From: micki.held@gmx.de Date: Tue, 19 Nov 2013 18:52:40 +0000 (+0000) Subject: - improved reader sensitivity for 14443a cards (FPGA change!) X-Git-Tag: v1.0.0~21 X-Git-Url: https://git.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/commitdiff_plain/e691fc45bcaf0ec02c0da0b472d06580046e918f - improved reader sensitivity for 14443a cards (FPGA change!) - implemented ISO 14443A anticollision loop See http://www.proxmark.org/forum/viewtopic.php?id=1797 further details --- diff --git a/armsrc/iso14443a.c b/armsrc/iso14443a.c index 63cc32ae..00dc622f 100644 --- a/armsrc/iso14443a.c +++ b/armsrc/iso14443a.c @@ -96,9 +96,9 @@ uint32_t GetParity(const uint8_t * pbtCmd, int iLen) int i; uint32_t dwPar = 0; - // Generate the encrypted data + // Generate the parity bits for (i = 0; i < iLen; i++) { - // Save the encrypted parity bit + // and save them to a 32Bit word dwPar |= ((OddByteParity[pbtCmd[i]]) << i); } return dwPar; @@ -375,196 +375,176 @@ static RAMFUNC int MillerDecoding(int bit) } //============================================================================= -// ISO 14443 Type A - Manchester +// ISO 14443 Type A - Manchester decoder //============================================================================= +// Basics: +// The tag will modulate the reader field by asserting different loads to it. As a consequence, the voltage +// at the reader antenna will be modulated as well. The FPGA detects the modulation for us and would deliver e.g. the following: +// ........ 0 0 1 1 1 1 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ....... +// The Manchester decoder needs to identify the following sequences: +// 4 ticks modulated followed by 4 ticks unmodulated: Sequence D = 1 (also used as "start of communication") +// 4 ticks unmodulated followed by 4 ticks modulated: Sequence E = 0 +// 8 ticks unmodulated: Sequence F = end of communication +// 8 ticks modulated: A collision. Save the collision position and treat as Sequence D +// Note 1: the bitstream may start at any time (either in first or second nibble within the parameter bit). We therefore need to sync. +// Note 2: parameter offset is used to determine the position of the parity bits (required for the anticollision command only) static tDemod Demod; -static RAMFUNC int ManchesterDecoding(int v) +inline RAMFUNC bool IsModulation(byte_t b) { - int bit; - int modulation; - //int error = 0; - - if(!Demod.buff) { - Demod.buff = 1; - Demod.buffer = v; - return FALSE; - } - else { - bit = Demod.buffer; - Demod.buffer = v; - } + if (b >= 5 || b == 3) // majority decision: 2 or more bits are set + return true; + else + return false; + +} - if(Demod.state==DEMOD_UNSYNCD) { - Demod.output[Demod.len] = 0xfa; - Demod.syncBit = 0; - //Demod.samples = 0; - Demod.posCount = 1; // This is the first half bit period, so after syncing handle the second part +inline RAMFUNC bool IsModulationNibble1(byte_t b) +{ + return IsModulation((b & 0xE0) >> 5); +} - if(bit & 0x08) { - Demod.syncBit = 0x08; - } +inline RAMFUNC bool IsModulationNibble2(byte_t b) +{ + return IsModulation((b & 0x0E) >> 1); +} - if(bit & 0x04) { - if(Demod.syncBit) { - bit <<= 4; +static RAMFUNC int ManchesterDecoding(int bit, uint16_t offset) +{ + + switch (Demod.state) { + + case DEMOD_UNSYNCD: // not yet synced + Demod.len = 0; // initialize number of decoded data bytes + Demod.bitCount = offset; // initialize number of decoded data bits + Demod.shiftReg = 0; // initialize shiftreg to hold decoded data bits + Demod.parityBits = 0; // initialize parity bits + Demod.collisionPos = 0; // Position of collision bit + + if (IsModulationNibble1(bit) + && !IsModulationNibble2(bit)) { // this is the start bit + Demod.samples = 8; + if(trigger) LED_A_OFF(); + Demod.state = DEMOD_MANCHESTER_DATA; + } else if (!IsModulationNibble1(bit) && IsModulationNibble2(bit)) { // this may be the first half of the start bit + Demod.samples = 4; + Demod.state = DEMOD_HALF_SYNCD; } - Demod.syncBit = 0x04; - } + break; - if(bit & 0x02) { - if(Demod.syncBit) { - bit <<= 2; - } - Demod.syncBit = 0x02; - } - if(bit & 0x01 && Demod.syncBit) { - Demod.syncBit = 0x01; - } - - if(Demod.syncBit) { - Demod.len = 0; - Demod.state = DEMOD_START_OF_COMMUNICATION; - Demod.sub = SUB_FIRST_HALF; - Demod.bitCount = 0; - Demod.shiftReg = 0; - Demod.parityBits = 0; - Demod.samples = 0; - if(Demod.posCount) { - if(trigger) LED_A_OFF(); - switch(Demod.syncBit) { - case 0x08: Demod.samples = 3; break; - case 0x04: Demod.samples = 2; break; - case 0x02: Demod.samples = 1; break; - case 0x01: Demod.samples = 0; break; + case DEMOD_HALF_SYNCD: + Demod.samples += 8; + if (IsModulationNibble1(bit)) { // error: this was not a start bit. + Demod.state = DEMOD_UNSYNCD; + } else { + if (IsModulationNibble2(bit)) { // modulation in first half + Demod.state = DEMOD_MOD_FIRST_HALF; + } else { // no modulation in first half + Demod.state = DEMOD_NOMOD_FIRST_HALF; } } - //error = 0; - } - } - else { - //modulation = bit & Demod.syncBit; - modulation = ((bit << 1) ^ ((Demod.buffer & 0x08) >> 3)) & Demod.syncBit; - - Demod.samples += 4; - - if(Demod.posCount==0) { - Demod.posCount = 1; - if(modulation) { - Demod.sub = SUB_FIRST_HALF; + break; + + + case DEMOD_MOD_FIRST_HALF: + Demod.samples += 8; + Demod.bitCount++; + if (IsModulationNibble1(bit)) { // modulation in both halfs - collision + if (!Demod.collisionPos) { + Demod.collisionPos = (Demod.len << 3) + Demod.bitCount; + } + } // modulation in first half only - Sequence D = 1 + Demod.shiftReg = (Demod.shiftReg >> 1) | 0x100; // add a 1 to the shiftreg + if(Demod.bitCount >= 9) { // if we decoded a full byte (including parity) + Demod.parityBits <<= 1; // make room for the parity bit + Demod.output[Demod.len++] = (Demod.shiftReg & 0xff); + Demod.parityBits |= ((Demod.shiftReg >> 8) & 0x01); // store parity bit + Demod.bitCount = 0; + Demod.shiftReg = 0; } - else { - Demod.sub = SUB_NONE; + if (IsModulationNibble2(bit)) { // modulation in first half + Demod.state = DEMOD_MOD_FIRST_HALF; + } else { // no modulation in first half + Demod.state = DEMOD_NOMOD_FIRST_HALF; } - } - else { - Demod.posCount = 0; - if(modulation && (Demod.sub == SUB_FIRST_HALF)) { - if(Demod.state!