| 1 | //----------------------------------------------------------------------------- |
| 2 | // ISO14443-A support for the Proxmark III |
| 3 | // Gerhard de Koning Gans, April 2008 |
| 4 | //----------------------------------------------------------------------------- |
| 5 | |
| 6 | // constants for the different modes: |
| 7 | `define SNIFFER 3'b000 |
| 8 | `define TAGSIM_LISTEN 3'b001 |
| 9 | `define TAGSIM_MOD 3'b010 |
| 10 | `define READER_LISTEN 3'b011 |
| 11 | `define READER_MOD 3'b100 |
| 12 | |
| 13 | module hi_iso14443a( |
| 14 | pck0, ck_1356meg, ck_1356megb, |
| 15 | pwr_lo, pwr_hi, pwr_oe1, pwr_oe2, pwr_oe3, pwr_oe4, |
| 16 | adc_d, adc_clk, |
| 17 | ssp_frame, ssp_din, ssp_dout, ssp_clk, |
| 18 | cross_hi, cross_lo, |
| 19 | dbg, |
| 20 | mod_type |
| 21 | ); |
| 22 | input pck0, ck_1356meg, ck_1356megb; |
| 23 | output pwr_lo, pwr_hi, pwr_oe1, pwr_oe2, pwr_oe3, pwr_oe4; |
| 24 | input [7:0] adc_d; |
| 25 | output adc_clk; |
| 26 | input ssp_dout; |
| 27 | output ssp_frame, ssp_din, ssp_clk; |
| 28 | input cross_hi, cross_lo; |
| 29 | output dbg; |
| 30 | input [2:0] mod_type; |
| 31 | |
| 32 | |
| 33 | wire adc_clk = ck_1356meg; |
| 34 | |
| 35 | |
| 36 | |
| 37 | //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// |
| 38 | // Reader -> PM3: |
| 39 | // detecting and shaping the reader's signal. Reader will modulate the carrier by 100% (signal is either on or off). Use a |
| 40 | // hysteresis (Schmitt Trigger) to avoid false triggers during slowly increasing or decreasing carrier amplitudes |
| 41 | reg after_hysteresis; |
| 42 | reg [11:0] has_been_low_for; |
| 43 | |
| 44 | always @(negedge adc_clk) |
| 45 | begin |
| 46 | if(adc_d >= 16) after_hysteresis <= 1'b1; // U >= 1,14V -> after_hysteresis = 1 |
| 47 | else if(adc_d < 8) after_hysteresis <= 1'b0; // U < 1,04V -> after_hysteresis = 0 |
| 48 | // Note: was >= 3,53V and <= 1,19V. The new trigger values allow more reliable detection of the first bit |
| 49 | // (it might not reach 3,53V due to the high time constant of the high pass filter in the analogue RF part). |
| 50 | // In addition, the new values are more in line with ISO14443-2: "The PICC shall detect the ”End of Pause” after the field exceeds |
| 51 | // 5% of H_INITIAL and before it exceeds 60% of H_INITIAL." Depending on the signal strength, 60% might well be less than 3,53V. |
| 52 | |
| 53 | |
| 54 | // detecting a loss of reader's field (adc_d < 192 for 4096 clock cycles). If this is the case, |
| 55 | // set the detected reader signal (after_hysteresis) to '1' (unmodulated) |
| 56 | if(adc_d >= 192) |
| 57 | begin |
| 58 | has_been_low_for <= 12'd0; |
| 59 | end |
| 60 | else |
| 61 | begin |
| 62 | if(has_been_low_for == 12'd4095) |
| 63 | begin |
| 64 | has_been_low_for <= 12'd0; |
| 65 | after_hysteresis <= 1'b1; |
| 66 | end |
| 67 | else |
| 68 | begin |
| 69 | has_been_low_for <= has_been_low_for + 1; |
| 70 | end |
| 71 | end |
| 72 | |
| 73 | end |
| 74 | |
| 75 | |
| 76 | |
| 77 | //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// |
| 78 | // Reader -> PM3 |
| 79 | // detect when a reader is active (modulating). We assume that the reader is active, if we see the carrier off for at least 8 |
