]>
Commit | Line | Data |
---|---|---|
1 | //----------------------------------------------------------------------------- | |
2 | // ISO14443-A support for the Proxmark III | |
3 | // Gerhard de Koning Gans, April 2008 | |
4 | //----------------------------------------------------------------------------- | |
5 | ||
6 | // constants for the different modes: | |
7 | `define SNIFFER 3'b000 | |
8 | `define TAGSIM_LISTEN 3'b001 | |
9 | `define TAGSIM_MOD 3'b010 | |
10 | `define READER_LISTEN 3'b011 | |
11 | `define READER_MOD 3'b100 | |
12 | ||
13 | module hi_iso14443a( | |
14 | pck0, ck_1356meg, ck_1356megb, | |
15 | pwr_lo, pwr_hi, pwr_oe1, pwr_oe2, pwr_oe3, pwr_oe4, | |
16 | adc_d, adc_clk, | |
17 | ssp_frame, ssp_din, ssp_dout, ssp_clk, | |
18 | cross_hi, cross_lo, | |
19 | dbg, | |
20 | mod_type | |
21 | ); | |
22 | input pck0, ck_1356meg, ck_1356megb; | |
23 | output pwr_lo, pwr_hi, pwr_oe1, pwr_oe2, pwr_oe3, pwr_oe4; | |
24 | input [7:0] adc_d; | |
25 | output adc_clk; | |
26 | input ssp_dout; | |
27 | output ssp_frame, ssp_din, ssp_clk; | |
28 | input cross_hi, cross_lo; | |
29 | output dbg; | |
30 | input [2:0] mod_type; | |
31 | ||
32 | reg ssp_clk; | |
33 | reg ssp_frame; | |
34 | ||
35 | wire adc_clk; | |
36 | assign adc_clk = ck_1356meg; | |
37 | ||
38 | reg after_hysteresis, after_hysteresis_prev1, after_hysteresis_prev2, after_hysteresis_prev3, after_hysteresis_prev4; | |
39 | reg [11:0] has_been_low_for; | |
40 | reg [8:0] saw_deep_modulation; | |
41 | reg [2:0] deep_counter; | |
42 | reg deep_modulation; | |
43 | ||
44 | always @(negedge adc_clk) | |
45 | begin | |
46 | if(& adc_d[7:6]) after_hysteresis <= 1'b1; // adc_d >= 196 (U >= 3,28V) -> after_hysteris = 1 | |
47 | else if(~(| adc_d[7:4])) after_hysteresis <= 1'b0; // if adc_d <= 15 (U <= 1,13V) -> after_hysteresis = 0 | |
48 | ||
49 | if(~(| adc_d[7:0])) // if adc_d == 0 (U <= 0,94V) | |
50 | begin | |
51 | if(deep_counter == 3'd7) // adc_d == 0 for 7 adc_clk ticks -> deep_modulation (by reader) | |
52 | begin | |
53 | deep_modulation <= 1'b1; | |
54 | saw_deep_modulation <= 8'd0; | |
55 | end | |
56 | else | |
57 | deep_counter <= deep_counter + 1; | |
58 | end | |
59 | else | |
60 | begin | |
61 | deep_counter <= 3'd0; | |
62 | if(saw_deep_modulation == 8'd255) // adc_d != 0 for 255 adc_clk ticks -> deep_modulation is over, now waiting for tag's response | |
63 | deep_modulation <= 1'b0; | |
64 | else | |
65 | saw_deep_modulation <= saw_deep_modulation + 1; | |
66 | end | |
67 | ||
68 | if(after_hysteresis) | |
69 | begin | |
70 | has_been_low_for <= 12'd0; | |
71 | end | |
72 | else | |
73 | begin | |
74 | if(has_been_low_for == 12'd4095) | |
75 | begin | |
76 | has_been_low_for <= 12'd0; | |
77 | after_hysteresis <= 1'b1; // reset after_hysteresis to 1 if it had been 0 for 4096 cycles (no field) | |
78 | end | |
79 | else | |
80 | begin | |
81 | has_been_low_for <= has_been_low_for + 1; | |
82 | end | |
83 | end | |
84 | end | |
85 | ||
86 | ||
87 | ||
88 | // Report every 4 subcarrier cycles | |
89 | // 128 periods of carrier frequency => 7-bit counter [negedge_cnt] | |
90 | reg [6:0] negedge_cnt; | |
91 | reg bit1, bit2, bit3, bit4; | |
92 | reg curbit; | |
93 | ||
94 | // storage for four previous samples: | |
95 | reg [7:0] adc_d_1; | |
96 | reg [7:0] adc_d_2; | |
97 | reg [7:0] adc_d_3; | |
98 | reg [7:0] adc_d_4; | |
99 | ||
100 | // the filtered signal (filter performs noise reduction and edge detection) | |
