//-----------------------------------------------------------------------------
// Jonathan Westhues, split Nov 2006
+// piwi 2018
//
// This code is licensed to you under the terms of the GNU GPL, version 2 or,
// at your option, any later version. See the LICENSE.txt file for the text of
#include "iso14443crc.h"
-#define RECEIVE_SAMPLES_TIMEOUT 2000
-#define ISO14443B_DMA_BUFFER_SIZE 256
+#define RECEIVE_SAMPLES_TIMEOUT 1000 // TR0 max is 256/fs = 256/(848kHz) = 302us or 64 samples from FPGA. 1000 seems to be much too high?
+#define ISO14443B_DMA_BUFFER_SIZE 128
// PCB Block number for APDUs
static uint8_t pcb_blocknum = 0;
// We need to listen to the high-frequency, peak-detected path.
SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
- FpgaSetupSsc();
+ FpgaSetupSsc(FPGA_MAJOR_MODE_HF_SIMULATOR);
cmdsRecvd = 0;
LED_D_OFF();
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_BPSK);
AT91C_BASE_SSC->SSC_THR = 0xff;
- FpgaSetupSsc();
+ FpgaSetupSsc(FPGA_MAJOR_MODE_HF_SIMULATOR);
// Transmit the response.
uint16_t i = 0;
#define SUBCARRIER_DETECT_THRESHOLD 8
-// Subcarrier amplitude v = sqrt(ci^2 + cq^2), approximated here by abs(ci) + abs(cq)
-/* #define CHECK_FOR_SUBCARRIER() { \
- v = ci; \
- if(v < 0) v = -v; \
- if(cq > 0) { \
- v += cq; \
- } else { \
- v -= cq; \
- } \
- }
- */
// Subcarrier amplitude v = sqrt(ci^2 + cq^2), approximated here by max(abs(ci),abs(cq)) + 1/2*min(abs(ci),abs(cq)))
-
- //note: couldn't we just use MAX(ABS(ci),ABS(cq)) + (MIN(ABS(ci),ABS(cq))/2) from common.h - marshmellow
-#define CHECK_FOR_SUBCARRIER() { \
- v = MAX(ABS(ci),ABS(cq)) + (MIN(ABS(ci),ABS(cq))/2); \
- }
- /*
- if(ci < 0) { \
- if(cq < 0) { \ // ci < 0, cq < 0
- if (cq < ci) { \
- v = -cq - (ci >> 1); \
- } else { \
- v = -ci - (cq >> 1); \
- } \
- } else { \ // ci < 0, cq >= 0
- if (cq < -ci) { \
- v = -ci + (cq >> 1); \
- } else { \
- v = cq - (ci >> 1); \
- } \
- } \
- } else { \
- if(cq < 0) { \ // ci >= 0, cq < 0
- if (-cq < ci) { \
- v = ci - (cq >> 1); \
- } else { \
- v = -cq + (ci >> 1); \
- } \
- } else { \ // ci >= 0, cq >= 0
- if (cq < ci) { \
- v = ci + (cq >> 1); \
- } else { \
- v = cq + (ci >> 1); \
- } \
- } \
- } \
- }
- */
-
+#define AMPLITUDE(ci,cq) (MAX(ABS(ci),ABS(cq)) + (MIN(ABS(ci),ABS(cq))/2))
switch(Demod.state) {
case DEMOD_UNSYNCD:
- CHECK_FOR_SUBCARRIER();
- if(v > SUBCARRIER_DETECT_THRESHOLD) { // subcarrier detected
+ if(AMPLITUDE(ci,cq) > SUBCARRIER_DETECT_THRESHOLD) { // subcarrier detected
Demod.state = DEMOD_PHASE_REF_TRAINING;
Demod.sumI = ci;
Demod.sumQ = cq;
case DEMOD_PHASE_REF_TRAINING:
if(Demod.posCount < 8) {
- CHECK_FOR_SUBCARRIER();
- if (v > SUBCARRIER_DETECT_THRESHOLD) {
+ if (AMPLITUDE(ci,cq) > SUBCARRIER_DETECT_THRESHOLD) {
// set the reference phase (will code a logic '1') by averaging over 32 1/fs.