| 80 | // carrier cycles. We assume that the reader is inactive, if the carrier stayed high for at least 256 carrier cycles. |
| 81 | reg deep_modulation; |
| 82 | reg [2:0] deep_counter; |
| 83 | reg [8:0] saw_deep_modulation; |
| 84 | |
| 85 | always @(negedge adc_clk) |
| 86 | begin |
| 87 | if(~(| adc_d[7:0])) // if adc_d == 0 (U <= 0,94V) |
| 88 | begin |
| 89 | if(deep_counter == 3'd7) // adc_d == 0 for 8 adc_clk ticks -> deep_modulation (by reader) |
| 90 | begin |
| 91 | deep_modulation <= 1'b1; |
| 92 | saw_deep_modulation <= 8'd0; |
| 93 | end |
| 94 | else |
| 95 | deep_counter <= deep_counter + 1; |
| 96 | end |
| 97 | else |
| 98 | begin |
| 99 | deep_counter <= 3'd0; |
| 100 | if(saw_deep_modulation == 8'd255) // adc_d != 0 for 256 adc_clk ticks -> deep_modulation is over, probably waiting for tag's response |
| 101 | deep_modulation <= 1'b0; |
| 102 | else |
| 103 | saw_deep_modulation <= saw_deep_modulation + 1; |
| 104 | end |
| 105 | end |
| 106 | |
| 107 | |
| 108 | |
| 109 | //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// |
| 110 | // Tag -> PM3 |
| 111 | // filter the input for a tag's signal. The filter box needs the 4 previous input values and is a gaussian derivative filter |
| 112 | // for noise reduction and edge detection. |
| 113 | // store 4 previous samples: |
| 114 | reg [7:0] input_prev_4, input_prev_3, input_prev_2, input_prev_1; |
| 115 | // convert to signed signals (and multiply by two for samples at t-4 and t) |
| 116 | wire signed [10:0] input_prev_4_times_2 = {0, 0, input_prev_4, 0}; |
| 117 | wire signed [10:0] input_prev_3_times_1 = {0, 0, 0, input_prev_3}; |
| 118 | wire signed [10:0] input_prev_1_times_1 = {0, 0, 0, input_prev_1}; |
| 119 | wire signed [10:0] adc_d_times_2 = {0, 0, adc_d, 0}; |
| 120 | |
| 121 | wire signed [10:0] tmp_1, tmp_2; |
| 122 | wire signed [10:0] adc_d_filtered; |
| 123 | integer i; |
| 124 | |
| 125 | assign tmp_1 = input_prev_4_times_2 + input_prev_3_times_1; |
| 126 | assign tmp_2 = input_prev_1_times_1 + adc_d_times_2; |
| 127 | |
| 128 | always @(negedge adc_clk) |
| 129 | begin |
| 130 | // for (i = 3; i > 0; i = i - 1) |
| 131 | // begin |
| 132 | // input_shift[i] <= input_shift[i-1]; |
| 133 | // end |
| 134 | // input_shift[0] <= adc_d; |
| 135 | input_prev_4 <= input_prev_3; |
| 136 | input_prev_3 <= input_prev_2; |
| 137 | input_prev_2 <= input_prev_1; |
| 138 | input_prev_1 <= adc_d; |
| 139 | end |
| 140 | |
| 141 | // assign adc_d_filtered = (input_shift[3] << 1) + input_shift[2] - input_shift[0] - (adc_d << 1); |
| 142 | assign adc_d_filtered = tmp_1 - tmp_2; |
| 143 | |
| 144 | |
| 145 | //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// |
| 146 | // internal FPGA timing. Maximum required period is 128 carrier clock cycles for a full 8 Bit transfer to ARM. (i.e. we need a |
| 147 | // 7 bit counter). Adjust its frequency to external reader's clock when simulating a tag or sniffing. |
| 148 | reg pre_after_hysteresis; |
| 149 | reg [3:0] reader_falling_edge_time; |
| 150 | reg [6:0] negedge_cnt; |
| 151 | |
| 152 | always @(negedge adc_clk) |
| 153 | begin |
| 154 | // detect a reader signal's falling edge and remember its timing: |
| 155 | pre_after_hysteresis <= after_hysteresis; |
| 156 | if (pre_after_hysteresis && ~after_hysteresis) |
