counter == 3'd7) // adc_d == 0 for 7 adc_clk ticks -> deep_modulation (by reader) |
6658905f | 52 | begin |
53 | deep_modulation <= 1'b1; | |
54 | saw_deep_modulation <= 8'd0; | |
55 | end | |
56 | else | |
57 | deep_counter <= deep_counter + 1; | |
58 | end | |
7bc95e2e | 59 | else |
6658905f | 60 | begin |
61 | deep_counter <= 3'd0; | |
7bc95e2e | 62 | if(saw_deep_modulation == 8'd255) // adc_d != 0 for 255 adc_clk ticks -> deep_modulation is over, now waiting for tag's response |
6658905f | 63 | deep_modulation <= 1'b0; |
64 | else | |
65 | saw_deep_modulation <= saw_deep_modulation + 1; | |
66 | end | |
67 | ||
68 | if(after_hysteresis) | |
69 | begin | |
7bc95e2e | 70 | has_been_low_for <= 12'd0; |
6658905f | 71 | end |
72 | else | |
73 | begin | |
74 | if(has_been_low_for == 12'd4095) | |
75 | begin | |
76 | has_been_low_for <= 12'd0; | |
7bc95e2e | 77 | after_hysteresis <= 1'b1; // reset after_hysteresis to 1 if it had been 0 for 4096 cycles (no field) |
6658905f | 78 | end |
79 | else | |
7bc95e2e | 80 | begin |
6658905f | 81 | has_been_low_for <= has_been_low_for + 1; |
7bc95e2e | 82 | end |
6658905f | 83 | end |
84 | end | |
85 | ||
7bc95e2e | 86 | |
87 | ||
6658905f | 88 | // Report every 4 subcarrier cycles |
7bc95e2e | 89 | // 128 periods of carrier frequency => 7-bit counter [negedge_cnt] |
90 | reg [6:0] negedge_cnt; | |
91 | reg bit1, bit2, bit3, bit4; | |
6658905f | 92 | reg curbit; |
e691fc45 | 93 | |
7bc95e2e | 94 | // storage for four previous samples: |
e691fc45 | 95 | reg [7:0] adc_d_1; |
96 | reg [7:0] adc_d_2; | |
97 | reg [7:0] adc_d_3; | |
98 | reg [7:0] adc_d_4; | |
99 | ||
100 | // the filtered signal (filter performs noise reduction and edge detection) | |
101 | // (gaussian derivative) | |
102 | wire signed [10:0] adc_d_filtered; | |
103 | assign adc_d_filtered = (adc_d_4 << 1) + adc_d_3 - adc_d_1 - (adc_d << 1); | |
104 | ||
105 | // Registers to store steepest edges detected: | |
106 | reg [7:0] rx_mod_falling_edge_max; | |
107 | reg [7:0] rx_mod_rising_edge_max; | |
6658905f | 108 | |
7bc95e2e | 109 | // A register to send 8 Bit results to the arm |
110 | reg [7:0] to_arm; | |
6658905f | 111 | |
6658905f | 112 | |
113 | reg bit_to_arm; | |
114 | reg fdt_indicator, fdt_elapsed; | |
115 | reg [10:0] fdt_counter; | |
7bc95e2e | 116 | //reg [47:0] mod_sig_buf; |
117 | reg [31:0] mod_sig_buf; | |
118 | //reg [5:0] mod_sig_ptr; | |
119 | reg [4:0] mod_sig_ptr; | |
6658905f | 120 | reg [3:0] mod_sig_flip; |
121 | reg mod_sig, mod_sig_coil; | |
122 | reg temp_buffer_reset; | |
123 | reg sendbit; | |
7bc95e2e | 124 | reg [3:0] sub_carrier_cnt; |
6658905f | 125 | |
126 | // ADC data appears on the rising edge, so sample it on the falling edge | |
127 | always @(negedge adc_clk) | |
128 | begin | |
e691fc45 | 129 | // ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
7bc95e2e | 130 | // relevant for TAGSIM_MOD only. Timing of Tag's answer relative to a command received from a reader |
e691fc45 | 131 | // ISO14443-3 specifies: |
132 | // fdt = 1172, if last bit was 0. | |
133 | // fdt = 1236, if last bit was 1. | |
134 | // the FPGA takes care for the 1172 delay. To achieve the additional 1236-1172=64 ticks delay, the ARM must send an additional correction bit (before the start bit). | |