// note: synchronization time > 80 1/fs
Demod.sumI += ci;
*/
static void GetSamplesFor14443bDemod(int n, bool quiet)
{
- int max = 0;
+ int maxBehindBy = 0;
bool gotFrame = false;
- int lastRxCounter, ci, cq, samples = 0;
-
+ int lastRxCounter, samples = 0;
+ int8_t ci, cq;
+
// Allocate memory from BigBuf for some buffers
// free all previous allocations first
BigBuf_free();
uint8_t *receivedResponse = BigBuf_malloc(MAX_FRAME_SIZE);
// The DMA buffer, used to stream samples from the FPGA
- int8_t *dmaBuf = (int8_t*) BigBuf_malloc(ISO14443B_DMA_BUFFER_SIZE);
+ uint16_t *dmaBuf = (uint16_t*) BigBuf_malloc(ISO14443B_DMA_BUFFER_SIZE * sizeof(uint16_t));
// Set up the demodulator for tag -> reader responses.
DemodInit(receivedResponse);
+ // wait for last transfer to complete
+ while (!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_TXEMPTY))
+
// Setup and start DMA.
+ FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
FpgaSetupSscDma((uint8_t*) dmaBuf, ISO14443B_DMA_BUFFER_SIZE);
- int8_t *upTo = dmaBuf;
+ uint16_t *upTo = dmaBuf;
lastRxCounter = ISO14443B_DMA_BUFFER_SIZE;
// Signal field is ON with the appropriate LED:
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ);
for(;;) {
- int behindBy = lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR;
- if(behindBy > max) max = behindBy;
-
- while(((lastRxCounter-AT91C_BASE_PDC_SSC->PDC_RCR) & (ISO14443B_DMA_BUFFER_SIZE-1)) > 2) {
- ci = upTo[0];
- cq = upTo[1];
- upTo += 2;
- if(upTo >= dmaBuf + ISO14443B_DMA_BUFFER_SIZE) {
- upTo = dmaBuf;
- AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) upTo;
- AT91C_BASE_PDC_SSC->PDC_RNCR = ISO14443B_DMA_BUFFER_SIZE;
- }
- lastRxCounter -= 2;
- if(lastRxCounter <= 0) {
- lastRxCounter += ISO14443B_DMA_BUFFER_SIZE;
- }
+ int behindBy = (lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR) & (ISO14443B_DMA_BUFFER_SIZE-1);
+ if(behindBy > maxBehindBy) {
+ maxBehindBy = behindBy;
+ }
- samples += 2;
+ if(behindBy < 1) continue;
- if(Handle14443bSamplesDemod(ci, cq)) {
- gotFrame = true;
- break;
- }
+ ci = *upTo >> 8;
+ cq = *upTo;
+ upTo++;
+ lastRxCounter--;
+ if(upTo >= dmaBuf + ISO14443B_DMA_BUFFER_SIZE) { // we have read all of the DMA buffer content.
+ upTo = dmaBuf; // start reading the circular buffer from the beginning
+ lastRxCounter += ISO14443B_DMA_BUFFER_SIZE;
+ }
+ if (AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_ENDRX)) { // DMA Counter Register had reached 0, already rotated.
+ AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf; // refresh the DMA Next Buffer and
+ AT91C_BASE_PDC_SSC->PDC_RNCR = ISO14443B_DMA_BUFFER_SIZE; // DMA Next Counter registers
+ }
+ samples++;
+
+ if(Handle14443bSamplesDemod(ci, cq)) {
+ gotFrame = true;
+ break;
}
- if(samples > n || gotFrame) {
+ if(samples > n) {
break;
}
}
- AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTDIS;
+ FpgaDisableSscDma();
- if (!quiet) Dbprintf("max behindby = %d, samples = %d, gotFrame = %d, Demod.len = %d, Demod.sumI = %d, Demod.sumQ = %d", max, samples, gotFrame, Demod.len, Demod.sumI, Demod.sumQ);
+ if (!quiet) Dbprintf("max behindby = %d, samples = %d, gotFrame = %d, Demod.len = %d, Demod.sumI = %d, Demod.sumQ = %d", maxBehindBy, samples, gotFrame, Demod.len, Demod.sumI, Demod.sumQ);
//Tracing
if (tracing && Demod.len > 0) {
uint8_t parity[MAX_PARITY_SIZE];
{
int c;
- FpgaSetupSsc();
-
- while(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
- AT91C_BASE_SSC->SSC_THR = 0xff;
- }
+ FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER_TX);
// Signal field is ON with the appropriate Red LED
LED_D_ON();
LED_B_ON();
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX | FPGA_HF_READER_TX_SHALLOW_MOD);
- for(c = 0; c < 10;) {
- if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
- AT91C_BASE_SSC->SSC_THR = 0xff;
- c++;
- }
- if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
- volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;
- (void)r;
- }
- WDT_HIT();
- }
-
c = 0;
for(;;) {
if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
- AT91C_BASE_SSC->SSC_THR = ToSend[c];
+ AT91C_BASE_SSC->SSC_THR = ~ToSend[c];
c++;
if(c >= ToSendMax) {
break;
}
}
- if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
- volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;
- (void)r;
- }
WDT_HIT();
}
LED_B_OFF(); // Finished sending
ToSendReset();
- // Establish initial reference level
- for(i = 0; i < 40; i++) {
- ToSendStuffBit(1);
- }
// Send SOF
for(i = 0; i < 10; i++) {
ToSendStuffBit(0);
}
+ ToSendStuffBit(1);
+ ToSendStuffBit(1);
for(i = 0; i < len; i++) {
- // Stop bits/EGT
- ToSendStuffBit(1);
- ToSendStuffBit(1);
// Start bit
ToSendStuffBit(0);
// Data bits
}
b >>= 1;
}
+ // Stop bit
+ ToSendStuffBit(1);
}
+
// Send EOF
- ToSendStuffBit(1);
for(i = 0; i < 10; i++) {
ToSendStuffBit(0);
}
- for(i = 0; i < 8; i++) {
- ToSendStuffBit(1);
- }
+ ToSendStuffBit(1);
- // And then a little more, to make sure that the last character makes
- // it out before we switch to rx mode.
- for(i = 0; i < 24; i++) {
+ // ensure that last byte is filled up
+ for(i = 0; i < 8; i++) {
ToSendStuffBit(1);
}
// send
CodeAndTransmit14443bAsReader(message_frame, message_length + 4);
// get response
- GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT*100, true);
+ GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);
if(Demod.len < 3)
{
return 0;
void iso14443b_setup() {
FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
// Set up the synchronous serial port
- FpgaSetupSsc();
+ FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER_TX);
// connect Demodulated Signal to ADC:
SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
LED_D_ON();
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX | FPGA_HF_READER_TX_SHALLOW_MOD);
- // Start the timer
- StartCountSspClk();
-
DemodReset();
UartReset();
}
SpinDelay(200);
SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
- FpgaSetupSsc();
+ FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
// Now give it time to spin up.
// Signal field is on with the appropriate LED
if (Demod.len == 0) {
DbpString("No response from tag");
+ LED_D_OFF();
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
return;
} else {
Dbprintf("Randomly generated Chip ID (+ 2 byte CRC): %02x %02x %02x",
GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);
if (Demod.len != 3) {
Dbprintf("Expected 3 bytes from tag, got %d", Demod.len);
+ LED_D_OFF();
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
return;
}
// Check the CRC of the answer:
ComputeCrc14443(CRC_14443_B, Demod.output, 1 , &cmd1[2], &cmd1[3]);
if(cmd1[2] != Demod.output[1] || cmd1[3] != Demod.output[2]) {
DbpString("CRC Error reading select response.");
+ LED_D_OFF();
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
return;
}
// Check response from the tag: should be the same UID as the command we just sent:
if (cmd1[1] != Demod.output[0]) {
Dbprintf("Bad response to SELECT from Tag, aborting: %02x %02x", cmd1[1], Demod.output[0]);
+ LED_D_OFF();
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
return;
}
GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);
if (Demod.len != 10) {
Dbprintf("Expected 10 bytes from tag, got %d", Demod.len);
+ LED_D_OFF();
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
return;
}
// The check the CRC of the answer (use cmd1 as temporary variable):
GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);
if (Demod.len != 6) { // Check if we got an answer from the tag
DbpString("Expected 6 bytes from tag, got less...");
+ LED_D_OFF();
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
return;
}
// The check the CRC of the answer (use cmd1 as temporary variable):
}
i++;
}
+
+ LED_D_OFF();
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
}
*/
void RAMFUNC SnoopIso14443b(void)
{
- // We won't start recording the frames that we acquire until we trigger;
- // a good trigger condition to get started is probably when we see a
- // response from the tag.