=DEMOD_ERROR_WAIT) { - Demod.state = DEMOD_ERROR_WAIT; - Demod.output[Demod.len] = 0xaa; - //error = 0x01; + break; + + + case DEMOD_NOMOD_FIRST_HALF: + if (IsModulationNibble1(bit)) { // modulation in second half only - Sequence E = 0 + Demod.bitCount++; + Demod.samples += 8; + Demod.shiftReg = (Demod.shiftReg >> 1); // add a 0 to the shiftreg + if(Demod.bitCount >= 9) { // if we decoded a full byte (including parity) + Demod.parityBits <<= 1; // make room for the new parity bit + Demod.output[Demod.len++] = (Demod.shiftReg & 0xff); + Demod.parityBits |= ((Demod.shiftReg >> 8) & 0x01); // store parity bit + Demod.bitCount = 0; + Demod.shiftReg = 0; } + } else { // no modulation in both halves - End of communication + Demod.samples += 4; + if(Demod.bitCount > 0) { // if we decoded bits + Demod.shiftReg >>= (9 - Demod.bitCount); // add the remaining decoded bits to the output + Demod.output[Demod.len++] = Demod.shiftReg & 0xff; + // No parity bit, so just shift a 0 + Demod.parityBits <<= 1; + } + Demod.state = DEMOD_UNSYNCD; // start from the beginning + return TRUE; // we are finished with decoding the raw data sequence } - else if(modulation) { - Demod.sub = SUB_SECOND_HALF; + if (IsModulationNibble2(bit)) { // modulation in first half + Demod.state = DEMOD_MOD_FIRST_HALF; + } else { // no modulation in first half + Demod.state = DEMOD_NOMOD_FIRST_HALF; } + break; + - switch(Demod.state) { - case DEMOD_START_OF_COMMUNICATION: - if(Demod.sub == SUB_FIRST_HALF) { - Demod.state = DEMOD_MANCHESTER_D; - } - else { - Demod.output[Demod.len] = 0xab; - Demod.state = DEMOD_ERROR_WAIT; - //error = 0x02; - } - break; - - case DEMOD_MANCHESTER_D: - case DEMOD_MANCHESTER_E: - if(Demod.sub == SUB_FIRST_HALF) { - Demod.bitCount++; - Demod.shiftReg = (Demod.shiftReg >> 1) ^ 0x100; - Demod.state = DEMOD_MANCHESTER_D; + case DEMOD_MANCHESTER_DATA: + Demod.samples += 8; + if (IsModulationNibble1(bit)) { // modulation in first half + if (IsModulationNibble2(bit) & 0x0f) { // ... and in second half = collision + if (!Demod.collisionPos) { + Demod.collisionPos = (Demod.len << 3) + Demod.bitCount; } - else if(Demod.sub == SUB_SECOND_HALF) { - Demod.bitCount++; - Demod.shiftReg >>= 1; - Demod.state = DEMOD_MANCHESTER_E; + } // modulation in first half only - Sequence D = 1 + Demod.bitCount++; + Demod.shiftReg = (Demod.shiftReg >> 1) | 0x100; // in both cases, add a 1 to the shiftreg + if(Demod.bitCount >= 9) { // if we decoded a full byte (including parity) + Demod.parityBits <<= 1; // make room for the parity bit + Demod.output[Demod.len++] = (Demod.shiftReg & 0xff); + Demod.parityBits |= ((Demod.shiftReg >> 8) & 0x01); // store parity bit + Demod.bitCount = 0; + Demod.shiftReg = 0; + } + } else { // no modulation in first half + if (IsModulationNibble2(bit)) { // and modulation in second half = Sequence E = 0 + Demod.bitCount++; + Demod.shiftReg = (Demod.shiftReg >> 1); // add a 0 to the shiftreg + if(Demod.bitCount >= 9) { // if we decoded a full byte (including parity) + Demod.parityBits <<= 1; // make room for the new parity bit + Demod.output[Demod.len++] = (Demod.shiftReg & 0xff); + Demod.parityBits |= ((Demod.shiftReg >> 8) & 0x01); // store parity bit + Demod.bitCount = 0; + Demod.shiftReg = 0; } - else { - Demod.state = DEMOD_MANCHESTER_F; + } else { // no modulation in both halves - End of communication + if(Demod.bitCount > 0) { // if we decoded bits + Demod.shiftReg >>= (9 - Demod.bitCount); // add the remaining decoded bits to the output + Demod.output[Demod.len++] = Demod.shiftReg & 0xff; + // No parity bit, so just shift a 0 + Demod.parityBits <<= 1; } - break; - - case DEMOD_MANCHESTER_F: - // Tag response does not need to be a complete byte! - if(Demod.len > 0 || Demod.bitCount > 0) { - if(Demod.bitCount > 0) { - Demod.shiftReg >>= (9 - Demod.bitCount); - Demod.output[Demod.len] = Demod.shiftReg & 0xff; - Demod.len++; - // No parity bit, so just shift a 0 - Demod.parityBits <<= 1; - } - - Demod.state = DEMOD_UNSYNCD; - return TRUE; - } - else { - Demod.output[Demod.len] = 0xad; - Demod.state = DEMOD_ERROR_WAIT; - //error = 0x03; - } - break; - - case DEMOD_ERROR_WAIT: - Demod.state = DEMOD_UNSYNCD; - break; - - default: - Demod.output[Demod.len] = 0xdd; - Demod.state = DEMOD_UNSYNCD; - break; - } - - if(Demod.bitCount>=9) { - Demod.output[Demod.len] = Demod.shiftReg & 0xff; - Demod.len++; - - Demod.parityBits <<= 1; - Demod.parityBits ^= ((Demod.shiftReg >> 8) & 0x01); - - Demod.bitCount = 0; - Demod.shiftReg = 0; + Demod.state = DEMOD_UNSYNCD; // start from the beginning + return TRUE; // we are finished with decoding the raw data sequence + } } + + } - /*if(error) { - Demod.output[Demod.len] = 0xBB; - Demod.len++; - Demod.output[Demod.len] = error & 0xFF; - Demod.len++; - Demod.output[Demod.len] = 