135 | // The correction bit will be coded as 00010000, i.e. it adds 4 bits to the transmission stream, causing the required delay. | |
7bc95e2e | 136 | if(fdt_counter == 11'd547) fdt_indicator <= 1'b1; // The ARM must not send earlier to prevent mod_sig_buf overflow. |
137 | // The mod_sig_buf can buffer 29 excess data bits, i.e. a maximum delay of 29 * 16 = 464 adc_clk ticks. fdt_indicator | |
138 | // could appear at ssp_din after 1 tick, 16 ticks for the transfer, 128 ticks until response is sended. | |
139 | // 1148 - 464 - 1 - 128 - 8 = 547 | |
6658905f | 140 | |
7bc95e2e | 141 | if ((mod_type == `TAGSIM_MOD) || (mod_type == `TAGSIM_LISTEN)) |
6658905f | 142 | begin |
7bc95e2e | 143 | if(fdt_counter == 11'd1148) // the RF part delays the rising edge by approx 5 adc_clk_ticks, the ADC needs 3 clk_ticks for A/D conversion, |
144 | // 16 ticks delay by mod_sig_buf | |
145 | // 1172 - 5 - 3 - 16 = 1148. | |
6658905f | 146 | begin |
7bc95e2e | 147 | if(fdt_elapsed) |
148 | begin | |
149 | if(negedge_cnt[3:0] == mod_sig_flip) mod_sig_coil <= mod_sig; // start modulating (if mod_sig is already set) | |
150 | sub_carrier_cnt[3:0] <= sub_carrier_cnt[3:0] + 1; | |
151 | end | |
152 | else | |
153 | begin | |
154 | mod_sig_flip <= negedge_cnt[3:0]; // start modulation at this time | |
155 | sub_carrier_cnt[3:0] <= 0; // subcarrier phase in sync with start of modulation | |
156 | mod_sig_coil <= mod_sig; // assign signal to coil | |
157 | fdt_elapsed = 1'b1; | |
158 | if(~(| mod_sig_ptr[4:0])) mod_sig_ptr <= 5'd9; // if mod_sig_ptr == 0 -> didn't receive a 1 yet. Delay next 1 by n*128 ticks. | |
159 | else temp_buffer_reset = 1'b1; // else fix the buffer size at current position | |
160 | end | |
6658905f | 161 | end |
162 | else | |
163 | begin | |
7bc95e2e | 164 | fdt_counter <= fdt_counter + 1; // Count until 1155 |
6658905f | 165 | end |
166 | end | |
7bc95e2e | 167 | else // other modes: don't use the delay line. |
6658905f | 168 | begin |
7bc95e2e | 169 | mod_sig_coil <= ssp_dout; |
170 | end | |
6658905f | 171 | |
e691fc45 | 172 | |
173 | //------------------------------------------------------------------------------------------------------------------------------------------- | |
174 | // Relevant for READER_LISTEN only | |
175 | // look for steepest falling and rising edges: | |
7bc95e2e | 176 | |
177 | if(negedge_cnt[3:0] == 4'd1) // reset modulation detector. Save current edge. | |
178 | begin | |
179 | if (adc_d_filtered > 0) | |
e691fc45 | 180 | begin |
e691fc45 | 181 | rx_mod_falling_edge_max <= adc_d_filtered; |
7bc95e2e | 182 | rx_mod_rising_edge_max <= 0; |
183 | end | |
184 | else | |
e691fc45 | 185 | begin |
7bc95e2e | 186 | rx_mod_falling_edge_max <= 0; |
e691fc45 | 187 | rx_mod_rising_edge_max <= -adc_d_filtered; |
188 | end | |
7bc95e2e | 189 | end |
190 | else // detect modulation | |
191 | begin | |
192 | if (adc_d_filtered > 0) | |
193 | begin | |
194 | if (adc_d_filtered > rx_mod_falling_edge_max) | |
195 | rx_mod_falling_edge_max <= adc_d_filtered; | |
196 | end | |
197 | else | |
198 | begin | |
199 | if (-adc_d_filtered > rx_mod_rising_edge_max) | |
200 | rx_mod_rising_edge_max <= -adc_d_filtered; | |
201 | end | |
202 | end | |
203 | ||