101 | // (gaussian derivative) | |
102 | wire signed [10:0] adc_d_filtered; | |
103 | assign adc_d_filtered = (adc_d_4 << 1) + adc_d_3 - adc_d_1 - (adc_d << 1); | |
104 | ||
105 | // Registers to store steepest edges detected: | |
106 | reg [7:0] rx_mod_falling_edge_max; | |
107 | reg [7:0] rx_mod_rising_edge_max; | |
108 | ||
109 | // A register to send 8 Bit results to the arm | |
110 | reg [7:0] to_arm; | |
111 | ||
112 | ||
113 | reg bit_to_arm; | |
114 | reg fdt_indicator, fdt_elapsed; | |
115 | reg [10:0] fdt_counter; | |
116 | //reg [47:0] mod_sig_buf; | |
117 | reg [31:0] mod_sig_buf; | |
118 | //reg [5:0] mod_sig_ptr; | |
119 | reg [4:0] mod_sig_ptr; | |
120 | reg [3:0] mod_sig_flip; | |
121 | reg mod_sig, mod_sig_coil; | |
122 | reg temp_buffer_reset; | |
123 | reg sendbit; | |
124 | reg [3:0] sub_carrier_cnt; | |
125 | ||
126 | // ADC data appears on the rising edge, so sample it on the falling edge | |
127 | always @(negedge adc_clk) | |
128 | begin | |
129 | // ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | |
130 | // relevant for TAGSIM_MOD only. Timing of Tag's answer relative to a command received from a reader | |
131 | // ISO14443-3 specifies: | |
132 | // fdt = 1172, if last bit was 0. | |
133 | // fdt = 1236, if last bit was 1. | |
134 | // the FPGA takes care for the 1172 delay. To achieve the additional 1236-1172=64 ticks delay, the ARM must send an additional correction bit (before the start bit). | |
135 | // The correction bit will be coded as 00010000, i.e. it adds 4 bits to the transmission stream, causing the required delay. | |
136 | if(fdt_counter == 11'd547) fdt_indicator <= 1'b1; // The ARM must not send earlier to prevent mod_sig_buf overflow. | |
137 | // The mod_sig_buf can buffer 29 excess data bits, i.e. a maximum delay of 29 * 16 = 464 adc_clk ticks. fdt_indicator | |
138 | // could appear at ssp_din after 1 tick, 16 ticks for the transfer, 128 ticks until response is sended. | |
139 | // 1148 - 464 - 1 - 128 - 8 = 547 | |
140 | ||
141 | if ((mod_type == `TAGSIM_MOD) || (mod_type == `TAGSIM_LISTEN)) | |
142 | begin | |
143 | if(fdt_counter == 11'd1148) // the RF part delays the rising edge by approx 5 adc_clk_ticks, the ADC needs 3 clk_ticks for A/D conversion, | |
144 | // 16 ticks delay by mod_sig_buf | |
145 | // 1172 - 5 - 3 - 16 = 1148. | |
146 | begin | |
147 | if(fdt_elapsed) | |
148 | begin | |
149 | if(negedge_cnt[3:0] == mod_sig_flip) mod_sig_coil <= mod_sig; // start modulating (if mod_sig is already set) | |
150 | sub_carrier_cnt[3:0] <= sub_carrier_cnt[3:0] + 1; | |
151 | end | |
152 | else | |
153 | begin | |
154 | mod_sig_flip <= negedge_cnt[3:0]; // start modulation at this time | |
155 | sub_carrier_cnt[3:0] <= 0; // subcarrier phase in sync with start of modulation | |
156 | mod_sig_coil <= mod_sig; // assign signal to coil | |
157 | fdt_elapsed = 1'b1; | |
158 | if(~(| mod_sig_ptr[4:0])) mod_sig_ptr <= 5'd9; // if mod_sig_ptr == 0 -> didn't receive a 1 yet. Delay next 1 by n*128 ticks. | |
159 | else temp_buffer_reset = 1'b1; // else fix the buffer size at current position | |
160 | end | |
161 | end | |
162 | else | |
163 | begin | |
164 | fdt_counter <= fdt_counter + 1; // Count until 1155 | |
165 | end | |
166 | end | |
167 | else // other modes: don't use the delay line. | |
168 | begin | |
169 | mod_sig_coil <= ssp_dout; | |
170 | end | |
171 | ||
