Automatically enter bootrom when OS image doesn't appear to be proper

[proxmark3-svn] / armsrc / iso14443.c

diff --git a/armsrc/iso14443.c b/armsrc/iso14443.c
index 2579b0538da0fb3a7ffa761078591cf03efa9f6a..dc1dbf12ae4d802344e580c3d1e628395318a49f 100644 (file)
--- a/armsrc/iso14443.c
+++ b/armsrc/iso14443.c
@@ -11,7 +11,10 @@
 \r
 //static void GetSamplesFor14443(BOOL weTx, int n);\r
 \r
 \r
 //static void GetSamplesFor14443(BOOL weTx, int n);\r
 \r

-#define DMA_BUFFER_SIZE 256\r
+#define DEMOD_TRACE_SIZE 4096\r
+#define READER_TAG_BUFFER_SIZE 2048\r
+#define TAG_READER_BUFFER_SIZE 2048\r
+#define DMA_BUFFER_SIZE 1024\r

 \r
 //=============================================================================\r
 // An ISO 14443 Type B tag. We listen for commands from the reader, using\r
 \r
 //=============================================================================\r
 // An ISO 14443 Type B tag. We listen for commands from the reader, using\r


@@ -131,10 +134,20 @@ static struct {
     BYTE   *output;\r
 } Uart;\r
 \r
     BYTE   *output;\r
 } Uart;\r
 \r

+/* Receive & handle a bit coming from the reader.\r
+ *\r
+ * LED handling:\r
+ * LED A -> ON once we have received the SOF and are expecting the rest.\r
+ * LED A -> OFF once we have received EOF or are in error state or unsynced\r
+ *\r
+ * Returns: true if we received a EOF\r
+ *          false if we are still waiting for some more\r
+ */\r

 static BOOL Handle14443UartBit(int bit)\r
 {\r
     switch(Uart.state) {\r
         case STATE_UNSYNCD:\r
 static BOOL Handle14443UartBit(int bit)\r
 {\r
     switch(Uart.state) {\r
         case STATE_UNSYNCD:\r

+               LED_A_OFF();\r

             if(!bit) {\r
                 // we went low, so this could be the beginning\r
                 // of an SOF\r
             if(!bit) {\r
                 // we went low, so this could be the beginning\r
                 // of an SOF\r


@@ -154,6 +167,7 @@ static BOOL Handle14443UartBit(int bit)
                         Uart.posCnt = 0;\r
                         Uart.byteCnt = 0;\r
                         Uart.state = STATE_AWAITING_START_BIT;\r
                         Uart.posCnt = 0;\r
                         Uart.byteCnt = 0;\r
                         Uart.state = STATE_AWAITING_START_BIT;\r

+                        LED_A_ON(); // Indicate we got a valid SOF\r

                     } else {\r
                         // didn't stay down long enough\r
                         // before going high, error\r
                     } else {\r
                         // didn't stay down long enough\r
                         // before going high, error\r


@@ -186,6 +200,7 @@ static BOOL Handle14443UartBit(int bit)
                 Uart.bitCnt = 0;\r
                 Uart.shiftReg = 0;\r
                 Uart.state = STATE_RECEIVING_DATA;\r
                 Uart.bitCnt = 0;\r
                 Uart.shiftReg = 0;\r
                 Uart.state = STATE_RECEIVING_DATA;\r

+                LED_A_ON(); // Indicate we're receiving\r

             }\r
             break;\r
 \r
             }\r
             break;\r
 \r


@@ -221,6 +236,7 @@ static BOOL Handle14443UartBit(int bit)
                     }\r
                 } else if(Uart.shiftReg == 0x000) {\r
                     // this is an EOF byte\r
                     }\r
                 } else if(Uart.shiftReg == 0x000) {\r
                     // this is an EOF byte\r

+                       LED_A_OFF(); // Finished receiving\r

                     return TRUE;\r
                 } else {\r
                     // this is an error\r
                     return TRUE;\r
                 } else {\r
                     // this is an error\r


@@ -245,6 +261,8 @@ static BOOL Handle14443UartBit(int bit)
             break;\r
     }\r
 \r
             break;\r
     }\r
 \r