- int triggered = true; // TODO: set and evaluate trigger condition
-
FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
BigBuf_free();
set_tracing(true);
// The DMA buffer, used to stream samples from the FPGA
- int8_t *dmaBuf = (int8_t*) BigBuf_malloc(ISO14443B_DMA_BUFFER_SIZE);
+ uint16_t *dmaBuf = (uint16_t*) BigBuf_malloc(ISO14443B_DMA_BUFFER_SIZE * sizeof(uint16_t));
int lastRxCounter;
- int8_t *upTo;
- int ci, cq;
+ uint16_t *upTo;
+ int8_t ci, cq;
int maxBehindBy = 0;
// Count of samples received so far, so that we can include timing
SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
// Setup for the DMA.
- FpgaSetupSsc();
+ FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
upTo = dmaBuf;
lastRxCounter = ISO14443B_DMA_BUFFER_SIZE;
FpgaSetupSscDma((uint8_t*) dmaBuf, ISO14443B_DMA_BUFFER_SIZE);
bool TagIsActive = false;
bool ReaderIsActive = false;
+ // We won't start recording the frames that we acquire until we trigger.
+ // A good trigger condition to get started is probably when we see a
+ // reader command
+ bool triggered = false;
// And now we loop, receiving samples.
for(;;) {
- int behindBy = (lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR) &
- (ISO14443B_DMA_BUFFER_SIZE-1);
+ int behindBy = (lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR) & (ISO14443B_DMA_BUFFER_SIZE-1);
if(behindBy > maxBehindBy) {
maxBehindBy = behindBy;
}
- if(behindBy < 2) continue;
+ if(behindBy < 1) continue;
- ci = upTo[0];
- cq = upTo[1];
- upTo += 2;
- lastRxCounter -= 2;
- if(upTo >= dmaBuf + ISO14443B_DMA_BUFFER_SIZE) {
- upTo = dmaBuf;
+ ci = *upTo>>8;
+ cq = *upTo;
+ upTo++;
+ lastRxCounter--;
+ if(upTo >= dmaBuf + ISO14443B_DMA_BUFFER_SIZE) { // we have read all of the DMA buffer content.
+ upTo = dmaBuf; // start reading the circular buffer from the beginning again
lastRxCounter += ISO14443B_DMA_BUFFER_SIZE;
- AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf;
- AT91C_BASE_PDC_SSC->PDC_RNCR = ISO14443B_DMA_BUFFER_SIZE;
- WDT_HIT();
- if(behindBy > (9*ISO14443B_DMA_BUFFER_SIZE/10)) { // TODO: understand whether we can increase/decrease as we want or not?
- Dbprintf("blew circular buffer! behindBy=%d", behindBy);
- break;
- }
- if(!tracing) {
- DbpString("Reached trace limit");
+ if(behindBy > (9*ISO14443B_DMA_BUFFER_SIZE/10)) {
+ Dbprintf("About to blow circular buffer - aborted! behindBy=%d", behindBy);
break;
}
+ }
+ if (AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_ENDRX)) { // DMA Counter Register had reached 0, already rotated.
+ AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf; // refresh the DMA Next Buffer and
+ AT91C_BASE_PDC_SSC->PDC_RNCR = ISO14443B_DMA_BUFFER_SIZE; // DMA Next Counter registers
+ WDT_HIT();
if(BUTTON_PRESS()) {
DbpString("cancelled");
break;
}
}
- samples += 2;
+ samples++;
if (!TagIsActive) { // no need to try decoding reader data if the tag is sending
if(Handle14443bUartBit(ci & 0x01)) {
- if(triggered && tracing) {
+ triggered = true;
+ if(tracing) {
LogTrace(Uart.output, Uart.byteCnt, samples, samples, parity, true);
}
/* And ready to receive another command. */
DemodReset();
}
if(Handle14443bUartBit(cq & 0x01)) {
- if(triggered && tracing) {
+ triggered = true;
+ if(tracing) {
LogTrace(Uart.output, Uart.byteCnt, samples, samples, parity, true);
}
/* And ready to receive another command. */
ReaderIsActive = (Uart.state > STATE_GOT_FALLING_EDGE_OF_SOF);
}
- if(!ReaderIsActive) { // no need to try decoding tag data if the reader is sending - and we cannot afford the time
- if(Handle14443bSamplesDemod(ci | 0x01, cq | 0x01)) {
+ if(!ReaderIsActive && triggered) { // no need to try decoding tag data if the reader is sending or not yet triggered
+ if(Handle14443bSamplesDemod(ci/2, cq/2)) {
//Use samples as a time measurement
if(tracing)
uint8_t parity[MAX_PARITY_SIZE];
LogTrace(Demod.output, Demod.len, samples, samples, parity, false);
}
- triggered = true;
-
// And ready to receive another response.
DemodReset();
}
FpgaDisableSscDma();
LEDsoff();
- AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTDIS;
DbpString("Snoop statistics:");
Dbprintf(" Max behind by: %i", maxBehindBy);
Dbprintf(" Uart State: %x", Uart.state);
{
FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
- FpgaSetupSsc();
+
+ // switch field on and give tag some time to power up
+ LED_D_ON();
+ FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER_TX);
+ SpinDelay(10);
if (datalen){
set_tracing(true);
{
int c;
-// FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
+ FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER_TX);
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX);
if(*wait < 10) { *wait = 10; }
-// for(c = 0; c < *wait;) {
-// if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
-// AT91C_BASE_SSC->SSC_THR = 0x00; // For exact timing!
-// c++;
-// }
-// if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
-// volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;
-// (void)r;
-// }
-// WDT_HIT();
-// }
-
c = 0;
for(;;) {
if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
- AT91C_BASE_SSC->SSC_THR = cmd[c];
+ AT91C_BASE_SSC->SSC_THR = ~cmd[c];
c++;
if(c >= len) {
break;
{
int c = 0;
uint8_t *dest = BigBuf_get_addr();
- int getNext = 0;
-
- int8_t prev = 0;
// NOW READ RESPONSE
+ FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
c = 0;
- getNext = false;
for(;;) {
if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
- int8_t b;
- b = (int8_t)AT91C_BASE_SSC->SSC_RHR;
-
+ uint16_t iq = AT91C_BASE_SSC->SSC_RHR;
// The samples are correlations against I and Q versions of the
- // tone that the tag AM-modulates, so every other sample is I,
- // every other is Q. We just want power, so abs(I) + abs(Q) is
- // close to what we want.
- if(getNext) {
- uint8_t r = AMPLITUDE(b, prev);
+ // tone that the tag AM-modulates. We just want power.
+ int8_t i = iq >> 8;
+ int8_t q = iq;
+ uint8_t r = AMPLITUDE(i, q);
- dest[c++] = r;
-
- if(c >= 4000) {
- break;
- }
- } else {
- prev = b;
+ dest[c++] = r;
+
+ if(c >= 4000) {
+ break;
}
-
- getNext = !getNext;
}
}
{
int c = 0;
uint8_t *dest = BigBuf_get_addr();
- int getNext = 0;
-
- int8_t prev = 0;
// NOW READ RESPONSE
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
//spindelay(60); // greg - experiment to get rid of some of the 0 byte/failed reads
c = 0;
- getNext = false;
for(;;) {
if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
- int8_t b = (int8_t)AT91C_BASE_SSC->SSC_RHR;
-
+ uint16_t iq = AT91C_BASE_SSC->SSC_RHR;
// The samples are correlations against I and Q versions of the
- // tone that the tag AM-modulates, so every other sample is I,
- // every other is Q. We just want power, so abs(I) + abs(Q) is
- // close to what we want.