| 157 | begin |
| 158 | reader_falling_edge_time[3:0] <= negedge_cnt[3:0]; |
| 159 | end |
| 160 | |
| 161 | // adjust internal timer counter if necessary: |
| 162 | if (negedge_cnt[3:0] == 4'd13 && (mod_type == `SNIFFER || mod_type == `TAGSIM_LISTEN) && deep_modulation) |
| 163 | begin |
| 164 | if (reader_falling_edge_time == 4'd1) // reader signal changes right after sampling. Better sample earlier next time. |
| 165 | begin |
| 166 | negedge_cnt <= negedge_cnt + 2; // time warp |
| 167 | end |
| 168 | else if (reader_falling_edge_time == 4'd0) // reader signal changes right before sampling. Better sample later next time. |
| 169 | begin |
| 170 | negedge_cnt <= negedge_cnt; // freeze time |
| 171 | end |
| 172 | else |
| 173 | begin |
| 174 | negedge_cnt <= negedge_cnt + 1; // Continue as usual |
| 175 | end |
| 176 | reader_falling_edge_time[3:0] <= 4'd8; // adjust only once per detected edge |
| 177 | end |
| 178 | else if (negedge_cnt == 7'd127) // normal operation: count from 0 to 127 |
| 179 | begin |
| 180 | negedge_cnt <= 0; |
| 181 | end |
| 182 | else |
| 183 | begin |
| 184 | negedge_cnt <= negedge_cnt + 1; |
| 185 | end |
| 186 | end |
| 187 | |
| 188 | |
| 189 | //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// |
| 190 | // Tag -> PM3: |
| 191 | // determine best possible time for starting/resetting the modulation detector. |
| 192 | reg [3:0] mod_detect_reset_time; |
| 193 | |
| 194 | always @(negedge adc_clk) |
| 195 | begin |
| 196 | if (mod_type == `READER_LISTEN) |
| 197 | // (our) reader signal changes at t=1, tag response expected n*16+4 ticks later, further delayed by |
| 198 | // 3 ticks ADC conversion. |
| 199 | // 1 + 4 + 3 = 8 |
| 200 | begin |
| 201 | mod_detect_reset_time <= 4'd8; |
| 202 | end |
| 203 | else |
| 204 | if (mod_type == `SNIFFER) |
| 205 | begin |
| 206 | // detect a rising edge of reader's signal and sync modulation detector to the tag's answer: |
| 207 | if (~pre_after_hysteresis && after_hysteresis && deep_modulation) |
| 208 | // reader signal rising edge detected at negedge_cnt[3:0]. This signal had been delayed |
| 209 | // 9 ticks by the RF part + 3 ticks by the A/D converter + 1 tick to assign to after_hysteresis. |
| 210 | // The tag will respond n*16 + 4 ticks later + 3 ticks A/D converter delay. |
| 211 | // - 9 - 3 - 1 + 4 + 3 = -6 |
| 212 | begin |
| 213 | mod_detect_reset_time <= negedge_cnt[3:0] - 4'd4; |
| 214 | end |
| 215 | end |
| 216 | end |
| 217 | |
| 218 | |
| 219 | //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// |
| 220 | // Tag -> PM3: |
| 221 | // modulation detector. Looks for the steepest falling and rising edges within a 16 clock period. If there is both a significant |
| 222 | // falling and rising edge (in any order), a modulation is detected. |
| 223 | reg signed [10:0] rx_mod_falling_edge_max; |
| 224 | reg signed [10:0] rx_mod_rising_edge_max; |
| 225 | reg curbit; |
| 226 | |
| 227 | always @(negedge adc_clk) |
| 228 | begin |
| 229 | if(negedge_cnt[3:0] == mod_detect_reset_time) |
| 230 | begin |
| 231 | // detect modulation signal: if modulating, there must have been a falling AND a rising edge |
| 232 | if (rx_mod_falling_edge_max > 5 && rx_mod_rising_edge_max > 5) |