204 | // detect modulation signal: if modulating, there must be a falling and a rising edge | |
205 | if (rx_mod_falling_edge_max > 6 && rx_mod_rising_edge_max > 6) | |
206 | curbit <= 1'b1; // modulation | |
207 | else | |
208 | curbit <= 1'b0; // no modulation | |
209 | ||
210 | ||
e691fc45 | 211 | // store previous samples for filtering and edge detection: |
212 | adc_d_4 <= adc_d_3; | |
213 | adc_d_3 <= adc_d_2; | |
214 | adc_d_2 <= adc_d_1; | |
215 | adc_d_1 <= adc_d; | |
216 | ||
e691fc45 | 217 | |
7bc95e2e | 218 | // Relevant for TAGSIM_MOD only (timing the Tag's answer. See above) |
219 | // When we see end of a modulation and we are emulating a Tag, start fdt_counter. | |
220 | // Reset fdt_counter when modulation is detected. | |
221 | if(~after_hysteresis /* && mod_sig_buf_empty */ && mod_type == `TAGSIM_LISTEN) | |
6658905f | 222 | begin |
7bc95e2e | 223 | fdt_counter <= 11'd0; |
224 | fdt_elapsed = 1'b0; | |
225 | fdt_indicator <= 1'b0; | |
226 | temp_buffer_reset = 1'b0; | |
227 | mod_sig_ptr <= 5'b00000; | |
228 | mod_sig = 1'b0; | |
229 | end | |
230 | ||
231 | ||
232 | if(negedge_cnt[3:0] == 4'd1) | |
233 | begin | |
234 | // What do we communicate to the ARM | |
235 | if(mod_type == `TAGSIM_LISTEN) | |
236 | sendbit = after_hysteresis; | |
237 | else if(mod_type == `TAGSIM_MOD) | |
238 | /* if(fdt_counter > 11'd772) sendbit = mod_sig_coil; // huh? | |
239 | else */ | |
240 | sendbit = fdt_indicator; | |
241 | else if (mod_type == `READER_LISTEN) | |
242 | sendbit = curbit; | |
243 | else | |
244 | sendbit = 1'b0; | |
245 | end | |
246 | ||
247 | //------------------------------------------------------------------------------------------------------------------------------------------ | |
248 | // Prepare 8 Bits to communicate to ARM | |
249 | ||
250 | // in SNIFFER mode: 4 Bits data sniffed as Tag, 4 Bits data sniffed as Reader | |
251 | if(mod_type == `SNIFFER) | |
252 | begin | |
253 | if (negedge_cnt == 7'd63) | |
6658905f | 254 | begin |
7bc95e2e | 255 | if(deep_modulation) // a reader is sending (or there's no field at all) |
256 | begin | |
257 | to_arm <= {after_hysteresis_prev1,after_hysteresis_prev2,after_hysteresis_prev3,after_hysteresis_prev4,1'b0,1'b0,1'b0,1'b0}; | |
258 | end | |
6658905f | 259 | else |
7bc95e2e | 260 | begin |
261 | to_arm <= {after_hysteresis_prev1,after_hysteresis_prev2,after_hysteresis_prev3,after_hysteresis_prev4,bit1,bit2,bit3,bit4}; | |
262 | end | |
263 | negedge_cnt <= 0; | |
264 | end | |
265 | else | |
6658905f | 266 | begin |
7bc95e2e | 267 | negedge_cnt <= negedge_cnt + 1; |
6658905f | 268 | end |
6658905f | 269 | end |
7bc95e2e | 270 | else |
271 | // other modes: 8 Bits info on queue delay | |
272 | begin | |
273 | if(negedge_cnt == 7'd127) | |
6658905f | 274 | begin |
7bc95e2e | 275 | if (mod_type == `TAGSIM_MOD) |
276 | begin | |
277 | to_arm[7:0] <= {mod_sig_ptr[4:0], mod_sig_flip[3:1]}; | |
278 | end | |
279 | else | |
280 | begin | |
281 | to_arm[7:0] <= 8'd0; | |
282 | end | |
283 | negedge_cnt <= 0; | |
6658905f | 284 | end |
285 | else | |
286 | begin | |
7bc95e2e | 287 | negedge_cnt <= negedge_cnt + 1; |
6658905f | 288 | end |
e691fc45 | 289 | end |
7bc95e2e | 290 | |
291 | if(negedge_cnt == 7'd1) | |
6658905f | 292 | begin |
