2 * LEGIC RF simulation code
4 * (c) 2009 Henryk Plötz <henryk@ploetzli.ch>
12 static struct legic_frame
{
17 static char response
= 0x2b; /* 1101 01 */
19 static void frame_send(char *response
, int num_bytes
, int num_bits
)
22 /* Use the SSC to send a response. 8-bit transfers, LSBit first, 100us per bit */
24 /* Bitbang the response */
25 AT91C_BASE_PIOA
->PIO_CODR
= GPIO_SSC_DOUT
;
26 AT91C_BASE_PIOA
->PIO_OER
= GPIO_SSC_DOUT
;
27 AT91C_BASE_PIOA
->PIO_PER
= GPIO_SSC_DOUT
;
29 /* Wait for the frame start */
30 while(AT91C_BASE_TC1
->TC_CV
< 490) ;
33 for(i
=0; i
<(num_bytes
*8+num_bits
); i
++) {
34 int nextbit
= AT91C_BASE_TC1
->TC_CV
+ 150;
35 int bit
= response
[i
/8] & (1<<(i
%8));
37 AT91C_BASE_PIOA
->PIO_SODR
= GPIO_SSC_DOUT
;
39 AT91C_BASE_PIOA
->PIO_CODR
= GPIO_SSC_DOUT
;
40 while(AT91C_BASE_TC1
->TC_CV
< nextbit
) ;
42 AT91C_BASE_PIOA
->PIO_CODR
= GPIO_SSC_DOUT
;
46 static void frame_respond(struct legic_frame
*f
)
49 if(f
->num_bytes
== 0 && f
->num_bits
== 7) {
50 /* This seems to be the initial dialogue, just send 6 bits of static data */
51 frame_send(&response
, 0, 6);
56 static void frame_append_bit(struct legic_frame
*f
, int bit
)
58 if(f
->num_bytes
>= (int)sizeof(f
->data
))
59 return; /* Overflow, won't happen */
60 f
->data
[f
->num_bytes
] |= (bit
<<f
->num_bits
);
68 static int frame_is_empty(struct legic_frame
*f
)
70 return( (f
->num_bytes
+ f
->num_bits
) <= 4 );
73 static void frame_handle(struct legic_frame
*f
)
75 if( !frame_is_empty(f
) ) {
80 static void frame_clean(struct legic_frame
*f
)
82 if(!frame_is_empty(f
))
83 memset(f
->data
, 0, sizeof(f
->data
));
88 static void emit(int bit
)
91 frame_handle(¤t_frame
);
92 frame_clean(¤t_frame
);
94 frame_append_bit(¤t_frame
, 0);
96 frame_append_bit(¤t_frame
, 1);
100 void LegicRfSimulate(void)
102 /* ADC path high-frequency peak detector, FPGA in high-frequency simulator mode,
103 * modulation mode set to 212kHz subcarrier. We are getting the incoming raw
104 * envelope waveform on DIN and should send our response on DOUT.
106 * The LEGIC RF protocol is pulse-pause-encoding from reader to card, so we'll
107 * measure the time between two rising edges on DIN, and no encoding on the
108 * subcarrier from card to reader, so we'll just shift out our verbatim data
109 * on DOUT, 1 bit is 100us. The time from reader to card frame is still unclear,
110 * seems to be 300us-ish.
112 SetAdcMuxFor(GPIO_MUXSEL_HIPKD
);
114 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR
| FPGA_HF_SIMULATOR_MODULATE_212K
);
116 /* Bitbang the receiver */
117 AT91C_BASE_PIOA
->PIO_ODR
= GPIO_SSC_DIN
;
118 AT91C_BASE_PIOA
->PIO_PER
= GPIO_SSC_DIN
;
120 /* Set up Timer 1 to use for measuring time between pulses. Since we're bit-banging
121 * this it won't be terribly accurate but should be good enough.
123 AT91C_BASE_PMC
->PMC_PCER
= (1 << AT91C_ID_TC1
);
124 AT91C_BASE_TC1
->TC_CCR
= AT91C_TC_CLKDIS
;
125 AT91C_BASE_TC1
->TC_CMR
= TC_CMR_TCCLKS_TIMER_CLOCK3
;
126 AT91C_BASE_TC1
->TC_CCR
= AT91C_TC_CLKEN
| AT91C_TC_SWTRG
;
129 /* At TIMER_CLOCK3 (MCK/32) */
130 #define BIT_TIME_1 150
131 #define BIT_TIME_0 90
132 #define BIT_TIME_FUZZ 20
135 while(!BUTTON_PRESS()) {
136 int level
= !!(AT91C_BASE_PIOA
->PIO_PDSR
& GPIO_SSC_DIN
);
137 int time
= AT91C_BASE_TC1
->TC_CV
;
139 if(level
!= old_level
) {
141 AT91C_BASE_TC1
->TC_CCR
= AT91C_TC_CLKEN
| AT91C_TC_SWTRG
;
142 if(time
> (BIT_TIME_1
-BIT_TIME_FUZZ
) && time
< (BIT_TIME_1
+BIT_TIME_FUZZ
)) {
146 } else if(time
> (BIT_TIME_0
-BIT_TIME_FUZZ
) && time
< (BIT_TIME_0
+BIT_TIME_FUZZ
)) {
158 if(time
>= (BIT_TIME_1
+2*BIT_TIME_FUZZ
) && active
) {
164 if(time
>= (20*BIT_TIME_1
) && (AT91C_BASE_TC1
->TC_SR
& AT91C_TC_CLKSTA
)) {
165 AT91C_BASE_TC1
->TC_CCR
= AT91C_TC_CLKDIS
;