| 233 | curbit <= 1'b1; // modulation |
| 234 | else |
| 235 | curbit <= 1'b0; // no modulation |
| 236 | // reset modulation detector |
| 237 | rx_mod_rising_edge_max <= 0; |
| 238 | rx_mod_falling_edge_max <= 0; |
| 239 | end |
| 240 | else // look for steepest edges (slopes) |
| 241 | begin |
| 242 | if (adc_d_filtered > 0) |
| 243 | begin |
| 244 | if (adc_d_filtered > rx_mod_falling_edge_max) |
| 245 | rx_mod_falling_edge_max <= adc_d_filtered; |
| 246 | end |
| 247 | else |
| 248 | begin |
| 249 | if (-adc_d_filtered > rx_mod_rising_edge_max) |
| 250 | rx_mod_rising_edge_max <= -adc_d_filtered; |
| 251 | end |
| 252 | end |
| 253 | |
| 254 | end |
| 255 | |
| 256 | |
| 257 | |
| 258 | //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// |
| 259 | // Tag+Reader -> PM3 |
| 260 | // sample 4 bits reader data and 4 bits tag data for sniffing |
| 261 | reg [3:0] reader_data; |
| 262 | reg [3:0] tag_data; |
| 263 | |
| 264 | always @(negedge adc_clk) |
| 265 | begin |
| 266 | if(negedge_cnt[3:0] == 4'd0) |
| 267 | begin |
| 268 | reader_data[3:0] <= {reader_data[2:0], after_hysteresis}; |
| 269 | tag_data[3:0] <= {tag_data[2:0], curbit}; |
| 270 | end |
| 271 | end |
| 272 | |
| 273 | |
| 274 | |
| 275 | //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// |
| 276 | // PM3 -> Tag: |
| 277 | // a delay line to ensure that we send the (emulated) tag's answer at the correct time according to ISO14443-3 |
| 278 | reg [31:0] mod_sig_buf; |
| 279 | reg [4:0] mod_sig_ptr; |
| 280 | reg mod_sig; |
| 281 | |
| 282 | always @(negedge adc_clk) |
| 283 | begin |
| 284 | if(negedge_cnt[3:0] == 4'd0) // sample data at rising edge of ssp_clk - ssp_dout changes at the falling edge. |
| 285 | begin |
| 286 | mod_sig_buf[31:2] <= mod_sig_buf[30:1]; // shift |
| 287 | if (~ssp_dout && ~mod_sig_buf[1]) |
| 288 | mod_sig_buf[1] <= 1'b0; // delete the correction bit (a single 1 preceded and succeeded by 0) |
| 289 | else |
| 290 | mod_sig_buf[1] <= mod_sig_buf[0]; |
| 291 | mod_sig_buf[0] <= ssp_dout; // add new data to the delay line |
| 292 | |
| 293 | mod_sig = mod_sig_buf[mod_sig_ptr]; // the delayed signal. |
| 294 | end |
| 295 | end |
| 296 | |
| 297 | |
| 298 | |
| 299 | //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// |
| 300 | // PM3 -> Tag, internal timing: |
| 301 | // a timer for the 1172 cycles fdt (Frame Delay Time). Start the timer with a rising edge of the reader's signal. |
| 302 | // set fdt_elapsed when we no longer need to delay data. Set fdt_indicator when we can start sending data. |
| 303 | // Note: the FPGA only takes care for the 1172 delay. To achieve an additional 1236-1172=64 ticks delay, the ARM must send |
| 304 | // a correction bit (before the start bit). The correction bit will be coded as 00010000, i.e. it adds 4 bits to the |
| 305 | // transmission stream, causing the required additional delay. |
| 306 | reg [10:0] fdt_counter; |
| 307 | reg fdt_indicator, fdt_elapsed; |
| 308 | reg [3:0] mod_sig_flip; |
| 309 | reg [3:0] sub_carrier_cnt; |
| 310 | |
| 311 | // we want to achieve a delay of 1172. The RF part already has delayed the reader signals's rising edge |
| 312 | // by 9 ticks, the ADC took 3 ticks and there is always a delay of 32 ticks by the mod_sig_buf. Therefore need to |