172 | ||
173 | //------------------------------------------------------------------------------------------------------------------------------------------- | |
174 | // Relevant for READER_LISTEN only | |
175 | // look for steepest falling and rising edges: | |
176 | ||
177 | if(negedge_cnt[3:0] == 4'd1) // reset modulation detector. Save current edge. | |
178 | begin | |
179 | if (adc_d_filtered > 0) | |
180 | begin | |
181 | rx_mod_falling_edge_max <= adc_d_filtered; | |
182 | rx_mod_rising_edge_max <= 0; | |
183 | end | |
184 | else | |
185 | begin | |
186 | rx_mod_falling_edge_max <= 0; | |
187 | rx_mod_rising_edge_max <= -adc_d_filtered; | |
188 | end | |
189 | end | |
190 | else // detect modulation | |
191 | begin | |
192 | if (adc_d_filtered > 0) | |
193 | begin | |
194 | if (adc_d_filtered > rx_mod_falling_edge_max) | |
195 | rx_mod_falling_edge_max <= adc_d_filtered; | |
196 | end | |
197 | else | |
198 | begin | |
199 | if (-adc_d_filtered > rx_mod_rising_edge_max) | |
200 | rx_mod_rising_edge_max <= -adc_d_filtered; | |
201 | end | |
202 | end | |
203 | ||
204 | // detect modulation signal: if modulating, there must be a falling and a rising edge | |
205 | if (rx_mod_falling_edge_max > 6 && rx_mod_rising_edge_max > 6) | |
206 | curbit <= 1'b1; // modulation | |
207 | else | |
208 | curbit <= 1'b0; // no modulation | |
209 | ||
210 | ||
211 | // store previous samples for filtering and edge detection: | |
212 | adc_d_4 <= adc_d_3; | |
213 | adc_d_3 <= adc_d_2; | |
214 | adc_d_2 <= adc_d_1; | |
215 | adc_d_1 <= adc_d; | |
216 | ||
217 | ||
218 | // Relevant for TAGSIM_MOD only (timing the Tag's answer. See above) | |
219 | // When we see end of a modulation and we are emulating a Tag, start fdt_counter. | |
220 | // Reset fdt_counter when modulation is detected. | |
221 | if(~after_hysteresis /* && mod_sig_buf_empty */ && mod_type == `TAGSIM_LISTEN) | |
222 | begin | |
223 | fdt_counter <= 11'd0; | |
224 | fdt_elapsed = 1'b0; | |
225 | fdt_indicator <= 1'b0; | |
226 | temp_buffer_reset = 1'b0; | |
227 | mod_sig_ptr <= 5'b00000; | |
228 | mod_sig = 1'b0; | |
229 | end | |
230 | ||
231 | ||
232 | if(negedge_cnt[3:0] == 4'd1) | |
233 | begin | |
234 | // What do we communicate to the ARM | |
235 | if(mod_type == `TAGSIM_LISTEN) | |
236 | sendbit = after_hysteresis; | |
237 | else if(mod_type == `TAGSIM_MOD) | |
238 | /* if(fdt_counter > 11'd772) sendbit = mod_sig_coil; // huh? | |
239 | else */ | |
240 | sendbit = fdt_indicator; | |
241 | else if (mod_type == `READER_LISTEN) | |
242 | sendbit = curbit; | |
243 | else | |
244 | sendbit = 1'b0; | |
245 | end | |
246 | ||
247 | //------------------------------------------------------------------------------------------------------------------------------------------ | |
248 | // Prepare 8 Bits to communicate to ARM | |
249 | ||
250 | // in SNIFFER mode: 4 Bits data sniffed as Tag, 4 Bits data sniffed as Reader | |
251 | if(mod_type == `SNIFFER) | |
252 | begin | |
253 | if (negedge_cnt == 7'd63) | |
254 | begin | |
255 | if(deep_modulation) // a reader is sending (or there's no field at all) | |
256 | begin | |
257 | to_arm <= {after_hysteresis_prev1,after_hysteresis_prev2,after_hysteresis_prev3,after_hysteresis_prev4,1'b0,1'b0,1'b0,1'b0}; | |
258 | end | |
259 | else | |
260 | begin | |
261 | to_arm <= {after_hysteresis_prev1,after_hysteresis_prev2,after_hysteresis_prev3,after_hysteresis_prev4,bit1,bit2,bit3,bit4}; | |
