1 //-----------------------------------------------------------------------------
2 // The main application code. This is the first thing called after start.c
4 // Jonathan Westhues, Mar 2006
5 // Edits by Gerhard de Koning Gans, Sep 2007 (##)
6 //-----------------------------------------------------------------------------
12 // The large multi-purpose buffer, typically used to hold A/D samples,
13 // maybe pre-processed in some way.
16 //=============================================================================
17 // A buffer where we can queue things up to be sent through the FPGA, for
18 // any purpose (fake tag, as reader, whatever). We go MSB first, since that
19 // is the order in which they go out on the wire.
20 //=============================================================================
26 void ToSendReset(void)
32 void ToSendStuffBit(int b
)
36 ToSend
[ToSendMax
] = 0;
41 ToSend
[ToSendMax
] |= (1 << (7 - ToSendBit
));
46 if(ToSendBit
>= sizeof(ToSend
)) {
48 DbpString("ToSendStuffBit overflowed!");
52 //=============================================================================
53 // Debug print functions, to go out over USB, to the usual PC-side client.
54 //=============================================================================
56 void DbpString(char *str
)
59 c
.cmd
= CMD_DEBUG_PRINT_STRING
;
61 memcpy(c
.d
.asBytes
, str
, c
.ext1
);
63 UsbSendPacket((BYTE
*)&c
, sizeof(c
));
64 // TODO fix USB so stupid things like this aren't req'd
68 void DbpIntegers(int x1
, int x2
, int x3
)
71 c
.cmd
= CMD_DEBUG_PRINT_INTEGERS
;
76 UsbSendPacket((BYTE
*)&c
, sizeof(c
));
81 void AcquireRawAdcSamples125k(BOOL at134khz
)
83 BYTE
*dest
= (BYTE
*)BigBuf
;
84 int n
= sizeof(BigBuf
);
90 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER
| FPGA_LF_READER_USE_134_KHZ
);
92 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER
| FPGA_LF_READER_USE_125_KHZ
);
95 // Connect the A/D to the peak-detected low-frequency path.
96 SetAdcMuxFor(GPIO_MUXSEL_LOPKD
);
98 // Give it a bit of time for the resonant antenna to settle.
101 // Now set up the SSC to get the ADC samples that are now streaming at us.
106 if(SSC_STATUS
& (SSC_STATUS_TX_READY
)) {
107 SSC_TRANSMIT_HOLDING
= 0x43;
110 if(SSC_STATUS
& (SSC_STATUS_RX_READY
)) {
111 dest
[i
] = (BYTE
)SSC_RECEIVE_HOLDING
;
119 DbpIntegers(dest
[0], dest
[1], at134khz
);
122 //-----------------------------------------------------------------------------
123 // Read an ADC channel and block till it completes, then return the result
124 // in ADC units (0 to 1023). Also a routine to average sixteen samples and
126 //-----------------------------------------------------------------------------
127 static int ReadAdc(int ch
)
131 ADC_CONTROL
= ADC_CONTROL_RESET
;
132 ADC_MODE
= ADC_MODE_PRESCALE(32) | ADC_MODE_STARTUP_TIME(16) |
133 ADC_MODE_SAMPLE_HOLD_TIME(8);
134 ADC_CHANNEL_ENABLE
= ADC_CHANNEL(ch
);
136 ADC_CONTROL
= ADC_CONTROL_START
;
137 while(!(ADC_STATUS
& ADC_END_OF_CONVERSION(ch
)))
139 d
= ADC_CHANNEL_DATA(ch
);
144 static int AvgAdc(int ch
)
149 for(i
= 0; i
< 32; i
++) {
153 return (a
+ 15) >> 5;
156 void MeasureAntennaTuning(void)
158 // Impedances are Zc = 1/(j*omega*C), in ohms
159 #define LF_TUNING_CAP_Z 1273 // 1 nF @ 125 kHz
160 #define HF_TUNING_CAP_Z 235 // 50 pF @ 13.56 MHz
162 int vLf125
, vLf134
, vHf
; // in mV
166 // Let the FPGA drive the low-frequency antenna around 125 kHz.