+    if (Uart.state == STATE_ERROR_WAIT) LED_A_OFF(); // Error\r
+\r

     return FALSE;\r
 }\r
 \r
     return FALSE;\r
 }\r
 \r


@@ -264,6 +282,8 @@ static BOOL GetIso14443CommandFromReader(BYTE *received, int *len, int maxLen)
 \r
     // Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen\r
     // only, since we are receiving, not transmitting).\r
 \r
     // Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen\r
     // only, since we are receiving, not transmitting).\r

+    // Signal field is off with the appropriate LED\r
+    LED_D_OFF();\r

     FpgaWriteConfWord(\r
        FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_NO_MODULATION);\r
 \r
     FpgaWriteConfWord(\r
        FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_NO_MODULATION);\r
 \r


@@ -278,11 +298,11 @@ static BOOL GetIso14443CommandFromReader(BYTE *received, int *len, int maxLen)
 \r
         if(BUTTON_PRESS()) return FALSE;\r
 \r
 \r
         if(BUTTON_PRESS()) return FALSE;\r
 \r

-        if(SSC_STATUS & (SSC_STATUS_TX_READY)) {\r
-            SSC_TRANSMIT_HOLDING = 0x00;\r
+        if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {\r
+            AT91C_BASE_SSC->SSC_THR = 0x00;\r

         }\r
         }\r

-        if(SSC_STATUS & (SSC_STATUS_RX_READY)) {\r
-            BYTE b = (BYTE)SSC_RECEIVE_HOLDING;\r
+        if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {\r
+            BYTE b = (BYTE)AT91C_BASE_SSC->SSC_RHR;\r

 \r
             mask = 0x80;\r
             for(i = 0; i < 8; i++, mask >>= 1) {\r
 \r
             mask = 0x80;\r
             for(i = 0; i < 8; i++, mask >>= 1) {\r


@@ -336,9 +356,8 @@ void SimulateIso14443Tag(void)
         BYTE b1, b2;\r
 \r
         if(!GetIso14443CommandFromReader(receivedCmd, &len, 100)) {\r
         BYTE b1, b2;\r
 \r
         if(!GetIso14443CommandFromReader(receivedCmd, &len, 100)) {\r

-            DbpIntegers(cmdsRecvd, 0, 0);\r
-            DbpString("button press");\r
-            break;\r
+               Dbprintf("button pressed, received %d commands", cmdsRecvd);\r
+               break;\r

         }\r
 \r
         // Good, look at the command now.\r
         }\r
 \r
         // Good, look at the command now.\r


@@ -346,8 +365,7 @@ void SimulateIso14443Tag(void)
         if(len == sizeof(cmd1) && memcmp(receivedCmd, cmd1, len)==0) {\r
             resp = resp1; respLen = resp1Len;\r
         } else {\r
         if(len == sizeof(cmd1) && memcmp(receivedCmd, cmd1, len)==0) {\r
             resp = resp1; respLen = resp1Len;\r
         } else {\r

-            DbpString("new cmd from reader:");\r
-            DbpIntegers(len, 0x1234, cmdsRecvd);\r
+            Dbprintf("new cmd from reader: len=%d, cmdsRecvd=%d", len, cmdsRecvd);\r

             // And print whether the CRC fails, just for good measure\r
             ComputeCrc14443(CRC_14443_B, receivedCmd, len-2, &b1, &b2);\r
             if(b1 != receivedCmd[len-2] || b2 != receivedCmd[len-1]) {\r
             // And print whether the CRC fails, just for good measure\r
             ComputeCrc14443(CRC_14443_B, receivedCmd, len-2, &b1, &b2);\r
             if(b1 != receivedCmd[len-2] || b2 != receivedCmd[len-1]) {\r


@@ -371,26 +389,28 @@ void SimulateIso14443Tag(void)
         if(respLen <= 0) continue;\r
 \r
         // Modulate BPSK\r
         if(respLen <= 0) continue;\r
 \r
         // Modulate BPSK\r

+        // Signal field is off with the appropriate LED\r
+        LED_D_OFF();\r

         FpgaWriteConfWord(\r
                FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_BPSK);\r
         FpgaWriteConfWord(\r
                FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_BPSK);\r

-        SSC_TRANSMIT_HOLDING = 0xff;\r
+        AT91C_BASE_SSC->SSC_THR = 0xff;\r

         FpgaSetupSsc();\r
 \r
         // Transmit the response.\r
         i = 0;\r
         for(;;) {\r
         FpgaSetupSsc();\r
 \r
         // Transmit the response.\r
         i = 0;\r
         for(;;) {\r