- if(getNext) {
- uint8_t r = AMPLITUDE(b, prev);
+ // tone that the tag AM-modulates. We just want power,
+ // so abs(I) + abs(Q) is close to what we want.
+ int8_t i = iq >> 8;
+ int8_t q = iq;
+ uint8_t r = AMPLITUDE(i, q);
- dest[c++] = r;
+ dest[c++] = r;
- if(c >= BIGBUF_SIZE) {
- break;
- }
- } else {
- prev = b;
+ if(c >= BIGBUF_SIZE) {
+ break;
}
-
- getNext = !getNext;
}
}
uint8_t *dest = BigBuf_get_addr();
int c = 0;
- int getNext = 0;
- int8_t prev = 0;
FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
BuildIdentifyRequest();
SpinDelay(100);
// Now send the command
- FpgaSetupSsc();
+ FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER_TX);
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX);
c = 0;
for(;;) {
if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
- AT91C_BASE_SSC->SSC_THR = ToSend[c];
+ AT91C_BASE_SSC->SSC_THR = ~ToSend[c];
c++;
if(c == ToSendMax+3) {
break;
WDT_HIT();
}
+ FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
c = 0;
- getNext = false;
for(;;) {
if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
- int8_t b;
- b = (int8_t)AT91C_BASE_SSC->SSC_RHR;
-
+ uint16_t iq = AT91C_BASE_SSC->SSC_RHR;
// The samples are correlations against I and Q versions of the
- // tone that the tag AM-modulates, so every other sample is I,
- // every other is Q. We just want power, so abs(I) + abs(Q) is
- // close to what we want.
- if(getNext) {
- uint8_t r = AMPLITUDE(b, prev);
+ // tone that the tag AM-modulates. We just want power,
+ // so abs(I) + abs(Q) is close to what we want.
+ int8_t i = iq >> 8;
+ int8_t q = iq;
+ uint8_t r = AMPLITUDE(i, q);
- dest[c++] = r;
+ dest[c++] = r;
- if(c >= 4000) {
- break;
- }
- } else {
- prev = b;
+ if(c >= 4000) {
+ break;
}
-
- getNext = !getNext;
}
}
}
uint8_t *dest = BigBuf_get_addr();
int c = 0;
- int getNext = 0;
- int8_t prev = 0;
FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
// Setup SSC
- FpgaSetupSsc();
+ FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
// Start from off (no field generated)
- FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
- SpinDelay(200);
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+ SpinDelay(200);
SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
c = 0;
- getNext = false;
for(;;) {
if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
- int8_t b;
- b = (int8_t)AT91C_BASE_SSC->SSC_RHR;
-
+ uint16_t iq = AT91C_BASE_SSC->SSC_RHR;
// The samples are correlations against I and Q versions of the
- // tone that the tag AM-modulates, so every other sample is I,
- // every other is Q. We just want power, so abs(I) + abs(Q) is
- // close to what we want.
- if(getNext) {
- uint8_t r = AMPLITUDE(b, prev);
+ // tone that the tag AM-modulates. We just want power,
+ // so abs(I) + abs(Q) is close to what we want.