167 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER
| FPGA_LF_READER_USE_125_KHZ
);
170 // Vref = 3.3V, and a 10000:240 voltage divider on the input
171 // can measure voltages up to 137500 mV
172 vLf125
= (137500 * vLf125
) >> 10;
174 // Let the FPGA drive the low-frequency antenna around 134 kHz.
175 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER
| FPGA_LF_READER_USE_134_KHZ
);
178 // Vref = 3.3V, and a 10000:240 voltage divider on the input
179 // can measure voltages up to 137500 mV
180 vLf134
= (137500 * vLf134
) >> 10;
182 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
183 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR
);
186 // Vref = 3300mV, and an 10:1 voltage divider on the input
187 // can measure voltages up to 33000 mV
188 vHf
= (33000 * vHf
) >> 10;
190 c
.cmd
= CMD_MEASURED_ANTENNA_TUNING
;
191 c
.ext1
= (vLf125
<< 0) | (vLf134
<< 16);
193 c
.ext3
= (LF_TUNING_CAP_Z
<< 0) | (HF_TUNING_CAP_Z
<< 16);
194 UsbSendPacket((BYTE
*)&c
, sizeof(c
));
197 void SimulateTagLowFrequency(int period
)
200 BYTE
*tab
= (BYTE
*)BigBuf
;
202 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_SIMULATOR
);
204 PIO_ENABLE
= (1 << GPIO_SSC_DOUT
) | (1 << GPIO_SSC_CLK
);
206 PIO_OUTPUT_ENABLE
= (1 << GPIO_SSC_DOUT
);
207 PIO_OUTPUT_DISABLE
= (1 << GPIO_SSC_CLK
);
209 #define SHORT_COIL() LOW(GPIO_SSC_DOUT)
210 #define OPEN_COIL() HIGH(GPIO_SSC_DOUT)
214 while(!(PIO_PIN_DATA_STATUS
& (1<<GPIO_SSC_CLK
))) {
229 while(PIO_PIN_DATA_STATUS
& (1<<GPIO_SSC_CLK
)) {
237 if(i
== period
) i
= 0;
241 // compose fc/8 fc/10 waveform
242 static void fc(int c
, int *n
) {
243 BYTE
*dest
= (BYTE
*)BigBuf
;
246 // for when we want an fc8 pattern every 4 logical bits
257 // an fc/8 encoded bit is a bit pattern of 11000000 x6 = 48 samples
259 for (idx
=0; idx
<6; idx
++) {
271 // an fc/10 encoded bit is a bit pattern of 1110000000 x5 = 50 samples
273 for (idx
=0; idx
<5; idx
++) {
288 // prepare a waveform pattern in the buffer based on the ID given then
289 // simulate a HID tag until the button is pressed
290 static void CmdHIDsimTAG(int hi
, int lo
)
294 HID tag bitstream format
295 The tag contains a 44bit unique code. This is sent out MSB first in sets of 4 bits
296 A 1 bit is represented as 6 fc8 and 5 fc10 patterns
297 A 0 bit is represented as 5 fc10 and 6 fc8 patterns
298 A fc8 is inserted before every 4 bits
299 A special start of frame pattern is used consisting a0b0 where a and b are neither 0
300 nor 1 bits, they are special patterns (a = set of 12 fc8 and b = set of 10 fc10)
304 DbpString("Tags can only have 44 bits.");
308 // special start of frame marker containing invalid bit sequences
309 fc(8, &n
); fc(8, &n
); // invalid
310 fc(8, &n
); fc(10, &n
); // logical 0
311 fc(10, &n
); fc(10, &n
); // invalid
312 fc(8, &n
); fc(10, &n
); // logical 0
315 // manchester encode bits 43 to 32
316 for (i
=11; i
>=0; i
--) {
317 if ((i
%4)==3) fc(0,&n
);
319 fc(10, &n
); fc(8, &n
); // low-high transition
321 fc(8, &n
); fc(10, &n
); // high-low transition
326 // manchester encode bits 31 to 0
327 for (i
=31; i
>=0; i
--) {
328 if ((i
%4)==3) fc(0,&n
);
330 fc(10, &n
); fc(8, &n
); // low-high transition
332 fc(8, &n
); fc(10, &n
); // high-low transition
337 SimulateTagLowFrequency(n
);
341 // loop to capture raw HID waveform then FSK demodulate the TAG ID from it
342 static void CmdHIDdemodFSK(void)
344 BYTE
*dest
= (BYTE
*)BigBuf
;
345 int m
=0, n
=0, i
=0, idx
=0, found
=0, lastval
=0;
348 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER
| FPGA_LF_READER_USE_125_KHZ
);
350 // Connect the A/D to the peak-detected low-frequency path.