262 | end | |
263 | negedge_cnt <= 0; | |
264 | end | |
265 | else | |
266 | begin | |
267 | negedge_cnt <= negedge_cnt + 1; | |
268 | end | |
269 | end | |
270 | else | |
271 | // other modes: 8 Bits info on queue delay | |
272 | begin | |
273 | if(negedge_cnt == 7'd127) | |
274 | begin | |
275 | if (mod_type == `TAGSIM_MOD) | |
276 | begin | |
277 | to_arm[7:0] <= {mod_sig_ptr[4:0], mod_sig_flip[3:1]}; | |
278 | end | |
279 | else | |
280 | begin | |
281 | to_arm[7:0] <= 8'd0; | |
282 | end | |
283 | negedge_cnt <= 0; | |
284 | end | |
285 | else | |
286 | begin | |
287 | negedge_cnt <= negedge_cnt + 1; | |
288 | end | |
289 | end | |
290 | ||
291 | if(negedge_cnt == 7'd1) | |
292 | begin | |
293 | after_hysteresis_prev1 <= after_hysteresis; | |
294 | bit1 <= curbit; | |
295 | end | |
296 | if(negedge_cnt == 7'd17) | |
297 | begin | |
298 | after_hysteresis_prev2 <= after_hysteresis; | |
299 | bit2 <= curbit; | |
300 | end | |
301 | if(negedge_cnt == 7'd33) | |
302 | begin | |
303 | after_hysteresis_prev3 <= after_hysteresis; | |
304 | bit3 <= curbit; | |
305 | end | |
306 | if(negedge_cnt == 7'd47) | |
307 | begin | |
308 | after_hysteresis_prev4 <= after_hysteresis; | |
309 | bit4 <= curbit; | |
310 | end | |
311 | ||
312 | //-------------------------------------------------------------------------------------------------------------------------------------------------------------- | |
313 | // Relevant in TAGSIM_MOD only. Delay-Line to buffer data and send it at the correct time | |
314 | if(negedge_cnt[3:0] == 4'd0) // at rising edge of ssp_clk - ssp_dout changes at the falling edge. | |
315 | begin | |
316 | mod_sig_buf[31:0] <= {mod_sig_buf[30:1], ssp_dout, 1'b0}; // shift in new data starting at mod_sig_buf[1]. mod_sig_buf[0] = 0 always. | |
317 | // asign the delayed signal to mod_sig, but don't modulate with the correction bit (which is sent as 00010000, all other bits will come with at least 2 consecutive 1s) | |
318 | // side effect: when ptr = 1 it will cancel the first 1 of every block of ones. Note: this would only be the case if we received a 1 just before fdt_elapsed. | |
319 | if((ssp_dout || (| mod_sig_ptr[4:0])) && ~fdt_elapsed) // buffer a 1 (and all subsequent data) until fdt_counter = 1148 adc_clk ticks. | |
320 | //if(mod_sig_ptr == 6'b101110) // buffer overflow at 46 - this would mean data loss | |
321 | //begin | |
322 | // mod_sig_ptr <= 6'b000000; | |
323 | //end | |
324 | if (mod_sig_ptr == 5'd30) mod_sig_ptr <= 5'd0; | |
325 | else mod_sig_ptr <= mod_sig_ptr + 1; // increase buffer (= increase delay by 16 adc_clk ticks). ptr always points to first 1. | |
326 | else if(fdt_elapsed && ~temp_buffer_reset) | |
327 | // fdt_elapsed. If we didn't receive a 1 yet, ptr will be at 9 and not yet fixed. Otherwise temp_buffer_reset will be 1 already. | |
328 | begin | |
329 | // wait for the next 1 after fdt_elapsed before fixing the delay and starting modulation. This ensures that the response can only happen | |
330 | // at intervals of 8 * 16 = 128 adc_clk ticks intervals (as defined in ISO14443-3) | |
331 | if(ssp_dout) temp_buffer_reset = 1'b1; | |
332 | if(mod_sig_ptr == 5'd2) mod_sig_ptr <= 5'd9; // still nothing received, need to go for the next interval | |
333 | else mod_sig_ptr <= mod_sig_ptr - 1; // decrease buffer. | |
334 | end | |
335 | else | |
336 | begin | |
