]> cvs.zerfleddert.de Git - proxmark3-svn/blame - fpga/hi_simulate.v
New FPGA code for bidirectional LF emulation
[proxmark3-svn] / fpga / hi_simulate.v
CommitLineData
6658905f 1//-----------------------------------------------------------------------------\r
2// Pretend to be an ISO 14443 tag. We will do this by alternately short-\r
3// circuiting and open-circuiting the antenna coil, with the tri-state\r
4// pins. \r
5//\r
6// We communicate over the SSP, as a bitstream (i.e., might as well be\r
7// unframed, though we still generate the word sync signal). The output\r
8// (ARM -> FPGA) tells us whether to modulate or not. The input (FPGA\r
9// -> ARM) is us using the A/D as a fancy comparator; this is with\r
10// (software-added) hysteresis, to undo the high-pass filter.\r
11//\r
12// At this point only Type A is implemented. This means that we are using a\r
13// bit rate of 106 kbit/s, or fc/128. Oversample by 4, which ought to make\r
14// things practical for the ARM (fc/32, 423.8 kbits/s, ~50 kbytes/s)\r
15//\r
16// Jonathan Westhues, October 2006\r
17//-----------------------------------------------------------------------------\r
18\r
19module hi_simulate(\r
20 pck0, ck_1356meg, ck_1356megb,\r
21 pwr_lo, pwr_hi, pwr_oe1, pwr_oe2, pwr_oe3, pwr_oe4,\r
22 adc_d, adc_clk,\r
23 ssp_frame, ssp_din, ssp_dout, ssp_clk,\r
24 cross_hi, cross_lo,\r
25 dbg,\r
26 mod_type\r
27);\r
28 input pck0, ck_1356meg, ck_1356megb;\r
29 output pwr_lo, pwr_hi, pwr_oe1, pwr_oe2, pwr_oe3, pwr_oe4;\r
30 input [7:0] adc_d;\r
31 output adc_clk;\r
32 input ssp_dout;\r
33 output ssp_frame, ssp_din, ssp_clk;\r
34 input cross_hi, cross_lo;\r
35 output dbg;\r
36 input [2:0] mod_type;\r
37\r
38// Power amp goes between LOW and tri-state, so pwr_hi (and pwr_lo) can\r
39// always be low.\r
40assign pwr_hi = 1'b0;\r
41assign pwr_lo = 1'b0;\r
42\r
43// The comparator with hysteresis on the output from the peak detector.\r
44reg after_hysteresis;\r
45assign adc_clk = ck_1356meg;\r
46\r
47always @(negedge adc_clk)\r
48begin\r
49 if(& adc_d[7:5]) after_hysteresis = 1'b1;\r
50 else if(~(| adc_d[7:5])) after_hysteresis = 1'b0;\r
51end\r
52\r
53// Divide 13.56 MHz by 32 to produce the SSP_CLK\r
54reg [4:0] ssp_clk_divider;\r
55always @(posedge adc_clk)\r
56 ssp_clk_divider <= (ssp_clk_divider + 1);\r
57assign ssp_clk = ssp_clk_divider[4];\r
58\r
59// Divide SSP_CLK by 8 to produce the byte framing signal; the phase of\r
60// this is arbitrary, because it's just a bitstream.\r
61// One nasty issue, though: I can't make it work with both rx and tx at\r
62// once. The phase wrt ssp_clk must be changed. TODO to find out why\r
63// that is and make a better fix.\r
64reg [2:0] ssp_frame_divider_to_arm;\r
65always @(posedge ssp_clk)\r
66 ssp_frame_divider_to_arm <= (ssp_frame_divider_to_arm + 1);\r
67reg [2:0] ssp_frame_divider_from_arm;\r
68always @(negedge ssp_clk)\r
69 ssp_frame_divider_from_arm <= (ssp_frame_divider_from_arm + 1);\r
70\r
71reg ssp_frame;\r
72always @(ssp_frame_divider_to_arm or ssp_frame_divider_from_arm or mod_type)\r
73 if(mod_type == 3'b000) // not modulating, so listening, to ARM\r
74 ssp_frame = (ssp_frame_divider_to_arm == 3'b000);\r
75 else\r
76 ssp_frame = (ssp_frame_divider_from_arm == 3'b000);\r
77\r
78// Synchronize up the after-hysteresis signal, to produce DIN.\r
79reg ssp_din;\r
80always @(posedge ssp_clk)\r
81 ssp_din = after_hysteresis;\r
82\r
83// Modulating carrier frequency is fc/16, reuse ssp_clk divider for that\r
84reg modulating_carrier;\r
85always @(mod_type or ssp_clk or ssp_dout)\r
86 if(mod_type == 3'b000)\r
87 modulating_carrier <= 1'b0; // no modulation\r
88 else if(mod_type == 3'b001)\r
89 modulating_carrier <= ssp_dout ^ ssp_clk_divider[3]; // XOR means BPSK\r
90 else\r
91 modulating_carrier <= 1'b0; // yet unused\r
92\r
93// This one is all LF, so doesn't matter\r
94assign pwr_oe2 = modulating_carrier;\r
95\r
96// Toggle only one of these, since we are already producing much deeper\r
97// modulation than a real tag would.\r
98assign pwr_oe1 = modulating_carrier;\r
99assign pwr_oe4 = modulating_carrier;\r
100\r
101// This one is always on, so that we can watch the carrier.\r
102assign pwr_oe3 = 1'b0;\r
103\r
104assign dbg = after_hysteresis;\r
105\r
106endmodule\r
Impressum, Datenschutz