-            if(SSC_STATUS & (SSC_STATUS_TX_READY)) {\r
+            if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {\r

                 BYTE b = resp[i];\r
 \r
                 BYTE b = resp[i];\r
 \r

-                SSC_TRANSMIT_HOLDING = b;\r
+                AT91C_BASE_SSC->SSC_THR = b;\r

 \r
                 i++;\r
                 if(i > respLen) {\r
                     break;\r
                 }\r
             }\r
 \r
                 i++;\r
                 if(i > respLen) {\r
                     break;\r
                 }\r
             }\r

-            if(SSC_STATUS & (SSC_STATUS_RX_READY)) {\r
-                volatile BYTE b = (BYTE)SSC_RECEIVE_HOLDING;\r
+            if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {\r
+                volatile BYTE b = (BYTE)AT91C_BASE_SSC->SSC_RHR;\r

                 (void)b;\r
             }\r
         }\r
                 (void)b;\r
             }\r
         }\r


@@ -426,6 +446,17 @@ static struct {
     int     sumQ;\r
 } Demod;\r
 \r
     int     sumQ;\r
 } Demod;\r
 \r

+/*\r
+ * Handles reception of a bit from the tag\r
+ *\r
+ * LED handling:\r
+ * LED C -> ON once we have received the SOF and are expecting the rest.\r
+ * LED C -> OFF once we have received EOF or are unsynced\r
+ *\r
+ * Returns: true if we received a EOF\r
+ *          false if we are still waiting for some more\r
+ *\r
+ */\r

 static BOOL Handle14443SamplesDemod(int ci, int cq)\r
 {\r
     int v;\r
 static BOOL Handle14443SamplesDemod(int ci, int cq)\r
 {\r
     int v;\r


@@ -498,6 +529,7 @@ static BOOL Handle14443SamplesDemod(int ci, int cq)
                 if(Demod.posCount < 12) {\r
                     Demod.state = DEMOD_UNSYNCD;\r
                 } else {\r
                 if(Demod.posCount < 12) {\r
                     Demod.state = DEMOD_UNSYNCD;\r
                 } else {\r

+                       LED_C_ON(); // Got SOF\r

                     Demod.state = DEMOD_AWAITING_START_BIT;\r
                     Demod.posCount = 0;\r
                     Demod.len = 0;\r
                     Demod.state = DEMOD_AWAITING_START_BIT;\r
                     Demod.posCount = 0;\r
                     Demod.len = 0;\r


@@ -557,6 +589,7 @@ static BOOL Handle14443SamplesDemod(int ci, int cq)
                         Demod.state = DEMOD_AWAITING_START_BIT;\r
                     } else if(s == 0x000) {\r
                         // This is EOF\r
                         Demod.state = DEMOD_AWAITING_START_BIT;\r
                     } else if(s == 0x000) {\r
                         // This is EOF\r

+                       LED_C_OFF();\r

                         return TRUE;\r
                         Demod.state = DEMOD_UNSYNCD;\r
                     } else {\r
                         return TRUE;\r
                         Demod.state = DEMOD_UNSYNCD;\r
                     } else {\r


@@ -572,10 +605,17 @@ static BOOL Handle14443SamplesDemod(int ci, int cq)
             break;\r
     }\r
 \r
             break;\r
     }\r
 \r

+    if (Demod.state == DEMOD_UNSYNCD) LED_C_OFF(); // Not synchronized...\r

     return FALSE;\r
 }\r
 \r
     return FALSE;\r
 }\r
 \r

-static void GetSamplesFor14443Demod(BOOL weTx, int n)\r
+/*\r
+ *  Demodulate the samples we received from the tag\r
+ *  weTx: set to 'TRUE' if we behave like a reader\r
+ *        set to 'FALSE' if we behave like a snooper\r
+ *  quiet: set to 'TRUE' to disable debug output\r
+ */\r
+static void GetSamplesFor14443Demod(BOOL weTx, int n, BOOL quiet)\r

 {\r
     int max = 0;\r
     BOOL gotFrame = FALSE;\r
 {\r
     int max = 0;\r
     BOOL gotFrame = FALSE;\r


@@ -607,17 +647,18 @@ static void GetSamplesFor14443Demod(BOOL weTx, int n)
     lastRxCounter = DMA_BUFFER_SIZE;\r
     FpgaSetupSscDma((BYTE *)dmaBuf, DMA_BUFFER_SIZE);\r
 \r
     lastRxCounter = DMA_BUFFER_SIZE;\r
     FpgaSetupSscDma((BYTE *)dmaBuf, DMA_BUFFER_SIZE);\r
 \r

