+/*------------------------------
+ * T5555/T5557/T5567/T5577 routines
+ *------------------------------
+ * NOTE: T55x7/T5555 configuration register definitions moved to protocols.h
+ *
+ * Relevant communication times in microsecond
+ * To compensate antenna falling times shorten the write times
+ * and enlarge the gap ones.
+ * Q5 tags seems to have issues when these values changes.
+ */
+
+ /*
+ // Original Timings for reference
+//note startgap must be sent after tag has been powered up for more than 3ms (per T5557 ds)
+
+#define START_GAP 31*8 // was 250 // SPEC: 1*8 to 50*8 - typ 15*8 (or 15fc)
+#define WRITE_GAP 20*8 // was 160 // SPEC: 1*8 to 20*8 - typ 10*8 (or 10fc)
+#define WRITE_0 18*8 // was 144 // SPEC: 16*8 to 32*8 - typ 24*8 (or 24fc)
+#define WRITE_1 50*8 // was 400 // SPEC: 48*8 to 64*8 - typ 56*8 (or 56fc) 432 for T55x7; 448 for E5550
+#define READ_GAP 15*8
+
+*/
+/* Q5 timing datasheet:
+ * Type | MIN | Typical | Max |
+ * Start_Gap | 10*8 | ? | 50*8 |
+ * Write_Gap Normal mode | 8*8 | 14*8 | 20*8 |
+ * Write_Gap Fast Mode | 8*8 | ? | 20*8 |
+ * Write_0 Normal mode | 16*8 | 24*8 | 32*8 |
+ * Write_1 Normal mode | 48*8 | 56*8 | 64*8 |
+ * Write_0 Fast Mode | 8*8 | 12*8 | 16*8 |
+ * Write_1 Fast Mode | 24*8 | 28*8 | 32*8 |
+*/
+
+/* T5557 timing datasheet:
+ * Type | MIN | Typical | Max |
+ * Start_Gap | 10*8 | ? | 50*8 |
+ * Write_Gap Normal mode | 8*8 |50-150us | 30*8 |
+ * Write_Gap Fast Mode | 8*8 | ? | 20*8 |
+ * Write_0 Normal mode | 16*8 | 24*8 | 31*8 |
+ * Write_1 Normal mode | 48*8 | 54*8 | 63*8 |
+ * Write_0 Fast Mode | 8*8 | 12*8 | 15*8 |
+ * Write_1 Fast Mode | 24*8 | 28*8 | 31*8 |
+*/
+
+/* T5577C timing datasheet for Fixed-Bit-Length protocol (defualt):
+ * Type | MIN | Typical | Max |
+ * Start_Gap | 8*8 | 15*8 | 50*8 |
+ * Write_Gap Normal mode | 8*8 | 10*8 | 20*8 |
+ * Write_Gap Fast Mode | 8*8 | 10*8 | 20*8 |
+ * Write_0 Normal mode | 16*8 | 24*8 | 32*8 |
+ * Write_1 Normal mode | 48*8 | 56*8 | 64*8 |
+ * Write_0 Fast Mode | 8*8 | 12*8 | 16*8 |
+ * Write_1 Fast Mode | 24*8 | 28*8 | 32*8 |
+*/
+
+// Structure to hold Timing values. In future will be simplier to add user changable timings.
+typedef struct {
+ uint16_t START_GAP;
+ uint16_t WRITE_GAP;
+ uint16_t WRITE_0;
+ uint16_t WRITE_1;
+ uint16_t WRITE_2;
+ uint16_t WRITE_3;
+ uint16_t READ_GAP;
+} T55xx_Timing;
+
+// Set Initial/Default Values. Note: *8 can occure when used. This should keep things simplier here.
+T55xx_Timing T55xx_Timing_FixedBit = { 31 * 8 , 20 * 8 , 18 * 8 , 50 * 8 , 0 , 0 , 15 * 8 };
+T55xx_Timing T55xx_Timing_LLR = { 31 * 8 , 20 * 8 , 18 * 8 , 50 * 8 , 0 , 0 , 15 * 8 };
+T55xx_Timing T55xx_Timing_Leading0 = { 31 * 8 , 20 * 8 , 18 * 8 , 40 * 8 , 0 , 0 , 15 * 8 };
+T55xx_Timing T55xx_Timing_1of4 = { 31 * 8 , 20 * 8 , 18 * 8 , 34 * 8 , 50 * 8 , 66 * 8 , 15 * 8 };
+
+// Some defines for readability
+#define T55xx_DLMode_Fixed 0 // Default Mode
+#define T55xx_DLMode_LLR 1 // Long Leading Reference
+#define T55xx_DLMode_Leading0 2 // Leading Zero
+#define T55xx_DLMode_1of4 3 // 1 of 4
+#define T55xx_LongLeadingReference 4 // Value to tell Write Bit to send long reference
+// Macro for code readability
+#define BitStream_Byte(X) ((X) >> 3)
+#define BitStream_Bit(X) ((X) & 7)
+
+
+void TurnReadLFOn(int delay) {
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
+ // Give it a bit of time for the resonant antenna to settle.
+ WaitUS(delay); //155*8 //50*8
+}
+
+// Write one bit to card
+void T55xxWriteBit(int bit, T55xx_Timing *Timings) {
+
+ // If bit = 4 Send Long Leading Reference which is 138 + WRITE_0
+ // Dbprintf ("Bits : %d",bit);
+ switch (bit){
+ case 0 : TurnReadLFOn(Timings->WRITE_0); break; // Send bit 0/00
+ case 1 : TurnReadLFOn(Timings->WRITE_1); break; // Send bit 1/01
+ case 2 : TurnReadLFOn(Timings->WRITE_2); break; // Send bits 10
+ case 3 : TurnReadLFOn(Timings->WRITE_3); break; // Send bits 11
+ case 4 : TurnReadLFOn(Timings->WRITE_0 + (136 * 8)); break; // Send Long Leading Reference
+ }
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+ WaitUS(Timings->WRITE_GAP);
+}
+
+// Function to abstract an Arbitrary length byte array to store bit pattern.