+ int8_t i = iq >> 8;
+ int8_t q = iq;
+ uint8_t r = AMPLITUDE(i, q);
- dest[c++] = r;
+ dest[c++] = r;
- if(c >= 14000) {
- break;
- }
- } else {
- prev = b;
+ if(c >= 14000) {
+ break;
}
-
- getNext = !getNext;
- WDT_HIT();
}
}
- Dbprintf("fin record");
+ Dbprintf("finished recording");
}
SpinDelay(10);
SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
- FpgaSetupSsc();
+ FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
// Give the tags time to energize
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
// Setup SSC
- FpgaSetupSsc();
+ FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
// Start from off (no field generated)
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
memset(buf, 0x00, 100);
SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
- FpgaSetupSsc();
+ FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
// Start from off (no field generated)
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
// I/O interface abstraction (FPGA -> ARM)
//-----------------------------------------------------------------------------
-static inline uint8_t rx_byte_from_fpga() {
+static inline uint16_t rx_frame_from_fpga() {
for(;;) {
WDT_HIT();
- // wait for byte be become available in rx holding register
+ // wait for frame be become available in rx holding register
if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
return AT91C_BASE_SSC->SSC_RHR;
}
// To reduce CPU time the amplitude is approximated by using linear functions:
// am = MAX(ABS(i),ABS(q)) + 1/2*MIN(ABS(i),ABSq))
//
-// Note: The SSC receiver is never synchronized the calculation my be performed
-// on a I/Q pair from two subsequent correlations, but does not matter.
-//
// The bit time is 99.1us (21 I/Q pairs). The receiver skips the first 5 samples
// and averages the next (most stable) 8 samples. The final 8 samples are dropped
// also.
//
-// The demedulated should be alligned to the bit periode by the caller. This is
+// The demodulated should be alligned to the bit period by the caller. This is
// done in rx_bit and rx_ack.
static inline bool rx_bit() {
- int32_t cq = 0;
- int32_t ci = 0;
+ int32_t sum_cq = 0;
+ int32_t sum_ci = 0;
// skip first 5 I/Q pairs
for(size_t i = 0; i<5; ++i) {
- (int8_t)rx_byte_from_fpga();
- (int8_t)rx_byte_from_fpga();
+ (void)rx_frame_from_fpga();
}
// sample next 8 I/Q pairs
for(size_t i = 0; i<8; ++i) {
- cq += (int8_t)rx_byte_from_fpga();
- ci += (int8_t)rx_byte_from_fpga();
+ uint16_t iq = rx_frame_from_fpga();
+ int8_t ci = (int8_t)(iq >> 8);
+ int8_t cq = (int8_t)(iq & 0xff);
+ sum_ci += ci;
+ sum_cq += cq;
}
// calculate power
- int32_t power = (MAX(ABS(ci), ABS(cq)) + (MIN(ABS(ci), ABS(cq)) >> 1));
+ int32_t power = (MAX(ABS(sum_ci), ABS(sum_cq)) + MIN(ABS(sum_ci), ABS(sum_cq))/2);
// compare average (power / 8) to threshold
return ((power >> 3) > INPUT_THRESHOLD);
static inline void tx_bit(bool bit) {
// insert pause
- LOW(GPIO_SSC_DOUT);
+ HIGH(GPIO_SSC_DOUT);
last_frame_end += RWD_TIME_PAUSE;
while(GET_TICKS < last_frame_end) { };
- HIGH(GPIO_SSC_DOUT);
- // return to high, wait for bit periode to end
+ // return to carrier on, wait for bit periode to end
+ LOW(GPIO_SSC_DOUT);
last_frame_end += (bit ? RWD_TIME_1 : RWD_TIME_0) - RWD_TIME_PAUSE;
while(GET_TICKS < last_frame_end) { };
}
};
// add pause to mark end of the frame
- LOW(GPIO_SSC_DOUT);
+ HIGH(GPIO_SSC_DOUT);
last_frame_end += RWD_TIME_PAUSE;
while(GET_TICKS < last_frame_end) { };
- HIGH(GPIO_SSC_DOUT);
+ LOW(GPIO_SSC_DOUT);
}
static uint32_t rx_frame(uint8_t len) {
LED_D_ON();
// configure SSC with defaults
- FpgaSetupSsc();
+ FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
// re-claim GPIO_SSC_DOUT as GPIO and enable output
AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT;
AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT;
- HIGH(GPIO_SSC_DOUT);
+ LOW(GPIO_SSC_DOUT);
// init crc calculator
crc_init(&legic_crc, 4, 0x19 >> 1, 0x05, 0);
projects / proxmark3-svn / commitdiff