+    // Signal field is ON with the appropriate LED:\r
+       if (weTx) LED_D_ON(); else LED_D_OFF();\r

     // And put the FPGA in the appropriate mode\r
     FpgaWriteConfWord(\r
        FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ |\r
        (weTx ? 0 : FPGA_HF_READER_RX_XCORR_SNOOP));\r
 \r
     for(;;) {\r
     // And put the FPGA in the appropriate mode\r
     FpgaWriteConfWord(\r
        FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ |\r
        (weTx ? 0 : FPGA_HF_READER_RX_XCORR_SNOOP));\r
 \r
     for(;;) {\r

-        int behindBy = lastRxCounter - PDC_RX_COUNTER(SSC_BASE);\r
+        int behindBy = lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR;\r

         if(behindBy > max) max = behindBy;\r
 \r
         if(behindBy > max) max = behindBy;\r
 \r

-        LED_D_ON();\r
-        while(((lastRxCounter-PDC_RX_COUNTER(SSC_BASE)) & (DMA_BUFFER_SIZE-1))\r
+        while(((lastRxCounter-AT91C_BASE_PDC_SSC->PDC_RCR) & (DMA_BUFFER_SIZE-1))\r

                     > 2)\r
         {\r
             ci = upTo[0];\r
                     > 2)\r
         {\r
             ci = upTo[0];\r


@@ -625,8 +666,8 @@ static void GetSamplesFor14443Demod(BOOL weTx, int n)
             upTo += 2;\r
             if(upTo - dmaBuf > DMA_BUFFER_SIZE) {\r
                 upTo -= DMA_BUFFER_SIZE;\r
             upTo += 2;\r
             if(upTo - dmaBuf > DMA_BUFFER_SIZE) {\r
                 upTo -= DMA_BUFFER_SIZE;\r

-                PDC_RX_NEXT_POINTER(SSC_BASE) = (DWORD)upTo;\r
-                PDC_RX_NEXT_COUNTER(SSC_BASE) = DMA_BUFFER_SIZE;\r
+                AT91C_BASE_PDC_SSC->PDC_RNPR = (DWORD)upTo;\r
+                AT91C_BASE_PDC_SSC->PDC_RNCR = DMA_BUFFER_SIZE;\r

             }\r
             lastRxCounter -= 2;\r
             if(lastRxCounter <= 0) {\r
             }\r
             lastRxCounter -= 2;\r
             if(lastRxCounter <= 0) {\r


@@ -642,14 +683,13 @@ static void GetSamplesFor14443Demod(BOOL weTx, int n)
                 gotFrame = 1;\r
             }\r
         }\r
                 gotFrame = 1;\r
             }\r
         }\r

-        LED_D_OFF();\r

 \r
         if(samples > 2000) {\r
             break;\r
         }\r
     }\r
 \r
         if(samples > 2000) {\r
             break;\r
         }\r
     }\r

-    PDC_CONTROL(SSC_BASE) = PDC_RX_DISABLE;\r
-    DbpIntegers(max, gotFrame, -1);\r
+    AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTDIS;\r
+    if (!quiet) Dbprintf("%x %x %x", max, gotFrame, Demod.len);\r

 }\r
 \r
 //-----------------------------------------------------------------------------\r
 }\r
 \r
 //-----------------------------------------------------------------------------\r


@@ -668,12 +708,12 @@ static void GetSamplesFor14443Demod(BOOL weTx, int n)
 \r
     c = 0;\r
     for(;;) {\r
 \r
     c = 0;\r
     for(;;) {\r

-        if(SSC_STATUS & (SSC_STATUS_TX_READY)) {\r
-            SSC_TRANSMIT_HOLDING = 0x43;\r
+        if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {\r
+            AT91C_BASE_SSC->SSC_THR = 0x43;\r

         }\r
         }\r

-        if(SSC_STATUS & (SSC_STATUS_RX_READY)) {\r
+        if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {\r

             SBYTE b;\r
             SBYTE b;\r

-            b = (SBYTE)SSC_RECEIVE_HOLDING;\r
+            b = (SBYTE)AT91C_BASE_SSC->SSC_RHR;\r

 \r
             dest[c++] = (BYTE)b;\r
 \r
 \r
             dest[c++] = (BYTE)b;\r
 \r