0xBB; - Demod.len++; - Demod.output[Demod.len] = bit & 0xFF; - Demod.len++; - Demod.output[Demod.len] = Demod.buffer & 0xFF; - Demod.len++; - Demod.output[Demod.len] = Demod.syncBit & 0xFF; - Demod.len++; - Demod.output[Demod.len] = 0xBB; - Demod.len++; - return TRUE; - }*/ - - } - - } // end (state != UNSYNCED) - - return FALSE; + return FALSE; // not finished yet, need more data } //============================================================================= @@ -691,7 +671,7 @@ void RAMFUNC SnoopIso14443a(uint8_t param) { LED_B_OFF(); } - if(ManchesterDecoding(data[0] & 0x0F)) { + if(ManchesterDecoding(data[0], 0)) { LED_B_ON(); if (!LogTrace(receivedResponse, Demod.len, 0 - Demod.samples, Demod.parityBits, FALSE)) break; @@ -1296,7 +1276,7 @@ static void TransmitFor14443a(const uint8_t *cmd, int len, uint32_t *timing) while(GetCountMifare() < (*timing & 0xfffffff8)); // Delay transfer (multiple of 8 MF clock ticks) } - for(c = 0; c < 10;) { // standard delay for each transfer (allow tag to be ready after last transmission) + for(c = 0; c < 10;) { // standard delay for each transfer (allow tag to be ready after last transmission?) if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) { AT91C_BASE_SSC->SSC_THR = 0x00; c++; @@ -1558,13 +1538,12 @@ int EmSendCmdPar(uint8_t *resp, int respLen, uint32_t par){ //----------------------------------------------------------------------------- // Wait a certain time for tag response // If a response is captured return TRUE -// If it takes to long return FALSE +// If it takes too long return FALSE //----------------------------------------------------------------------------- -static int GetIso14443aAnswerFromTag(uint8_t *receivedResponse, int maxLen, int *samples, int *elapsed) //uint8_t *buffer +static int GetIso14443aAnswerFromTag(uint8_t *receivedResponse, uint16_t offset, int maxLen, int *samples) { - // buffer needs to be 512 bytes int c; - + // Set FPGA mode to "reader listen mode", no modulation (listen // only, since we are receiving, not transmitting). // Signal field is on with the appropriate LED @@ -1577,7 +1556,6 @@ static int GetIso14443aAnswerFromTag(uint8_t *receivedResponse, int maxLen, int Demod.state = DEMOD_UNSYNCD; uint8_t b; - if (elapsed) *elapsed = 0; c = 0; for(;;) { @@ -1590,12 +1568,8 @@ static int GetIso14443aAnswerFromTag(uint8_t *receivedResponse, int maxLen, int if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) { if(c < iso14a_timeout) { c++; } else { return FALSE; } b = (uint8_t)AT91C_BASE_SSC->SSC_RHR; - if(ManchesterDecoding((b>>4) & 0xf)) { - *samples = ((c - 1) << 3) + 4; - return TRUE; - } - if(ManchesterDecoding(b & 0x0f)) { - *samples = c << 3; + if(ManchesterDecoding(b, offset)) { + *samples = Demod.samples; return TRUE; } } @@ -1607,12 +1581,12 @@ void ReaderTransmitBitsPar(uint8_t* frame, int bits, uint32_t par, uint32_t *tim CodeIso14443aBitsAsReaderPar(frame,bits,par); - // Select the card + // Send command to tag TransmitFor14443a(ToSend, ToSendMax, timing); if(trigger) LED_A_ON(); - // Store reader command in buffer + // Log reader command in trace buffer if (tracing) LogTrace(frame,nbytes(bits),0,par,TRUE); } @@ -1621,38 +1595,49 @@ void ReaderTransmitPar(uint8_t* frame, int len, uint32_t par, uint32_t *timing) ReaderTransmitBitsPar(frame,len*8,par, timing); } +void ReaderTransmitBits(uint8_t* frame, int len, uint32_t *timing) +{ + // Generate parity and redirect + ReaderTransmitBitsPar(frame,len,GetParity(frame,len/8), timing); +} + void ReaderTransmit(uint8_t* frame, int len, uint32_t *timing) { // Generate parity and redirect ReaderTransmitBitsPar(frame,len*8,GetParity(frame,len), timing); } +int ReaderReceiveOffset(uint8_t* receivedAnswer, uint16_t offset) +{ + int samples = 0; + if (!GetIso14443aAnswerFromTag(receivedAnswer,offset,160,&samples)) return FALSE; + if (tracing) LogTrace(receivedAnswer,Demod.len,samples,Demod.parityBits,FALSE); + if(samples == 0) return FALSE; + return Demod.len; +} + int ReaderReceive(uint8_t* receivedAnswer) { - int samples = 0; - if (!GetIso14443aAnswerFromTag(receivedAnswer,160,&samples,0)) return FALSE; - if (tracing) LogTrace(receivedAnswer,Demod.len,samples,Demod.parityBits,FALSE); - if(samples == 0) return FALSE; - return Demod.len; + return ReaderReceiveOffset(receivedAnswer, 0); } -int ReaderReceivePar(uint8_t* receivedAnswer, uint32_t * parptr) +int ReaderReceivePar(uint8_t *receivedAnswer, uint32_t *parptr) { - int samples = 0; - if (!GetIso14443aAnswerFromTag(receivedAnswer,160,&samples,0)) return FALSE; - if (tracing) LogTrace(receivedAnswer,Demod.len,samples,Demod.parityBits,FALSE); + int samples = 0; + if (!GetIso14443aAnswerFromTag(receivedAnswer,0,160,&samples)) return FALSE; + if (tracing) LogTrace(receivedAnswer,Demod.len,samples,Demod.parityBits,FALSE); *parptr = Demod.parityBits; - if(samples == 0) return FALSE; - return Demod.len; + if(samples == 0) return FALSE; + return Demod.len; } -/* performs iso14443a anticolision procedure +/* performs iso14443a anticollision procedure * fills the uid pointer unless NULL * fills resp_data unless NULL */ int iso14443a_select_card(byte_t* uid_ptr, iso14a_card_select_t* p_hi14a_card, uint32_t* cuid_ptr) { uint8_t wupa[] = { 0x52 }; // 0x26 - REQA 0x52 - WAKE-UP uint8_t sel_all[] = { 0x93,0x20 }; - uint8_t sel_uid[] = { 0x93,0x70,0x00,0x00,0x00,0x00,0x00,0x00,0x00 }; + uint8_t sel_uid[] = { 0x93,0x70,0x00,0x00,0x00,0x00,0x00,0x00,0x00}; uint8_t rats[] = { 0xE0,0x80,0x00,0x00 }; // FSD=256, FSDI=8, CID=0 uint8_t* resp = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET); // was 3560 - tied to other size changes byte_t uid_resp[4]; @@ -1666,7 +1651,7 @@ int iso14443a_select_card(byte_t* uid_ptr, iso14a_card_select_t* p_hi14a_card, u ReaderTransmitBitsPar(wupa,7,0, NULL); // Receive the ATQA if(!ReaderReceive(resp)) return 0; -// Dbprintf("atqa: %02x %02x",resp[0],resp[1]); + // Dbprintf("atqa: %02x %02x",resp[0],resp[1]); if(p_hi14a_card) { memcpy(p_hi14a_card->atqa, resp, 2); @@ -1690,19 +1675,50 @@ int iso14443a_select_card(byte_t* uid_ptr, iso14a_card_select_t* p_hi14a_card, u ReaderTransmit(sel_all,sizeof(sel_all), NULL); if (!ReaderReceive(resp)) return 0; - // First backup the current uid - memcpy(uid_resp,resp,4); - uid_resp_len = 4; + if (Demod.collisionPos) { // we had a collision and need to construct the UID bit by bit + memset(uid_resp, 0, 4); + uint16_t uid_resp_bits = 0; + uint16_t collision_answer_offset = 0; + // anti-collision-loop: + while (Demod.collisionPos) { + Dbprintf("Multiple tags detected. Collision after Bit %d", Demod.collisionPos); + for (uint16_t i = collision_answer_offset; i < Demod.collisionPos; i++, uid_resp_bits++) { // add valid UID bits before collision point + uint16_t UIDbit = (resp[i/8] >> (i % 8)) & 0x01; + uid_resp[uid_resp_bits & 0xf8] |= UIDbit << (uid_resp_bits % 8); + } + uid_resp[uid_resp_bits/8] |= 1 << (uid_resp_bits % 8); // next time select the card(s) with a 1 in the collision position + uid_resp_bits++; + // construct anticollosion command: + sel_uid[1] = ((2 + uid_resp_bits/8) << 4) | (uid_resp_bits & 0x07); // length of data in bytes and bits + for (uint16_t i = 0; i <= uid_resp_bits/8; i++) { + sel_uid[2+i] = uid_resp[i]; + } + collision_answer_offset = uid_resp_bits%8; + ReaderTransmitBits(sel_uid, 16 + uid_resp_bits, NULL); + if (!ReaderReceiveOffset(resp, collision_answer_offset)) return 0; + } + // finally, add the last bits and BCC of the UID + for (uint16_t i = collision_answer_offset; i < (Demod.len-1)*8; i++, uid_resp_bits++) { + uint16_t UIDbit = (resp[i/8] >> (i%8)) & 0x01; + uid_resp[uid_resp_bits/8] |= UIDbit << (uid_resp_bits % 8); + } + + } else { // no collision, use the response to SELECT_ALL as current uid + memcpy(uid_resp,resp,4); + } + uid_resp_len = 4; // Dbprintf("uid: %02x %02x %02x %02x",uid_resp[0],uid_resp[1],uid_resp[2],uid_resp[3]); - // calculate crypto UID. Always use last 4 Bytes. + // calculate crypto UID. Always use last 4 Bytes. if(cuid_ptr) { *cuid_ptr = bytes_to_num(uid_resp, 4); } // Construct SELECT UID command - memcpy(sel_uid+2,resp,5); - AppendCrc14443a(sel_uid,7); + sel_uid[1] = 0x70; // transmitting a full UID (1 Byte cmd, 1 Byte NVB, 4 Byte UID, 1 Byte BCC, 2 Bytes CRC) + memcpy(sel_uid+2,uid_resp,4); // the UID + sel_uid[6] = sel_uid[2] ^ sel_uid[3] ^ sel_uid[4] ^ sel_uid[5]; // calculate and add BCC + AppendCrc14443a(sel_uid,7); // calculate and add CRC ReaderTransmit(sel_uid,sizeof(sel_uid), NULL); // Receive the SAK @@ -1710,7 +1726,7 @@ int iso14443a_select_card(byte_t* uid_ptr, iso14a_card_select_t* p_hi14a_card, u sak = resp[0]; // Test if more parts of the uid are comming - if ((sak & 0x04) && uid_resp[0] == 0x88) { + if ((sak & 0x04) /* && uid_resp[0] == 0x88 */) { // Remove first byte, 0x88 is not an UID byte, it CT, see page 3 of: // http://www.nxp.com/documents/application_note/AN10927.pdf memcpy(uid_resp, uid_resp + 1, 3); @@ -1769,6 +1785,7 @@ void iso14443a_setup() { FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD); SpinDelay(7); // iso14443-3 specifies 5ms max. + Demod.state = DEMOD_UNSYNCD; iso14a_timeout = 2048; //default } @@ -1815,6 +1832,7 @@ void ReaderIso14443a(UsbCommand * c) if(param & ISO14A_CONNECT) { iso14a_clear_trace(); } + iso14a_set_tracing(true); if(param & ISO14A_REQUEST_TRIGGER) { @@ -1976,8 +1994,6 @@ void ReaderMifare(bool first_try) //keep the card active FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD); - // CodeIso14443aBitsAsReaderPar(mf_auth, sizeof(mf_auth)*8, GetParity(mf_auth, sizeof(mf_auth)*8)); - sync_time = (sync_time & 0xfffffff8) + sync_cycles + catch_up_cycles; catch_up_cycles = 0; @@ -2645,7 +2661,7 @@ void RAMFUNC SniffMifare(uint8_t param) { Demod.state = DEMOD_UNSYNCD; } - if(ManchesterDecoding(data[0] & 0x0F)) { + if(ManchesterDecoding(data[0], 0)) { LED_C_INV(); if (MfSniffLogic(receivedResponse, Demod.len, Demod.parityBits, Demod.bitCount, FALSE)) break; diff --git a/armsrc/iso14443a.h b/armsrc/iso14443a.h index 4c3c6674..2a2b3403 100644 --- a/armsrc/iso14443a.h +++ b/armsrc/iso14443a.h @@ -22,32 +22,22 @@ #define CARD_MEMORY 6000 #define CARD_MEMORY_LEN 4096 -typedef struct nestedVector { uint32_t nt, ks1; } nestedVector; - typedef struct { enum { DEMOD_UNSYNCD, - DEMOD_START_OF_COMMUNICATION, - DEMOD_MANCHESTER_D, - DEMOD_MANCHESTER_E, - DEMOD_MANCHESTER_F, - DEMOD_ERROR_WAIT - } state; - int bitCount; - int posCount; - int syncBit; - int parityBits; - uint16_t shiftReg; - int buffer; - int buff; - int samples; - int len; - enum { - SUB_NONE, - SUB_FIRST_HALF, - SUB_SECOND_HALF - } sub; - uint8_t *output; + DEMOD_HALF_SYNCD, + DEMOD_MOD_FIRST_HALF, + DEMOD_NOMOD_FIRST_HALF, + DEMOD_MANCHESTER_DATA + } state; + uint16_t bitCount; + uint16_t collisionPos; + uint16_t syncBit; + uint16_t parityBits; + uint16_t shiftReg; + uint16_t samples; + uint16_t len; + uint8_t *output; } tDemod; typedef struct { @@ -79,18 +69,18 @@ typedef struct { extern byte_t oddparity (const byte_t bt); -extern