| 313 | // count to 1172 - 9 - 3 - 32 = 1128 |
| 314 | `define FDT_COUNT 11'd1128 |
| 315 | |
| 316 | // The ARM must not send too early, otherwise the mod_sig_buf will overflow, therefore signal that we are ready |
| 317 | // with fdt_indicator. The mod_sig_buf can buffer 29 excess data bits, i.e. a maximum delay of 29 * 16 = 464 adc_clk ticks. |
| 318 | // fdt_indicator could appear at ssp_din after 1 tick, the transfer needs 16 ticks, the ARM can send 128 ticks later. |
| 319 | // 1128 - 464 - 1 - 128 - 8 = 535 |
| 320 | `define FDT_INDICATOR_COUNT 11'd535 |
| 321 | |
| 322 | // reset on a pause in listen mode. I.e. the counter starts when the pause is over: |
| 323 | assign fdt_reset = ~after_hysteresis && mod_type == `TAGSIM_LISTEN; |
| 324 | |
| 325 | always @(negedge adc_clk) |
| 326 | begin |
| 327 | if (fdt_reset) |
| 328 | begin |
| 329 | fdt_counter <= 11'd0; |
| 330 | fdt_elapsed <= 1'b0; |
| 331 | fdt_indicator <= 1'b0; |
| 332 | end |
| 333 | else |
| 334 | begin |
| 335 | if(fdt_counter == `FDT_COUNT) |
| 336 | begin |
| 337 | if(~fdt_elapsed) // just reached fdt. |
| 338 | begin |
| 339 | mod_sig_flip <= negedge_cnt[3:0]; // start modulation at this time |
| 340 | sub_carrier_cnt <= 4'd0; // subcarrier phase in sync with start of modulation |
| 341 | fdt_elapsed <= 1'b1; |
| 342 | end |
| 343 | else |
| 344 | begin |
| 345 | sub_carrier_cnt <= sub_carrier_cnt + 1; |
| 346 | end |
| 347 | end |
| 348 | else |
| 349 | begin |
| 350 | fdt_counter <= fdt_counter + 1; |
| 351 | end |
| 352 | end |
| 353 | |
| 354 | if(fdt_counter == `FDT_INDICATOR_COUNT) fdt_indicator <= 1'b1; |
| 355 | end |
| 356 | |
| 357 | |
| 358 | //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// |
| 359 | // PM3 -> Reader or Tag |
| 360 | // assign a modulation signal to the antenna. This signal is either a delayed signal (to achieve fdt when sending to a reader) |
| 361 | // or undelayed when sending to a tag |
| 362 | reg mod_sig_coil; |
| 363 | |
| 364 | always @(negedge adc_clk) |
| 365 | begin |
| 366 | if (mod_type == `TAGSIM_MOD) // need to take care of proper fdt timing |
| 367 | begin |
| 368 | if(fdt_counter == `FDT_COUNT) |
| 369 | begin |
| 370 | if(fdt_elapsed) |
| 371 | begin |
| 372 | if(negedge_cnt[3:0] == mod_sig_flip) mod_sig_coil <= mod_sig; |
| 373 | end |
| 374 | else |
| 375 | begin |
| 376 | mod_sig_coil <= mod_sig; // just reached fdt. Immediately assign signal to coil |
| 377 | end |
| 378 | end |
| 379 | end |
| 380 | else // other modes: don't delay |
| 381 | begin |
| 382 | mod_sig_coil <= ssp_dout; |
| 383 | end |
| 384 | end |
| 385 | |
| 386 | |
| 387 | |
| 388 | //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// |
| 389 | // PM3 -> Reader |
| 390 | // determine the required delay in the mod_sig_buf (set mod_sig_ptr). |
| 391 | reg temp_buffer_reset; |
| 392 | |
| 393 | always @(negedge adc_clk) |
| 394 | begin |
| 395 | if(fdt_reset) |
| 396 | begin |
| 397 | mod_sig_ptr <= 5'd0; |
| 398 | temp_buffer_reset = 1'b0; |
| 399 | end |
| 400 | else |
| 401 | begin |
| 402 | if(fdt_counter == `FDT_COUNT && ~fdt_elapsed) // if we just reached fdt |
| 403 | if(~(| mod_sig_ptr[4:0])) |