351 SetAdcMuxFor(GPIO_MUXSEL_LOPKD
);
353 // Give it a bit of time for the resonant antenna to settle.
356 // Now set up the SSC to get the ADC samples that are now streaming at us.
371 if(SSC_STATUS
& (SSC_STATUS_TX_READY
)) {
372 SSC_TRANSMIT_HOLDING
= 0x43;
375 if(SSC_STATUS
& (SSC_STATUS_RX_READY
)) {
376 dest
[i
] = (BYTE
)SSC_RECEIVE_HOLDING
;
377 // we don't care about actual value, only if it's more or less than a
378 // threshold essentially we capture zero crossings for later analysis
379 if(dest
[i
] < 127) dest
[i
] = 0; else dest
[i
] = 1;
390 // sync to first lo-hi transition
391 for( idx
=1; idx
<m
; idx
++) {
392 if (dest
[idx
-1]<dest
[idx
])
398 // count cycles between consecutive lo-hi transitions, there should be either 8 (fc/8)
399 // or 10 (fc/10) cycles but in practice due to noise etc we may end up with with anywhere
400 // between 7 to 11 cycles so fuzz it by treat anything <9 as 8 and anything else as 10
401 for( i
=0; idx
<m
; idx
++) {
402 if (dest
[idx
-1]<dest
[idx
]) {
417 // we now have a set of cycle counts, loop over previous results and aggregate data into bit patterns
422 for( idx
=0; idx
<m
; idx
++) {
423 if (dest
[idx
]==lastval
) {
426 // a bit time is five fc/10 or six fc/8 cycles so figure out how many bits a pattern width represents,
427 // an extra fc/8 pattern preceeds every 4 bits (about 200 cycles) just to complicate things but it gets
428 // swallowed up by rounding
429 // expected results are 1 or 2 bits, any more and it's an invalid manchester encoding
430 // special start of frame markers use invalid manchester states (no transitions) by using sequences
433 n
=(n
+1)/6; // fc/8 in sets of 6
435 n
=(n
+1)/5; // fc/10 in sets of 5
437 switch (n
) { // stuff appropriate bits in buffer
440 dest
[i
++]=dest
[idx
-1];
443 dest
[i
++]=dest
[idx
-1];
444 dest
[i
++]=dest
[idx
-1];
446 case 3: // 3 bit start of frame markers
447 dest
[i
++]=dest
[idx
-1];
448 dest
[i
++]=dest
[idx
-1];
449 dest
[i
++]=dest
[idx
-1];
451 // When a logic 0 is immediately followed by the start of the next transmisson
452 // (special pattern) a pattern of 4 bit duration lengths is created.