uint32_t GetParity(const uint8_t * pbtCmd, int iLen); -extern void AppendCrc14443a(uint8_t* data, int len); +extern uint32_t GetParity(const uint8_t *pbtCmd, int iLen); +extern void AppendCrc14443a(uint8_t *data, int len); -extern void ReaderTransmit(uint8_t* frame, int len, uint32_t *timing); -extern void ReaderTransmitBitsPar(uint8_t* frame, int bits, uint32_t par, uint32_t *timing); -extern void ReaderTransmitPar(uint8_t* frame, int len, uint32_t par, uint32_t *timing); -extern int ReaderReceive(uint8_t* receivedAnswer); -extern int ReaderReceivePar(uint8_t* receivedAnswer, uint32_t * parptr); +extern void ReaderTransmit(uint8_t *frame, int len, uint32_t *timing); +extern void ReaderTransmitBitsPar(uint8_t *frame, int bits, uint32_t par, uint32_t *timing); +extern void ReaderTransmitPar(uint8_t *frame, int len, uint32_t par, uint32_t *timing); +extern int ReaderReceive(uint8_t *receivedAnswer); +extern int ReaderReceivePar(uint8_t *receivedAnswer, uint32_t *parptr); extern void iso14443a_setup(); -extern int iso14_apdu(uint8_t * cmd, size_t cmd_len, void * data); -extern int iso14443a_select_card(uint8_t * uid_ptr, iso14a_card_select_t * resp_data, uint32_t * cuid_ptr); +extern int iso14_apdu(uint8_t *cmd, size_t cmd_len, void *data); +extern int iso14443a_select_card(uint8_t *uid_ptr, iso14a_card_select_t *resp_data, uint32_t *cuid_ptr); extern void iso14a_set_trigger(bool enable); extern void iso14a_set_timeout(uint32_t timeout); diff --git a/client/cmdhf14a.c b/client/cmdhf14a.c index f7e0ffa9..2c5fd1c0 100644 --- a/client/cmdhf14a.c +++ b/client/cmdhf14a.c @@ -101,7 +101,7 @@ int CmdHF14AList(const char *Cmd) char *crc; crc = ""; if (len > 2) { - uint8_t b1, b2; + uint8_t b1, b2; for (j = 0; j < (len - 1); j++) { // gives problems... search for the reason.. /*if(frame[j] == 0xAA) { @@ -132,8 +132,8 @@ int CmdHF14AList(const char *Cmd) crc = (isResponse & (len < 6)) ? "" : " !crc"; } else { crc = ""; - } - } + } + } } else { crc = ""; // SHORT } @@ -148,7 +148,7 @@ int CmdHF14AList(const char *Cmd) PrintAndLog(" +%7d: %s: %s %s %s", (prev < 0 ? 0 : (timestamp - prev)), metricString, - (isResponse ? "TAG" : " "), line, crc); + (isResponse ? "TAG " : " "), line, crc); prev = timestamp; i += (len + 9); @@ -184,12 +184,12 @@ int CmdHF14AReader(const char *Cmd) case 0x00: PrintAndLog("TYPE : NXP MIFARE Ultralight | Ultralight C"); break; case 0x04: PrintAndLog("TYPE : NXP MIFARE (various !DESFire !DESFire EV1)"); break; - case 0x08: PrintAndLog("TYPE : NXP MIFARE CLASSIC 1k | Plus 2k"); break; + case 0x08: PrintAndLog("TYPE : NXP MIFARE CLASSIC 1k | Plus 2k SL1"); break; case 0x09: PrintAndLog("TYPE : NXP MIFARE Mini 0.3k"); break; - case 0x10: PrintAndLog("TYPE : NXP MIFARE Plus 2k"); break; - case 0x11: PrintAndLog("TYPE : NXP MIFARE Plus 4k"); break; - case 0x18: PrintAndLog("TYPE : NXP MIFARE Classic 4k | Plus 4k"); break; - case 0x20: PrintAndLog("TYPE : NXP MIFARE DESFire 4k | DESFire EV1 2k/4k/8k | Plus 2k/4k | JCOP 31/41"); break; + case 0x10: PrintAndLog("TYPE : NXP MIFARE Plus 2k SL2"); break; + case 0x11: PrintAndLog("TYPE : NXP MIFARE Plus 4k SL2"); break; + case 0x18: PrintAndLog("TYPE : NXP MIFARE Classic 4k | Plus 4k SL1"); break; + case 0x20: PrintAndLog("TYPE : NXP MIFARE DESFire 4k | DESFire EV1 2k/4k/8k | Plus 2k/4k SL3 | JCOP 31/41"); break; case 0x24: PrintAndLog("TYPE : NXP MIFARE DESFire | DESFire EV1"); break; case 0x28: PrintAndLog("TYPE : JCOP31 or JCOP41 v2.3.1"); break; case 0x38: PrintAndLog("TYPE : Nokia 6212 or 6131 MIFARE CLASSIC 4K"); break; diff --git a/fpga/Makefile b/fpga/Makefile index 8759c22c..12aeaaae 100644 --- a/fpga/Makefile +++ b/fpga/Makefile @@ -12,11 +12,11 @@ fpga.ngc: fpga.v fpga.ucf xst.scr util.v lo_edge_detect.v lo_read.v lo_passthru. fpga.ngd: fpga.ngc $(DELETE) fpga.ngd - $(XILINX_TOOLS_PREFIX)ngdbuild -aul -p xc2s30-6vq100 -nt timestamp -uc fpga.ucf fpga.ngc fpga.ngd + $(XILINX_TOOLS_PREFIX)ngdbuild -aul -p xc2s30-5-vq100 -nt timestamp -uc fpga.ucf fpga.ngc fpga.ngd fpga.ncd: fpga.ngd $(DELETE) fpga.ncd - $(XILINX_TOOLS_PREFIX)map -p xc2s30-6vq100 fpga.ngd + $(XILINX_TOOLS_PREFIX)map -p xc2s30-5-vq100 fpga.ngd fpga-placed.ncd: fpga.ncd $(DELETE) fpga-placed.ncd diff --git a/fpga/fpga.bit b/fpga/fpga.bit index 3ea1560d..e7d62707 100644 Binary files a/fpga/fpga.bit and b/fpga/fpga.bit differ diff --git a/fpga/fpga.ucf b/fpga/fpga.ucf index 35f38e73..f20e2da0 100644 --- a/fpga/fpga.ucf +++ b/fpga/fpga.ucf @@ -39,3 +39,16 @@ NET "ssp_frame" LOC = "P31" ; #PACE: Start of PACE Prohibit Constraints #PACE: End of Constraints generated by PACE + +# definition of Clock nets: +NET "ck_1356meg" TNM_NET = "clk_net_1356" ; +NET "ck_1356megb" TNM_NET = "clk_net_1356b" ; +NET "pck0" TNM_NET = "clk_net_pck0" ; +NET "spck" TNM_NET = "clk_net_spck" ; + +# Timing specs of clock nets: +TIMEGRP "clk_net_1356_all" = "clk_net_1356" "clk_net_1356b" ; +TIMESPEC "TS_1356MHz" = PERIOD "clk_net_1356_all" 74 ns HIGH 37 ns ; +TIMESPEC "TS_24MHz" = PERIOD "clk_net_pck0" 42 ns HIGH 21 ns ; +TIMESPEC "TS_4MHz" = PERIOD "clk_net_spck" 250 ns HIGH 125 ns ; + diff --git a/fpga/fpga.v b/fpga/fpga.v index d2d84a32..a083ae5c 100644 --- a/fpga/fpga.v +++ b/fpga/fpga.v @@ -22,17 +22,17 @@ `include "util.v" module fpga( - spcki, miso, mosi, ncs, - pck0i, ck_1356meg, ck_1356megb, + spck, miso, mosi, ncs, + pck0, ck_1356meg, ck_1356megb, pwr_lo, pwr_hi, pwr_oe1, pwr_oe2, pwr_oe3, pwr_oe4, adc_d, adc_clk, adc_noe, ssp_frame, ssp_din, ssp_dout, ssp_clk, cross_hi, cross_lo, dbg ); - input spcki, mosi, ncs; + input spck, mosi, ncs; output miso; - input pck0i, ck_1356meg, ck_1356megb; + input pck0, ck_1356meg, ck_1356megb; output pwr_lo, pwr_hi, pwr_oe1, pwr_oe2, pwr_oe3, pwr_oe4; input [7:0] adc_d; output adc_clk, adc_noe; @@ -42,15 +42,17 @@ module fpga( output dbg; //assign pck0 = pck0i; - IBUFG #(.IOSTANDARD("DEFAULT") ) pck0b( - .O(pck0), - .I(pck0i) - ); +// IBUFG #(.IOSTANDARD("DEFAULT") ) pck0b( +// .O(pck0), +// .I(pck0i) +// ); //assign spck = spcki; - IBUFG #(.IOSTANDARD("DEFAULT") ) spckb( - .O(spck), - .I(spcki) - ); +// IBUFG #(.IOSTANDARD("DEFAULT") ) spckb( + // .O(spck), + // .I(spcki) +// ); + + //----------------------------------------------------------------------------- // The SPI receiver. This sets up the configuration word, which the rest of // the logic looks at to determine how to connect the A/D and the coil @@ -68,8 +70,8 @@ reg [7:0] conf_word; always @(posedge ncs) begin case(shift_reg[15:12]) - 4'b0001: conf_word <= shift_reg[7:0]; - 4'b0010: divisor <= shift_reg[7:0]; + 4'b0001: conf_word <= shift_reg[7:0]; // FPGA_CMD_SET_CONFREG + 4'b0010: divisor <= shift_reg[7:0]; // FPGA_CMD_SET_DIVISOR endcase end @@ -202,7 +204,7 @@ hi_iso14443a hisn( mux8 mux_ssp_clk (major_mode, ssp_clk, lr_ssp_clk, ls_ssp_clk, ht_ssp_clk, hrxc_ssp_clk, hs_ssp_clk, hisn_ssp_clk, lp_ssp_clk, 1'b0); mux8 mux_ssp_din (major_mode, ssp_din, lr_ssp_din, ls_ssp_din, ht_ssp_din, hrxc_ssp_din, hs_ssp_din, hisn_ssp_din, lp_ssp_din, 1'b0); -mux8 mux_ssp_frame (major_mode, ssp_frame, lr_ssp_frame, ls_ssp_frame, ht_ssp_frame, hrxc_ssp_frame, hs_ssp_frame, hisn_ssp_frame, lp_ssp_frame, 1'b0); +mux8 mux_ssp_frame (major_mode, ssp_frame, lr_ssp_frame, ls_ssp_frame, ht_ssp_frame, hrxc_ssp_frame, hs_ssp_frame, hisn_ssp_frame, lp_ssp_frame, 1'b0); mux8 mux_pwr_oe1 (major_mode, pwr_oe1, lr_pwr_oe1, ls_pwr_oe1, ht_pwr_oe1, hrxc_pwr_oe1, hs_pwr_oe1, hisn_pwr_oe1, lp_pwr_oe1, 1'b0); mux8 mux_pwr_oe2 (major_mode, pwr_oe2, lr_pwr_oe2, ls_pwr_oe2, ht_pwr_oe2, hrxc_pwr_oe2, hs_pwr_oe2, hisn_pwr_oe2, lp_pwr_oe2, 1'b0); mux8 mux_pwr_oe3 (major_mode, pwr_oe3, lr_pwr_oe3, ls_pwr_oe3, ht_pwr_oe3, hrxc_pwr_oe3, hs_pwr_oe3, hisn_pwr_oe3, lp_pwr_oe3, 1'b0); @@ -210,7 +212,7 @@ mux8 mux_pwr_oe4 (major_mode, pwr_oe4, lr_pwr_oe4, ls_pwr_oe4, ht_pwr_oe4 mux8 mux_pwr_lo (major_mode, pwr_lo, lr_pwr_lo, ls_pwr_lo, ht_pwr_lo, hrxc_pwr_lo, hs_pwr_lo, hisn_pwr_lo, lp_pwr_lo, 1'b0); mux8 mux_pwr_hi (major_mode, pwr_hi, lr_pwr_hi, ls_pwr_hi, ht_pwr_hi, hrxc_pwr_hi, hs_pwr_hi, hisn_pwr_hi, lp_pwr_hi, 1'b0); mux8 mux_adc_clk (major_mode, adc_clk, lr_adc_clk, ls_adc_clk, ht_adc_clk, hrxc_adc_clk, hs_adc_clk, hisn_adc_clk, lp_adc_clk, 1'b0); -mux8 mux_dbg (major_mode, dbg, lr_dbg, ls_dbg, ht_dbg, hrxc_dbg, hs_dbg, hisn_dbg, lp_dbg, 1'b0); +mux8 mux_dbg (major_mode, dbg, lr_dbg, ls_dbg, ht_dbg, hrxc_dbg, hs_dbg, hisn_dbg, lp_dbg, 1'b0); // In all modes, let the ADC's outputs be enabled. assign adc_noe = 1'b0; diff --git a/fpga/hi_iso14443a.v b/fpga/hi_iso14443a.v index eb03fa23..1009c436 100644 --- a/fpga/hi_iso14443a.v +++ b/fpga/hi_iso14443a.v @@ -39,8 +39,8 @@ reg [2:0] deep_counter; reg deep_modulation; always @(negedge adc_clk) begin - if(& adc_d[7:6]) after_hysteresis <= 1'b1; - else if(~(| adc_d[7:4])) after_hysteresis <= 1'b0; + if(& adc_d[7:6]) after_hysteresis <= 1'b1; // if adc_d >= 196 + else if(~(| adc_d[7:4])) after_hysteresis <= 1'b0; // if adc_d <= 15 if(~(| adc_d[7:0])) begin @@ -83,20 +83,34 @@ reg [5:0] negedge_cnt; reg bit1, bit2, bit3; reg [3:0] count_ones; reg [3:0] count_zeros; -wire [7:0] avg; -reg [7:0] lavg; -reg signed [12:0] step1; -reg signed [12:0] step2; -reg [7:0] stepsize; +// wire [7:0] avg; +// reg [7:0] lavg; +// reg signed [12:0] step1; +// reg signed [12:0] step2; +// reg [7:0] stepsize; +reg [7:0] rx_mod_edge_threshold; reg curbit; -reg [12:0] average; -wire signed [9:0] dif; +// reg [12:0] average; +// wire signed [9:0] dif; + +// storage for two previous samples: +reg [7:0] adc_d_1; +reg [7:0] adc_d_2; +reg [7:0] adc_d_3; +reg [7:0] adc_d_4; + +// the filtered signal (filter performs noise reduction and edge detection) +// (gaussian derivative) +wire signed [10:0] adc_d_filtered; +assign adc_d_filtered = (adc_d_4 << 1) + adc_d_3 - adc_d_1 - (adc_d << 1); + +// Registers to store steepest edges detected: +reg [7:0] rx_mod_falling_edge_max; +reg [7:0] rx_mod_rising_edge_max; // A register to send the results to the arm reg signed [7:0] to_arm; -assign avg[7:0] = average[11:4]; -assign dif = lavg - avg; reg bit_to_arm; reg fdt_indicator, fdt_elapsed; @@ -115,36 +129,67 @@ reg [2:0] ssp_frame_counter; // ADC data appears on the rising edge, so sample it on the falling edge always @(negedge adc_clk) begin - - // last bit = 0 then fdt = 1172, in case of 0x26 (7-bit command, LSB first!) - // last bit = 1 then fdt = 1236, in case of 0x52 (7-bit command, LSB first!) - if(fdt_counter == 11'd740) fdt_indicator = 1'b1; + // ------------------------------------------------------------------------------------------------------------------------------------------------------------------ + // relevant for TAGSIM_MOD only. Timing of Tag's answer to a command received from a reader + // ISO14443-3 specifies: + // fdt = 1172, if last bit was 0. + // fdt = 1236, if last bit was 1. + // the FPGA takes care for the 1172 delay. To achieve the additional 1236-1172=64 ticks delay, the ARM must send an additional correction bit (before the start bit). + // The correction bit will