337 | if(~mod_sig_buf[mod_sig_ptr-1] && ~mod_sig_buf[mod_sig_ptr+1]) mod_sig = 1'b0; | |
338 | // finally, assign the delayed signal: | |
339 | else mod_sig = mod_sig_buf[mod_sig_ptr]; | |
340 | end | |
341 | end | |
342 | ||
343 | //----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | |
344 | // Communication to ARM (SSP Clock and data) | |
345 | // SNIFFER mode (ssp_clk = adc_clk / 8, ssp_frame clock = adc_clk / 64)): | |
346 | if(mod_type == `SNIFFER) | |
347 | begin | |
348 | if(negedge_cnt[2:0] == 3'b100) | |
349 | ssp_clk <= 1'b0; | |
350 | ||
351 | if(negedge_cnt[2:0] == 3'b000) | |
352 | begin | |
353 | ssp_clk <= 1'b1; | |
354 | // Don't shift if we just loaded new data, obviously. | |
355 | if(negedge_cnt[5:0] != 6'd0) | |
356 | begin | |
357 | to_arm[7:1] <= to_arm[6:0]; | |
358 | end | |
359 | end | |
360 | ||
361 | if(negedge_cnt[5:4] == 2'b00) | |
362 | ssp_frame = 1'b1; | |
363 | else | |
364 | ssp_frame = 1'b0; | |
365 | ||
366 | bit_to_arm = to_arm[7]; | |
367 | end | |
368 | else | |
369 | //----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | |
370 | // Communication to ARM (SSP Clock and data) | |
371 | // all other modes (ssp_clk = adc_clk / 16, ssp_frame clock = adc_clk / 128): | |
372 | begin | |
373 | if(negedge_cnt[3:0] == 4'b1000) ssp_clk <= 1'b0; | |
374 | ||
375 | if(negedge_cnt[3:0] == 4'b0111) | |
376 | begin | |
377 | // if(ssp_frame_counter == 3'd7) ssp_frame_counter <= 3'd0; | |
378 | // else ssp_frame_counter <= ssp_frame_counter + 1; | |
379 | if (negedge_cnt[6:4] == 3'b000) ssp_frame = 1'b1; | |
380 | else ssp_frame = 1'b0; | |
381 | end | |
382 | // ssp_frame = (ssp_frame_counter == 3'd7); | |
383 | ||
384 | if(negedge_cnt[3:0] == 4'b0000) | |
385 | begin | |
386 | ssp_clk <= 1'b1; | |
387 | // Don't shift if we just loaded new data, obviously. | |
388 | if(negedge_cnt[6:0] != 7'd0) | |
389 | begin | |
390 | to_arm[7:1] <= to_arm[6:0]; | |
391 | end | |
392 | end | |
393 | ||
394 | if (mod_type == `TAGSIM_MOD && fdt_elapsed && temp_buffer_reset) | |
395 | // transmit timing information | |
396 | bit_to_arm = to_arm[7]; | |
397 | else | |
398 | // transmit data or fdt_indicator | |
399 | bit_to_arm = sendbit; | |
400 | end | |
401 | ||
402 | end //always @(negedge adc_clk) | |
403 | ||
404 | assign ssp_din = bit_to_arm; | |
405 | ||
406 | ||
407 | // Subcarrier (adc_clk/16, for TAGSIM_MOD only). | |
408 | wire sub_carrier; | |
409 | assign sub_carrier = ~sub_carrier_cnt[3]; | |
410 | ||
411 | // in READER_MOD: drop carrier for mod_sig_coil==1 (pause); in READER_LISTEN: carrier always on; in other modes: carrier always off | |
412 | assign pwr_hi = (ck_1356megb & (((mod_type == `READER_MOD) & ~mod_sig_coil) || (mod_type == `READER_LISTEN))); | |
413 | ||
414 | ||
415 | // Enable HF antenna drivers: | |
416 | assign pwr_oe1 = 1'b0; | |
417 | assign pwr_oe3 = 1'b0; | |
418 | ||
419 | // TAGSIM_MOD: short circuit antenna with different resistances (modulated by sub_carrier modulated by mod_sig_coil) | |
420 | // for pwr_oe4 = 1 (tristate): antenna load = 10k || 33 = 32,9 Ohms | |
421 | // for pwr_oe4 = 0 (active): antenna load = 10k || 33 || 33 = 16,5 Ohms | |
422 | assign pwr_oe4 = ~(mod_sig_coil & sub_carrier & (mod_type == `TAGSIM_MOD)); | |
423 | ||
424 | // This is all LF, so doesn't matter. | |
425 | assign pwr_oe2 = 1'b0; | |
426 | assign pwr_lo = 1'b0; | |
427 | ||
428 | ||
429 | assign dbg = negedge_cnt[3]; | |
430 | ||
431 | endmodule |