454 dest
[i
++]=dest
[idx
-1];
455 dest
[i
++]=dest
[idx
-1];
456 dest
[i
++]=dest
[idx
-1];
457 dest
[i
++]=dest
[idx
-1];
459 default: // this shouldn't happen, don't stuff any bits
469 // final loop, go over previously decoded manchester data and decode into usable tag ID
470 // 111000 bit pattern represent start of frame, 01 pattern represents a 1 and 10 represents a 0
471 for( idx
=0; idx
<m
-6; idx
++) {
472 // search for a start of frame marker
473 if ( dest
[idx
] && dest
[idx
+1] && dest
[idx
+2] && (!dest
[idx
+3]) && (!dest
[idx
+4]) && (!dest
[idx
+5]) )
477 if (found
&& (hi
|lo
)) {
479 DbpIntegers(hi
, lo
, (lo
>>1)&0xffff);
486 if (dest
[idx
] && (!dest
[idx
+1]) ) {
489 } else if ( (!dest
[idx
]) && dest
[idx
+1]) {
499 if ( dest
[idx
] && dest
[idx
+1] && dest
[idx
+2] && (!dest
[idx
+3]) && (!dest
[idx
+4]) && (!dest
[idx
+5]) )
503 if (found
&& (hi
|lo
)) {
505 DbpIntegers(hi
, lo
, (lo
>>1)&0xffff);
516 void SimulateTagHfListen(void)
518 BYTE
*dest
= (BYTE
*)BigBuf
;
519 int n
= sizeof(BigBuf
);
524 // We're using this mode just so that I can test it out; the simulated
525 // tag mode would work just as well and be simpler.
526 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR
| FPGA_HF_READER_RX_XCORR_848_KHZ
| FPGA_HF_READER_RX_XCORR_SNOOP
);
528 // We need to listen to the high-frequency, peak-detected path.
529 SetAdcMuxFor(GPIO_MUXSEL_HIPKD
);
535 if(SSC_STATUS
& (SSC_STATUS_TX_READY
)) {
536 SSC_TRANSMIT_HOLDING
= 0xff;
538 if(SSC_STATUS
& (SSC_STATUS_RX_READY
)) {
539 BYTE r
= (BYTE
)SSC_RECEIVE_HOLDING
;
559 DbpString("simulate tag (now type bitsamples)");
562 void UsbPacketReceived(BYTE
*packet
, int len
)
564 UsbCommand
*c
= (UsbCommand
*)packet
;
567 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K
:
568 AcquireRawAdcSamples125k(c
->ext1
);
571 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693
:
572 AcquireRawAdcSamplesIso15693();
575 case CMD_READER_ISO_15693
:
576 ReaderIso15693(c
->ext1
);
579 case CMD_SIMTAG_ISO_15693
:
580 SimTagIso15693(c
->ext1
);
584 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_14443
:
585 AcquireRawAdcSamplesIso14443(c
->ext1
);
588 case CMD_READER_ISO_14443a
:
589 ReaderIso14443a(c
->ext1
);
592 case CMD_SNOOP_ISO_14443
:
596 case CMD_SNOOP_ISO_14443a
:
600 case CMD_SIMULATE_TAG_HF_LISTEN
:
601 SimulateTagHfListen();
604 case CMD_SIMULATE_TAG_ISO_14443
:
605 SimulateIso14443Tag();
608 case CMD_SIMULATE_TAG_ISO_14443a
:
609 SimulateIso14443aTag(c
->ext1
, c
->ext2
); // ## Simulate iso14443a tag - pass tag type & UID
612 case CMD_MEASURE_ANTENNA_TUNING
:
613 MeasureAntennaTuning();
616 case CMD_HID_DEMOD_FSK
:
617 CmdHIDdemodFSK(); // Demodulate HID tag
620 case CMD_HID_SIM_TAG
:
621 CmdHIDsimTAG(c
->ext1
, c
->ext2
); // Simulate HID tag by ID
624 case CMD_FPGA_MAJOR_MODE_OFF
: // ## FPGA Control
626 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
631 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K
:
632 case CMD_DOWNLOAD_RAW_BITS_TI_TYPE
: {
634 if(c
->cmd
== CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K
) {
635 n
.cmd
= CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K
;
637 n
.cmd
= CMD_DOWNLOADED_RAW_BITS_TI_TYPE
;
640 memcpy(n
.d
.asDwords
, BigBuf
+c
->ext1
, 12*sizeof(DWORD
));
641 UsbSendPacket((BYTE
*)&n
, sizeof(n
));
644 case CMD_DOWNLOADED_SIM_SAMPLES_125K
: {
645 BYTE
*b
= (BYTE
*)BigBuf
;
646 memcpy(b
+c
->ext1
, c
->d
.asBytes
, 48);
649 case CMD_SIMULATE_TAG_125K
:
651 SimulateTagLowFrequency(c
->ext1
);
663 case CMD_SETUP_WRITE
:
664 case CMD_FINISH_WRITE
:
665 USB_D_PLUS_PULLUP_OFF();
668 RSTC_CONTROL
= RST_CONTROL_KEY
| RST_CONTROL_PROCESSOR_RESET
;
670 // We're going to reset, and the bootrom will take control.