293 | after_hysteresis_prev1 <= after_hysteresis; | |
294 | bit1 <= curbit; | |
295 | end | |
7bc95e2e | 296 | if(negedge_cnt == 7'd17) |
6658905f | 297 | begin |
298 | after_hysteresis_prev2 <= after_hysteresis; | |
299 | bit2 <= curbit; | |
300 | end | |
7bc95e2e | 301 | if(negedge_cnt == 7'd33) |
6658905f | 302 | begin |
303 | after_hysteresis_prev3 <= after_hysteresis; | |
304 | bit3 <= curbit; | |
305 | end | |
7bc95e2e | 306 | if(negedge_cnt == 7'd47) |
307 | begin | |
308 | after_hysteresis_prev4 <= after_hysteresis; | |
309 | bit4 <= curbit; | |
310 | end | |
6658905f | 311 | |
e691fc45 | 312 | //-------------------------------------------------------------------------------------------------------------------------------------------------------------- |
313 | // Relevant in TAGSIM_MOD only. Delay-Line to buffer data and send it at the correct time | |
7bc95e2e | 314 | if(negedge_cnt[3:0] == 4'd0) // at rising edge of ssp_clk - ssp_dout changes at the falling edge. |
6658905f | 315 | begin |
7bc95e2e | 316 | mod_sig_buf[31:0] <= {mod_sig_buf[30:1], ssp_dout, 1'b0}; // shift in new data starting at mod_sig_buf[1]. mod_sig_buf[0] = 0 always. |
317 | // asign the delayed signal to mod_sig, but don't modulate with the correction bit (which is sent as 00010000, all other bits will come with at least 2 consecutive 1s) | |
318 | // side effect: when ptr = 1 it will cancel the first 1 of every block of ones. Note: this would only be the case if we received a 1 just before fdt_elapsed. | |
319 | if((ssp_dout || (| mod_sig_ptr[4:0])) && ~fdt_elapsed) // buffer a 1 (and all subsequent data) until fdt_counter = 1148 adc_clk ticks. | |
320 | //if(mod_sig_ptr == 6'b101110) // buffer overflow at 46 - this would mean data loss | |
321 | //begin | |
322 | // mod_sig_ptr <= 6'b000000; | |
323 | //end | |
324 | if (mod_sig_ptr == 5'd30) mod_sig_ptr <= 5'd0; | |
325 | else mod_sig_ptr <= mod_sig_ptr + 1; // increase buffer (= increase delay by 16 adc_clk ticks). ptr always points to first 1. | |
326 | else if(fdt_elapsed && ~temp_buffer_reset) | |
327 | // fdt_elapsed. If we didn't receive a 1 yet, ptr will be at 9 and not yet fixed. Otherwise temp_buffer_reset will be 1 already. | |
6658905f | 328 | begin |
7bc95e2e | 329 | // wait for the next 1 after fdt_elapsed before fixing the delay and starting modulation. This ensures that the response can only happen |
330 | // at intervals of 8 * 16 = 128 adc_clk ticks intervals (as defined in ISO14443-3) | |
331 | if(ssp_dout) temp_buffer_reset = 1'b1; | |
332 | if(mod_sig_ptr == 5'd2) mod_sig_ptr <= 5'd9; // still nothing received, need to go for the next interval | |
333 | else mod_sig_ptr <= mod_sig_ptr - 1; // decrease buffer. | |
334 | end | |
335 | else | |
336 | begin | |
337 | if(~mod_sig_buf[mod_sig_ptr-1] && ~mod_sig_buf[mod_sig_ptr+1]) mod_sig = 1'b0; | |
338 | // finally, assign the delayed signal: | |
339 | else mod_sig = mod_sig_buf[mod_sig_ptr]; | |
6658905f | 340 | end |
341 | end | |
342 | ||
e691fc45 | 343 | //----------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
344 | // Communication to ARM (SSP Clock and data) | |
345 | // SNIFFER mode (ssp_clk = adc_clk / 8, ssp_frame clock = adc_clk / 64)): | |
7bc95e2e | 346 | if(mod_type == `SNIFFER) |
6658905f | 347 | begin |