| 404 | mod_sig_ptr <= 5'd8; // ... but didn't buffer a 1 yet, delay next 1 by n*128 ticks. |
| 405 | else |
| 406 | temp_buffer_reset = 1'b1; // else no need for further delays. |
| 407 | |
| 408 | if(negedge_cnt[3:0] == 4'd0) // at rising edge of ssp_clk - ssp_dout changes at the falling edge. |
| 409 | begin |
| 410 | if((ssp_dout || (| mod_sig_ptr[4:0])) && ~fdt_elapsed) // buffer a 1 (and all subsequent data) until fdt is reached. |
| 411 | if (mod_sig_ptr == 5'd31) |
| 412 | mod_sig_ptr <= 5'd0; // buffer overflow - data loss. |
| 413 | else |
| 414 | mod_sig_ptr <= mod_sig_ptr + 1; // increase buffer (= increase delay by 16 adc_clk ticks). mod_sig_ptr always points ahead of first 1. |
| 415 | else if(fdt_elapsed && ~temp_buffer_reset) |
| 416 | begin |
| 417 | // wait for the next 1 after fdt_elapsed before fixing the delay and starting modulation. This ensures that the response can only happen |
| 418 | // at intervals of 8 * 16 = 128 adc_clk ticks (as defined in ISO14443-3) |
| 419 | if(ssp_dout) |
| 420 | temp_buffer_reset = 1'b1; |
| 421 | if(mod_sig_ptr == 5'd1) |
| 422 | mod_sig_ptr <= 5'd8; // still nothing received, need to go for the next interval |
| 423 | else |
| 424 | mod_sig_ptr <= mod_sig_ptr - 1; // decrease buffer. |
| 425 | end |
| 426 | end |
| 427 | end |
| 428 | end |
| 429 | |
| 430 | |
| 431 | |
| 432 | //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// |
| 433 | // FPGA -> ARM communication: |
| 434 | // buffer 8 bits data to be sent to ARM. Shift them out bit by bit. |
| 435 | reg [7:0] to_arm; |
| 436 | |
| 437 | always @(negedge adc_clk) |
| 438 | begin |
| 439 | if (negedge_cnt[5:0] == 6'd63) // fill the buffer |
| 440 | begin |
| 441 | if (mod_type == `SNIFFER) |
| 442 | begin |
| 443 | if(deep_modulation) // a reader is sending (or there's no field at all) |
| 444 | begin |
| 445 | to_arm <= {reader_data[3:0], 4'b0000}; // don't send tag data |
| 446 | end |
| 447 | else |
| 448 | begin |
| 449 | to_arm <= {reader_data[3:0], tag_data[3:0]}; |
| 450 | end |
| 451 | end |
| 452 | else |
| 453 | begin |
| 454 | to_arm[7:0] <= {mod_sig_ptr[4:0], mod_sig_flip[3:1]}; // feedback timing information |
| 455 | end |
| 456 | end |
| 457 | |
| 458 | if(negedge_cnt[2:0] == 3'b000 && mod_type == `SNIFFER) // shift at double speed |
| 459 | begin |
| 460 | // Don't shift if we just loaded new data, obviously. |
| 461 | if(negedge_cnt[5:0] != 6'd0) |
| 462 | begin |
| 463 | to_arm[7:1] <= to_arm[6:0]; |
| 464 | end |
| 465 | end |
| 466 | |
| 467 | if(negedge_cnt[3:0] == 4'b0000 && mod_type != `SNIFFER) |
| 468 | begin |
| 469 | // Don't shift if we just loaded new data, obviously. |
| 470 | if(negedge_cnt[6:0] != 7'd0) |
| 471 | begin |
| 472 | to_arm[7:1] <= to_arm[6:0]; |
| 473 | end |
| 474 | end |
| 475 | |
| 476 | end |
| 477 | |
| 478 | |
| 479 | //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// |
| 480 | // FPGA -> ARM communication: |
| 481 | // generate a ssp clock and ssp frame signal for the synchronous transfer from/to the ARM |
| 482 | reg ssp_clk; |
| 483 | reg ssp_frame; |
| 484 | reg [2:0] ssp_frame_counter; |
| 485 | |
| 486 | always @(negedge adc_clk) |
| 487 | begin |
| 488 | if(mod_type == `SNIFFER) |
| 489 | // SNIFFER mode (ssp_clk = adc_clk / 8, ssp_frame clock = adc_clk / 64)): |