675 DbpString("unknown command");
682 memset(BigBuf
,0,sizeof(BigBuf
));
692 // The FPGA gets its clock from us from PCK0 output, so set that up.
693 PIO_PERIPHERAL_B_SEL
= (1 << GPIO_PCK0
);
694 PIO_DISABLE
= (1 << GPIO_PCK0
);
695 PMC_SYS_CLK_ENABLE
= PMC_SYS_CLK_PROGRAMMABLE_CLK_0
;
696 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
697 PMC_PROGRAMMABLE_CLK_0
= PMC_CLK_SELECTION_PLL_CLOCK
|
698 PMC_CLK_PRESCALE_DIV_4
;
699 PIO_OUTPUT_ENABLE
= (1 << GPIO_PCK0
);
702 SPI_CONTROL
= SPI_CONTROL_RESET
;
704 SSC_CONTROL
= SSC_CONTROL_RESET
;
706 // Load the FPGA image, which we have stored in our flash.
711 // test text on different colored backgrounds
712 LCDString(" The quick brown fox ", &FONT6x8
,1,1+8*0,WHITE
,BLACK
);
713 LCDString(" jumped over the ", &FONT6x8
,1,1+8*1,BLACK
,WHITE
);
714 LCDString(" lazy dog. ", &FONT6x8
,1,1+8*2,YELLOW
,RED
);
715 LCDString(" AaBbCcDdEeFfGgHhIiJj ", &FONT6x8
,1,1+8*3,RED
,GREEN
);
716 LCDString(" KkLlMmNnOoPpQqRrSsTt ", &FONT6x8
,1,1+8*4,MAGENTA
,BLUE
);
717 LCDString("UuVvWwXxYyZz0123456789", &FONT6x8
,1,1+8*5,BLUE
,YELLOW
);
718 LCDString("`-=[]_;',./~!@#$%^&*()", &FONT6x8
,1,1+8*6,BLACK
,CYAN
);
719 LCDString(" _+{}|:\\\"<>? ",&FONT6x8
,1,1+8*7,BLUE
,MAGENTA
);
722 LCDFill(0, 1+8* 8, 132, 8, BLACK
);
723 LCDFill(0, 1+8* 9, 132, 8, WHITE
);
724 LCDFill(0, 1+8*10, 132, 8, RED
);
725 LCDFill(0, 1+8*11, 132, 8, GREEN
);
726 LCDFill(0, 1+8*12, 132, 8, BLUE
);
727 LCDFill(0, 1+8*13, 132, 8, YELLOW
);
728 LCDFill(0, 1+8*14, 132, 8, CYAN
);
729 LCDFill(0, 1+8*15, 132, 8, MAGENTA
);
737 void SpinDelay(int ms
)
739 int ticks
= (48000*ms
) >> 10;
741 // Borrow a PWM unit for my real-time clock
742 PWM_ENABLE
= PWM_CHANNEL(0);
743 // 48 MHz / 1024 gives 46.875 kHz
744 PWM_CH_MODE(0) = PWM_CH_MODE_PRESCALER(10);
745 PWM_CH_DUTY_CYCLE(0) = 0;
746 PWM_CH_PERIOD(0) = 0xffff;
748 WORD start
= (WORD
)PWM_CH_COUNTER(0);
751 WORD now
= (WORD
)PWM_CH_COUNTER(0);
752 if(now
== (WORD
)(start
+ ticks
)) {