348 | if(negedge_cnt[2:0] == 3'b100) | |
349 | ssp_clk <= 1'b0; | |
350 | ||
351 | if(negedge_cnt[2:0] == 3'b000) | |
352 | begin | |
353 | ssp_clk <= 1'b1; | |
354 | // Don't shift if we just loaded new data, obviously. | |
7bc95e2e | 355 | if(negedge_cnt[5:0] != 6'd0) |
6658905f | 356 | begin |
357 | to_arm[7:1] <= to_arm[6:0]; | |
358 | end | |
359 | end | |
360 | ||
361 | if(negedge_cnt[5:4] == 2'b00) | |
362 | ssp_frame = 1'b1; | |
363 | else | |
364 | ssp_frame = 1'b0; | |
365 | ||
366 | bit_to_arm = to_arm[7]; | |
367 | end | |
368 | else | |
e691fc45 | 369 | //----------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
370 | // Communication to ARM (SSP Clock and data) | |
371 | // all other modes (ssp_clk = adc_clk / 16, ssp_frame clock = adc_clk / 128): | |
6658905f | 372 | begin |
373 | if(negedge_cnt[3:0] == 4'b1000) ssp_clk <= 1'b0; | |
374 | ||
375 | if(negedge_cnt[3:0] == 4'b0111) | |
376 | begin | |
7bc95e2e | 377 | // if(ssp_frame_counter == 3'd7) ssp_frame_counter <= 3'd0; |
378 | // else ssp_frame_counter <= ssp_frame_counter + 1; | |
379 | if (negedge_cnt[6:4] == 3'b000) ssp_frame = 1'b1; | |
380 | else ssp_frame = 1'b0; | |
6658905f | 381 | end |
7bc95e2e | 382 | // ssp_frame = (ssp_frame_counter == 3'd7); |
6658905f | 383 | |
384 | if(negedge_cnt[3:0] == 4'b0000) | |
385 | begin | |
386 | ssp_clk <= 1'b1; | |
7bc95e2e | 387 | // Don't shift if we just loaded new data, obviously. |
388 | if(negedge_cnt[6:0] != 7'd0) | |
389 | begin | |
390 | to_arm[7:1] <= to_arm[6:0]; | |
391 | end | |
6658905f | 392 | end |
393 | ||
7bc95e2e | 394 | if (mod_type == `TAGSIM_MOD && fdt_elapsed && temp_buffer_reset) |
395 | // transmit timing information | |
396 | bit_to_arm = to_arm[7]; | |
397 | else | |
398 | // transmit data or fdt_indicator | |
399 | bit_to_arm = sendbit; | |
400 | end | |
6658905f | 401 | |
7bc95e2e | 402 | end //always @(negedge adc_clk) |
6658905f | 403 | |
404 | assign ssp_din = bit_to_arm; | |
405 | ||
e691fc45 | 406 | |
7bc95e2e | 407 | // Subcarrier (adc_clk/16, for TAGSIM_MOD only). |
408 | wire sub_carrier; | |
409 | assign sub_carrier = ~sub_carrier_cnt[3]; | |
e691fc45 | 410 | |
7bc95e2e | 411 | // in READER_MOD: drop carrier for mod_sig_coil==1 (pause); in READER_LISTEN: carrier always on; in other modes: carrier always off |
412 | assign pwr_hi = (ck_1356megb & (((mod_type == `READER_MOD) & ~mod_sig_coil) || (mod_type == `READER_LISTEN))); | |
6658905f | 413 | |
6658905f | 414 | |
e691fc45 | 415 | // Enable HF antenna drivers: |
6658905f | 416 | assign pwr_oe1 = 1'b0; |
e691fc45 | 417 | assign pwr_oe3 = 1'b0; |
418 | ||
7bc95e2e | 419 | // TAGSIM_MOD: short circuit antenna with different resistances (modulated by sub_carrier modulated by mod_sig_coil) |
e691fc45 | 420 | // for pwr_oe4 = 1 (tristate): antenna load = 10k || 33 = 32,9 Ohms |
421 | // for pwr_oe4 = 0 (active): antenna load = 10k || 33 || 33 = 16,5 Ohms | |
7bc95e2e | 422 | assign pwr_oe4 = ~(mod_sig_coil & sub_carrier & (mod_type == `TAGSIM_MOD)); |
6658905f | 423 | |
e691fc45 | 424 | // This is all LF, so doesn't matter. |
425 | assign pwr_oe2 = 1'b0; | |
426 | assign pwr_lo = 1'b0; | |
6658905f | 427 | |
428 | ||
429 | assign dbg = negedge_cnt[3]; | |
430 | ||
6658905f | 431 | endmodule |