+// bit_array - Array to hold data/bit pattern
+// start_offset - bit location to start storing new bits.
+// data - upto 32 bits of data to store
+// num_bits - how many bits (low x bits of data) Max 32 bits at a time
+// max_len - how many bytes can the bit_array hold (ensure no buffer overflow)
+// returns "Next" bit offset / bits stored (for next store)
+//int T55xx_SetBits (uint8_t *bit_array, int start_offset, uint32_t data , int num_bits, int max_len)
+int T55xx_SetBits (uint8_t *BitStream, uint8_t start_offset, uint32_t data , uint8_t num_bits, uint8_t max_len)
+{
+ int8_t offset;
+ int8_t NextOffset = start_offset;
+
+ // Check if data will fit.
+ if ((start_offset + num_bits) <= (max_len*8)) {
+ // Loop through the data and store
+ for (offset = (num_bits-1); offset >= 0; offset--) {
+
+ if ((data >> offset) & 1) BitStream[BitStream_Byte(NextOffset)] |= (1 << BitStream_Bit(NextOffset)); // Set the bit to 1
+ else BitStream[BitStream_Byte(NextOffset)] &= (0xff ^ (1 << BitStream_Bit(NextOffset))); // Set the bit to 0
+
+ NextOffset++;
+ }
+ }
+ else {
+ // Note: This should never happen unless some code changes cause it.
+ // So short message for coders when testing.
+ Dbprintf ("T55 too many bits");
+ }
+ return NextOffset;
+}
+
+// Send one downlink command to the card
+void T55xx_SendCMD (uint32_t Data, uint32_t Block, uint32_t Pwd, uint8_t arg) {
+
+ /*
+ arg bits
+ xxxxxxx1 0x01 PwdMode
+ xxxxxx1x 0x02 Page
+ xxxxx1xx 0x04 testMode
+ xxx11xxx 0x18 downlink mode
+ xx1xxxxx 0x20 !reg_readmode
+ x1xxxxxx 0x40 called for a read, so no data packet
+ 1xxxxxxx 0x80 reset
+
+ */
+ bool PwdMode = ((arg & 0x01) == 0x01);
+ bool Page = (arg & 0x02);
+ bool testMode = ((arg & 0x04) == 0x04);
+ uint8_t downlink_mode = (arg >> 3) & 0x03;
+ bool reg_readmode = ((arg & 0x20) == 0x20);
+ bool read_cmd = ((arg & 0x40) == 0x40);
+ bool reset = (arg & 0x80);
+
+ uint8_t i = 0;
+ uint8_t BitStream[10]; // Max Downlink Command size ~74 bits, so 10 bytes (80 bits)
+ uint8_t BitStreamLen;
+ T55xx_Timing *Timing;
+ uint8_t SendBits;
+
+ // Assigning Downlink Timeing for write
+ switch (downlink_mode)
+ {
+ case T55xx_DLMode_Fixed : Timing = &T55xx_Timing_FixedBit; break;
+ case T55xx_DLMode_LLR : Timing = &T55xx_Timing_LLR; break;
+ case T55xx_DLMode_Leading0 : Timing = &T55xx_Timing_Leading0; break;
+ case T55xx_DLMode_1of4 : Timing = &T55xx_Timing_1of4; break;
+ default:
+ Timing = &T55xx_Timing_FixedBit;
+ }
+
+ // Build Bit Stream to send.
+ memset (BitStream,0x00,sizeof(BitStream));
+
+ BitStreamLen = 0; // Ensure 0 bit index to start.
+
+ // Add Leading 0 and 1 of 4 reference bit
+ if ((downlink_mode == T55xx_DLMode_Leading0) || (downlink_mode == T55xx_DLMode_1of4))
+ BitStreamLen = T55xx_SetBits (BitStream, BitStreamLen, 0, 1,sizeof(BitStream));
+
+ // Add extra reference 0 for 1 of 4
+ if (downlink_mode == T55xx_DLMode_1of4)
+ BitStreamLen = T55xx_SetBits (BitStream, BitStreamLen, 0, 1,sizeof(BitStream));
+
+ // Add Opcode
+ if (reset) {
+ // Reset : r*) 00
+ BitStreamLen = T55xx_SetBits (BitStream, BitStreamLen, 0, 2,sizeof(BitStream));
+ }
+ else
+ {
+ if (testMode) Dbprintf("TestMODE");
+ BitStreamLen = T55xx_SetBits (BitStream, BitStreamLen,testMode ? 0 : 1 , 1,sizeof(BitStream));
+ BitStreamLen = T55xx_SetBits (BitStream, BitStreamLen,testMode ? 1 : Page , 1,sizeof(BitStream));
+
+ if (PwdMode) {
+ // Leading 0 and 1 of 4 00 fixed bits if passsword used
+ if ((downlink_mode == T55xx_DLMode_Leading0) || (downlink_mode == T55xx_DLMode_1of4)) {
+ BitStreamLen = T55xx_SetBits (BitStream, BitStreamLen, 0, 2,sizeof(BitStream));
+ }
+ BitStreamLen = T55xx_SetBits (BitStream, BitStreamLen, Pwd, 32,sizeof(BitStream));
projects / proxmark3-svn / blobdiff