]> git.zerfleddert.de Git - proxmark3-svn/blame - fpga/hi_read_rx_xcorr.v
New: implementing hf mf hardnested
[proxmark3-svn] / fpga / hi_read_rx_xcorr.v
CommitLineData
ba06a4b6 1//-----------------------------------------------------------------------------
2//
3// Jonathan Westhues, April 2006
4//-----------------------------------------------------------------------------
5
6module hi_read_rx_xcorr(
7 pck0, ck_1356meg, ck_1356megb,
8 pwr_lo, pwr_hi, pwr_oe1, pwr_oe2, pwr_oe3, pwr_oe4,
9 adc_d, adc_clk,
10 ssp_frame, ssp_din, ssp_dout, ssp_clk,
11 cross_hi, cross_lo,
12 dbg,
da586b17 13 xcorr_is_848, snoop
ba06a4b6 14);
15 input pck0, ck_1356meg, ck_1356megb;
16 output pwr_lo, pwr_hi, pwr_oe1, pwr_oe2, pwr_oe3, pwr_oe4;
17 input [7:0] adc_d;
18 output adc_clk;
19 input ssp_dout;
20 output ssp_frame, ssp_din, ssp_clk;
21 input cross_hi, cross_lo;
22 output dbg;
da586b17 23 input xcorr_is_848, snoop;
ba06a4b6 24
25// Carrier is steady on through this, unless we're snooping.
26assign pwr_hi = ck_1356megb & (~snoop);
27assign pwr_oe1 = 1'b0;
ba06a4b6 28assign pwr_oe3 = 1'b0;
29assign pwr_oe4 = 1'b0;
30
46734099 31wire adc_clk = ck_1356megb;
32
33reg fc_div_2;
da586b17 34always @(negedge ck_1356megb)
35 fc_div_2 <= fc_div_2 + 1;
ba06a4b6 36
37// When we're a reader, we just need to do the BPSK demod; but when we're an
38// eavesdropper, we also need to pick out the commands sent by the reader,
39// using AM. Do this the same way that we do it for the simulated tag.
51d4f6f1 40reg after_hysteresis, after_hysteresis_prev, after_hysteresis_prev_prev;
ba06a4b6 41reg [11:0] has_been_low_for;
42always @(negedge adc_clk)
43begin
44 if(& adc_d[7:0]) after_hysteresis <= 1'b1;
45 else if(~(| adc_d[7:0])) after_hysteresis <= 1'b0;
46
47 if(after_hysteresis)
48 begin
49 has_been_low_for <= 7'b0;
50 end
51 else
52 begin
53 if(has_been_low_for == 12'd4095)
54 begin
55 has_been_low_for <= 12'd0;
56 after_hysteresis <= 1'b1;
57 end
58 else
59 has_been_low_for <= has_been_low_for + 1;
60 end
61end
62
63// Let us report a correlation every 4 subcarrier cycles, or 4*16 samples,
64// so we need a 6-bit counter.
65reg [5:0] corr_i_cnt;
ba06a4b6 66// And a couple of registers in which to accumulate the correlations.
5b95953d 67// we would add at most 32 times adc_d, the result can be held in 13 bits.
68// Need one additional bit because it can be negative as well
69reg signed [13:0] corr_i_accum;
70reg signed [13:0] corr_q_accum;
ba06a4b6 71reg signed [7:0] corr_i_out;
72reg signed [7:0] corr_q_out;
51d4f6f1 73// clock and frame signal for communication to ARM
74reg ssp_clk;
75reg ssp_frame;
76
77
46734099 78always @(negedge adc_clk)
79begin
80 if (xcorr_is_848 | fc_div_2)
81 corr_i_cnt <= corr_i_cnt + 1;
82end
83
ba06a4b6 84
85// ADC data appears on the rising edge, so sample it on the falling edge
86always @(negedge adc_clk)
87begin
88 // These are the correlators: we correlate against in-phase and quadrature
89 // versions of our reference signal, and keep the (signed) result to
90 // send out later over the SSP.
705bfa10 91 if(corr_i_cnt == 6'd0)
ba06a4b6 92 begin
93 if(snoop)
94 begin
46734099 95 // Send only 7 most significant bits of tag signal (signed), LSB is reader signal:
51d4f6f1 96 corr_i_out <= {corr_i_accum[13:7], after_hysteresis_prev_prev};
97 corr_q_out <= {corr_q_accum[13:7], after_hysteresis_prev};
98 after_hysteresis_prev_prev <= after_hysteresis;
ba06a4b6 99 end
100 else
101 begin
51d4f6f1 102 // 8 most significant bits of tag signal
ba06a4b6 103 corr_i_out <= corr_i_accum[13:6];
104 corr_q_out <= corr_q_accum[13:6];
105 end
106
107 corr_i_accum <= adc_d;
108 corr_q_accum <= adc_d;
ba06a4b6 109 end
110 else
111 begin
112 if(corr_i_cnt[3])
113 corr_i_accum <= corr_i_accum - adc_d;
114 else
115 corr_i_accum <= corr_i_accum + adc_d;
116
51d4f6f1 117 if(corr_i_cnt[3] == corr_i_cnt[2]) // phase shifted by pi/2
ba06a4b6 118 corr_q_accum <= corr_q_accum + adc_d;
51d4f6f1 119 else
120 corr_q_accum <= corr_q_accum - adc_d;
ba06a4b6 121
ba06a4b6 122 end
123
124 // The logic in hi_simulate.v reports 4 samples per bit. We report two
125 // (I, Q) pairs per bit, so we should do 2 samples per pair.
705bfa10 126 if(corr_i_cnt == 6'd32)
ba06a4b6 127 after_hysteresis_prev <= after_hysteresis;
128
129 // Then the result from last time is serialized and send out to the ARM.
130 // We get one report each cycle, and each report is 16 bits, so the
131 // ssp_clk should be the adc_clk divided by 64/16 = 4.
132
133 if(corr_i_cnt[1:0] == 2'b10)
134 ssp_clk <= 1'b0;
135
136 if(corr_i_cnt[1:0] == 2'b00)
137 begin
138 ssp_clk <= 1'b1;
139 // Don't shift if we just loaded new data, obviously.
140 if(corr_i_cnt != 7'd0)
141 begin
142 corr_i_out[7:0] <= {corr_i_out[6:0], corr_q_out[7]};
143 corr_q_out[7:1] <= corr_q_out[6:0];
144 end
145 end
146
09c66f1f 147 // set ssp_frame signal for corr_i_cnt = 0..3 and corr_i_cnt = 32..35
51d4f6f1 148 // (send two frames with 8 Bits each)
09c66f1f 149 if(corr_i_cnt[5:2] == 4'b0000 || corr_i_cnt[5:2] == 4'b1000)
ba06a4b6 150 ssp_frame = 1'b1;
151 else
152 ssp_frame = 1'b0;
153
154end
155
156assign ssp_din = corr_i_out[7];
157
158assign dbg = corr_i_cnt[3];
159
160// Unused.
161assign pwr_lo = 1'b0;
51d4f6f1 162assign pwr_oe2 = 1'b0;
ba06a4b6 163
164endmodule
Impressum, Datenschutz