| 490 | begin |
| 491 | if(negedge_cnt[2:0] == 3'd0) |
| 492 | ssp_clk <= 1'b1; |
| 493 | if(negedge_cnt[2:0] == 3'd4) |
| 494 | ssp_clk <= 1'b0; |
| 495 | |
| 496 | if(negedge_cnt[5:0] == 6'd0) // ssp_frame rising edge indicates start of frame |
| 497 | ssp_frame <= 1'b1; |
| 498 | if(negedge_cnt[5:0] == 6'd8) |
| 499 | ssp_frame <= 1'b0; |
| 500 | end |
| 501 | else |
| 502 | // all other modes (ssp_clk = adc_clk / 16, ssp_frame clock = adc_clk / 128): |
| 503 | begin |
| 504 | if(negedge_cnt[3:0] == 4'd0) |
| 505 | ssp_clk <= 1'b1; |
| 506 | if(negedge_cnt[3:0] == 4'd8) |
| 507 | ssp_clk <= 1'b0; |
| 508 | |
| 509 | if(negedge_cnt[6:0] == 7'd7) // ssp_frame rising edge indicates start of frame |
| 510 | ssp_frame <= 1'b1; |
| 511 | if(negedge_cnt[6:0] == 7'd23) |
| 512 | ssp_frame <= 1'b0; |
| 513 | end |
| 514 | end |
| 515 | |
| 516 | |
| 517 | |
| 518 | //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// |
| 519 | // FPGA -> ARM communication: |
| 520 | // select the data to be sent to ARM |
| 521 | reg bit_to_arm; |
| 522 | reg sendbit; |
| 523 | |
| 524 | always @(negedge adc_clk) |
| 525 | begin |
| 526 | if(negedge_cnt[3:0] == 4'd0) |
| 527 | begin |
| 528 | // What do we communicate to the ARM |
| 529 | if(mod_type == `TAGSIM_LISTEN) |
| 530 | sendbit = after_hysteresis; |
| 531 | else if(mod_type == `TAGSIM_MOD) |
| 532 | /* if(fdt_counter > 11'd772) sendbit = mod_sig_coil; // huh? |
| 533 | else */ |
| 534 | sendbit = fdt_indicator; |
| 535 | else if (mod_type == `READER_LISTEN) |
| 536 | sendbit = curbit; |
| 537 | else |
| 538 | sendbit = 1'b0; |
| 539 | end |
| 540 | |
| 541 | |
| 542 | if(mod_type == `SNIFFER) |
| 543 | // send sampled reader and tag data: |
| 544 | bit_to_arm = to_arm[7]; |
| 545 | else if (mod_type == `TAGSIM_MOD && fdt_elapsed && temp_buffer_reset) |
| 546 | // send timing information: |
| 547 | bit_to_arm = to_arm[7]; |
| 548 | else |
| 549 | // send data or fdt_indicator |
| 550 | bit_to_arm = sendbit; |
| 551 | end |
| 552 | |
| 553 | |
| 554 | |
| 555 | |
| 556 | assign ssp_din = bit_to_arm; |
| 557 | |
| 558 | // Subcarrier (adc_clk/16, for TAGSIM_MOD only). |
| 559 | wire sub_carrier; |
| 560 | assign sub_carrier = ~sub_carrier_cnt[3]; |
| 561 | |
| 562 | // in READER_MOD: drop carrier for mod_sig_coil==1 (pause); in READER_LISTEN: carrier always on; in other modes: carrier always off |
| 563 | assign pwr_hi = (ck_1356megb & (((mod_type == `READER_MOD) & ~mod_sig_coil) || (mod_type == `READER_LISTEN))); |
| 564 | |
| 565 | |
| 566 | // Enable HF antenna drivers: |
| 567 | assign pwr_oe1 = 1'b0; |
| 568 | assign pwr_oe3 = 1'b0; |
| 569 | |
| 570 | // TAGSIM_MOD: short circuit antenna with different resistances (modulated by sub_carrier modulated by mod_sig_coil) |
| 571 | // for pwr_oe4 = 1 (tristate): antenna load = 10k || 33 = 32,9 Ohms |
| 572 | // for pwr_oe4 = 0 (active): antenna load = 10k || 33 || 33 = 16,5 Ohms |
| 573 | assign pwr_oe4 = ~(mod_sig_coil & sub_carrier & (mod_type == `TAGSIM_MOD)); |
| 574 | |
| 575 | // This is all LF, so doesn't matter. |
| 576 | assign pwr_oe2 = 1'b0; |
| 577 | assign pwr_lo = 1'b0; |
| 578 | |
| 579 | |
| 580 | assign dbg = negedge_cnt[3]; |
| 581 | |
| 582 | endmodule |