be coded as 00010000, i.e. it adds 4 bits to the transmission stream, causing the required delay. + if(fdt_counter == 11'd740) fdt_indicator = 1'b1; // fdt_indicator is true for 740 <= fdt_counter <= 1148. Ready to buffer data. (?) + // Shouldn' this be 1236 - 720 = 516? (The mod_sig_buf can buffer 46 data bits, + // i.e. a maximum delay of 46 * 16 = 720 adc_clk ticks) - if(fdt_counter == 11'd1148) + if(fdt_counter == 11'd1148) // additional 16 (+ eventual n*128) adc_clk_ticks delay will be added by the mod_sig_buf below + // the remaining 8 ticks delay comes from the 8 ticks timing difference between reseting fdt_counter and the mod_sig_buf clock. begin if(fdt_elapsed) begin - if(negedge_cnt[3:0] == mod_sig_flip[3:0]) mod_sig_coil <= mod_sig; + if(negedge_cnt[3:0] == mod_sig_flip[3:0]) mod_sig_coil <= mod_sig; // start modulating (if mod_sig is already set) end else begin - mod_sig_flip[3:0] <= negedge_cnt[3:0]; - mod_sig_coil <= mod_sig; + mod_sig_flip[3:0] <= negedge_cnt[3:0]; // exact timing of modulation + mod_sig_coil <= mod_sig; // modulate (if mod_sig is already set) fdt_elapsed = 1'b1; fdt_indicator = 1'b0; - if(~(| mod_sig_ptr[5:0])) mod_sig_ptr <= 6'b001001; - else temp_buffer_reset = 1'b1; // fix position of the buffer pointer + if(~(| mod_sig_ptr[5:0])) mod_sig_ptr <= 6'b001001; // didn't receive a 1 yet. Delay next 1 by n*128 ticks. + else temp_buffer_reset = 1'b1; // else fix the buffer size at current position end end else begin - fdt_counter <= fdt_counter + 1; + fdt_counter <= fdt_counter + 1; // Count until 1148 end - if(& negedge_cnt[3:0]) + + //------------------------------------------------------------------------------------------------------------------------------------------- + // Relevant for READER_LISTEN only + // look for steepest falling and rising edges: + if (adc_d_filtered > 0) + begin + if (adc_d_filtered > rx_mod_falling_edge_max) + rx_mod_falling_edge_max <= adc_d_filtered; + end + else + begin + if (-adc_d_filtered > rx_mod_rising_edge_max) + rx_mod_rising_edge_max <= -adc_d_filtered; + end + + // store previous samples for filtering and edge detection: + adc_d_4 <= adc_d_3; + adc_d_3 <= adc_d_2; + adc_d_2 <= adc_d_1; + adc_d_1 <= adc_d; + + + + if(& negedge_cnt[3:0]) // == 0xf == 15 begin - // When there is a dip in the signal and not in reader mode + // Relevant for TAGSIM_MOD only (timing Tag's answer. See above) + // When there is a dip in the signal and not in (READER_MOD, READER_LISTEN, TAGSIM_MOD) if(~after_hysteresis && mod_sig_buf_empty && ~((mod_type == 3'b100) || (mod_type == 3'b011) || (mod_type == 3'b010))) // last condition to prevent reset begin fdt_counter <= 11'd0; @@ -154,74 +199,33 @@ begin mod_sig_ptr <= 6'b000000; end - lavg <= avg; - - if(stepsize<16) stepsize = 8'd16; - - if(dif>0) - begin - step1 = dif*3; - step2 = stepsize*2; // 3:2 - if(step1>step2) - begin - curbit = 1'b0; - stepsize = dif; - end - end - else - begin - step1 = dif*3; - step1 = -step1; - step2 = stepsize*2; - if(step1>step2) - begin - curbit = 1'b1; - stepsize = -dif; - end - end - - if(curbit) - begin - count_zeros <= 4'd0; - if(& count_ones[3:2]) - begin - curbit = 1'b0; // suppressed signal - stepsize = 8'd24; // just a fine number - end + // Relevant for READER_LISTEN only + // detect modulation signal: if modulating, there must be a falling and a rising edge ... and vice versa + if (rx_mod_falling_edge_max > 6 && rx_mod_rising_edge_max > 6) + curbit = 1'b1; // modulation else - begin - count_ones <= count_ones + 1; - end - end - else - begin - count_ones <= 4'd0; - if(& count_zeros[3:0]) - begin - stepsize = 8'd24; - end - else - begin - count_zeros <= count_zeros + 1; - end - end - + curbit = 1'b0; // no modulation + + // prepare next edge detection: + rx_mod_rising_edge_max <= 0; + rx_mod_falling_edge_max <= 0; + + // What do we communicate to the ARM - if(mod_type == 3'b001) sendbit = after_hysteresis; - else if(mod_type == 3'b010) + if(mod_type == 3'b001) sendbit = after_hysteresis; // TAGSIM_LISTEN + else if(mod_type == 3'b010) // TAGSIM_MOD begin if(fdt_counter > 11'd772) sendbit = mod_sig_coil; else sendbit = fdt_indicator; end - else if(mod_type == 3'b011) sendbit = curbit; - else sendbit = 1'b0; + else if(mod_type == 3'b011) sendbit = curbit; // READER_LISTEN + else sendbit = 1'b0; // READER_MOD, SNIFFER end - if(~(| negedge_cnt[3:0])) average <= adc_d; - else average <= average + adc_d; - - if(negedge_cnt == 7'd63) + //------------------------------------------------------------------------------------------------------------------------------------------ + // Relevant for SNIFFER mode only. Prepare communication to ARM. + if(negedge_cnt == 7'd63) begin if(deep_modulation) begin @@ -234,7 +238,7 @@ begin negedge_cnt <= 0; - end + end else begin negedge_cnt <= negedge_cnt + 1; @@ -256,35 +260,48 @@ begin bit3 <= curbit; end - - if(mod_type != 3'b000) + //-------------------------------------------------------------------------------------------------------------------------------------------------------------- + // Relevant in TAGSIM_MOD only. Delay-Line to buffer data and send it at the correct time + // Note: Data in READER_MOD is fed through this delay line as well. + if(mod_type != 3'b000) // != SNIFFER begin - if(negedge_cnt[3:0] == 4'b1000) + if(negedge_cnt[3:0] == 4'b1000) // == 0x8 begin - // The modulation signal of the tag - mod_sig_buf[47:0] <= {mod_sig_buf[46:1], ssp_dout, 1'b0}; - if((ssp_dout || (| mod_sig_ptr[5:0])) && ~fdt_elapsed) - if(mod_sig_ptr == 6'b101110) + // The modulation signal of the tag. The delay line is only relevant for TAGSIM_MOD, but used in other modes as well. + // Note: this means that even in READER_MOD, there will be an arbitrary delay depending on the time of a previous reset of fdt_counter and the time and + // content of the next bit to be transmitted. + mod_sig_buf[47:0] <= {mod_sig_buf[46:1], ssp_dout, 1'b0}; // shift in new data starting at mod_sig_buf[1]. mod_sig_buf[0] = 0 always. + if((ssp_dout || (| mod_sig_ptr[5:0])) && ~fdt_elapsed) // buffer a 1 (and all subsequent data) until fdt_counter = 1148 adc_clk ticks. + if(mod_sig_ptr == 6'b101110) // buffer overflow at 46 - this would mean data loss begin mod_sig_ptr <= 6'b000000; end - else mod_sig_ptr <= mod_sig_ptr + 1; - else if(fdt_elapsed && ~temp_buffer_reset) + else mod_sig_ptr <= mod_sig_ptr + 1; // increase buffer (= increase delay by 16 adc_clk ticks). ptr always points to first 1. + else if(fdt_elapsed && ~temp_buffer_reset) + // fdt_elapsed. If we didn't receive a 1 yet, ptr will be at 9 and not yet fixed. Otherwise temp_buffer_reset will be 1 already. begin - if(ssp_dout) temp_buffer_reset = 1'b1; - if(mod_sig_ptr == 6'b000010) mod_sig_ptr <= 6'b001001; - else mod_sig_ptr <= mod_sig_ptr - 1; + // wait for the next 1 after fdt_elapsed before fixing the delay and starting modulation. This ensures that the response can only happen + // at intervals of 8 * 16 = 128 adc_clk ticks intervals (as defined in ISO14443-3) + if(ssp_dout) temp_buffer_reset = 1'b1; + if(mod_sig_ptr == 6'b000010) mod_sig_ptr <= 6'b001001; // still nothing received, need to go for the next interval + else mod_sig_ptr <= mod_sig_ptr - 1; // decrease buffer. end else + // mod_sig_ptr and therefore the delay is now fixed until fdt_counter is reset (this can happen in SNIFFER and TAGSIM_LISTEN mode only. Note that SNIFFER + // mode (3'b000) is the default and is active in FPGA_MAJOR_MODE_OFF if no other minor mode is explicitly requested. begin - // side effect: when ptr = 1 it will cancel the first 1 of every block of ones + // don't modulate with the correction bit (which is sent as 00010000, all other bits will come with at least 2 consecutive 1s) + // side effect: when ptr = 1 it will cancel the first 1 of every block of ones. Note: this would only be the case if we received a 1 just before fdt_elapsed. if(~mod_sig_buf[mod_sig_ptr-1] && ~mod_sig_buf[mod_sig_ptr+1]) mod_sig = 1'b0; - else mod_sig = mod_sig_buf[mod_sig_ptr] & fdt_elapsed; // & fdt_elapsed was for direct relay to oe4 + // finally, do the modulation: + else mod_sig = mod_sig_buf[mod_sig_ptr] & fdt_elapsed; end end end - // SSP Clock and data + //----------------------------------------------------------------------------------------------------------------------------------------------------------------------- + // Communication to ARM (SSP Clock and data) + // SNIFFER mode (ssp_clk = adc_clk / 8, ssp_frame clock = adc_clk / 64)): if(mod_type == 3'b000) begin if(negedge_cnt[2:0] == 3'b100) @@ -308,6 +325,9 @@ begin bit_to_arm = to_arm[7]; end else + //----------------------------------------------------------------------------------------------------------------------------------------------------------------------- + // Communication to ARM (SSP Clock and data) + // all other modes (ssp_clk = adc_clk / 16, ssp_frame clock = adc_clk / 128): begin if(negedge_cnt[3:0] == 4'b1000) ssp_clk <= 1'b0; @@ -331,30 +351,29 @@ end assign ssp_din = bit_to_arm; -// Modulating carrier frequency is fc/16 + +// Modulating carrier (adc_clk/16, for TAGSIM_MOD only). Will be 0 for other modes. wire modulating_carrier; -assign modulating_carrier = (mod_sig_coil & negedge_cnt[3] & (mod_type == 3'b010)); -assign pwr_hi = (ck_1356megb & (((mod_type == 3'b100) & ~mod_sig_coil) || (mod_type == 3'b011))); +assign modulating_carrier = (mod_sig_coil & negedge_cnt[3] & (mod_type == 3'b010)); // in TAGSIM_MOD only. Otherwise always 0. + +// for READER_MOD only: drop carrier for mod_sig_coil==1 (pause), READER_LISTEN: carrier always on, others: carrier always off +assign pwr_hi = (ck_1356megb & (((mod_type == 3'b100) & ~mod_sig_coil) || (mod_type == 3'b011))); -// This one is all LF, so doesn't matter -//assign pwr_oe2 = modulating_carrier; -assign pwr_oe2 = 1'b0; -// Toggle only one of these, since we are already producing much deeper -// modulation than a real tag would. -//assign pwr_oe1 = modulating_carrier; +// Enable HF antenna drivers: assign pwr_oe1 = 1'b0; +assign pwr_oe3 = 1'b0; + +// TAGSIM_MOD: short circuit antenna with different resistances (modulated by modulating_carrier) +// for pwr_oe4 = 1 (tristate): antenna load = 10k || 33 = 32,9 Ohms +// for pwr_oe4 = 0 (active): antenna load = 10k || 33 || 33 = 16,5 Ohms assign pwr_oe4 = modulating_carrier; -//assign pwr_oe4 = 1'b0; -// This one is always on, so that we can watch the carrier. -//assign pwr_oe3 = modulating_carrier; -assign pwr_oe3 = 1'b0; +// This is all LF, so doesn't matter. +assign pwr_oe2 = 1'b0; +assign pwr_lo = 1'b0; assign dbg = negedge_cnt[3]; -// Unused. -assign pwr_lo = 1'b0; - endmodule diff --git a/fpga/xst.scr b/fpga/xst.scr index 60d24c64..406bbeee 100644 --- a/fpga/xst.scr +++ b/fpga/xst.scr @@ -1 +1 @@ -run -ifn fpga.v -ifmt Verilog -ofn fpga.ngc -ofmt NGC -p xc2s30-6vq100 -opt_mode Speed -opt_level 1 -ent fpga +run -ifn fpga.v -ifmt Verilog -ofn fpga.ngc -ofmt NGC -p xc2s30-5-vq100 -opt_mode Speed -opt_level 1 -ent fpga