@@ -693,20 +733,24 @@ static void TransmitFor14443(void)
 \r
     FpgaSetupSsc();\r
 \r
 \r
     FpgaSetupSsc();\r
 \r

-    while(SSC_STATUS & (SSC_STATUS_TX_READY)) {\r
-        SSC_TRANSMIT_HOLDING = 0xff;\r
+    while(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {\r
+        AT91C_BASE_SSC->SSC_THR = 0xff;\r

     }\r
 \r
     }\r
 \r

-    FpgaWriteConfWord(\r
+    // Signal field is ON with the appropriate Red LED\r
+       LED_D_ON();\r
+       // Signal we are transmitting with the Green LED\r
+       LED_B_ON();\r
+       FpgaWriteConfWord(\r

        FPGA_MAJOR_MODE_HF_READER_TX | FPGA_HF_READER_TX_SHALLOW_MOD);\r
 \r
     for(c = 0; c < 10;) {\r
        FPGA_MAJOR_MODE_HF_READER_TX | FPGA_HF_READER_TX_SHALLOW_MOD);\r
 \r
     for(c = 0; c < 10;) {\r

-        if(SSC_STATUS & (SSC_STATUS_TX_READY)) {\r
-            SSC_TRANSMIT_HOLDING = 0xff;\r
+        if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {\r
+            AT91C_BASE_SSC->SSC_THR = 0xff;\r

             c++;\r
         }\r
             c++;\r
         }\r

-        if(SSC_STATUS & (SSC_STATUS_RX_READY)) {\r
-            volatile DWORD r = SSC_RECEIVE_HOLDING;\r
+        if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {\r
+            volatile DWORD r = AT91C_BASE_SSC->SSC_RHR;\r

             (void)r;\r
         }\r
         WDT_HIT();\r
             (void)r;\r
         }\r
         WDT_HIT();\r


@@ -714,19 +758,20 @@ static void TransmitFor14443(void)
 \r
     c = 0;\r
     for(;;) {\r
 \r
     c = 0;\r
     for(;;) {\r

-        if(SSC_STATUS & (SSC_STATUS_TX_READY)) {\r
-            SSC_TRANSMIT_HOLDING = ToSend[c];\r
+        if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {\r
+            AT91C_BASE_SSC->SSC_THR = ToSend[c];\r

             c++;\r
             if(c >= ToSendMax) {\r
                 break;\r
             }\r
         }\r
             c++;\r
             if(c >= ToSendMax) {\r
                 break;\r
             }\r
         }\r

-        if(SSC_STATUS & (SSC_STATUS_RX_READY)) {\r
-            volatile DWORD r = SSC_RECEIVE_HOLDING;\r
+        if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {\r
+            volatile DWORD r = AT91C_BASE_SSC->SSC_RHR;\r

             (void)r;\r
         }\r
         WDT_HIT();\r
     }\r
             (void)r;\r
         }\r
         WDT_HIT();\r
     }\r

+    LED_B_OFF(); // Finished sending\r

 }\r
 \r
 //-----------------------------------------------------------------------------\r
 }\r
 \r
 //-----------------------------------------------------------------------------\r


@@ -788,12 +833,58 @@ void CodeIso14443bAsReader(const BYTE *cmd, int len)
 //-----------------------------------------------------------------------------\r
 // Read an ISO 14443 tag. We send it some set of commands, and record the\r
 // responses.\r
 //-----------------------------------------------------------------------------\r
 // Read an ISO 14443 tag. We send it some set of commands, and record the\r
 // responses.\r

+// The command name is misleading, it actually decodes the reponse in HEX\r
+// into the output buffer (read the result using hexsamples, not hisamples)\r

 //-----------------------------------------------------------------------------\r
 void AcquireRawAdcSamplesIso14443(DWORD parameter)\r
 {\r
 //-----------------------------------------------------------------------------\r
 void AcquireRawAdcSamplesIso14443(DWORD parameter)\r
 {\r

-//    BYTE cmd1[] = { 0x05, 0x00, 0x00, 0x71, 0xff };\r

     BYTE cmd1[] = { 0x05, 0x00, 0x08, 0x39, 0x73 };\r
 \r
     BYTE cmd1[] = { 0x05, 0x00, 0x08, 0x39, 0x73 };\r
 \r

+    // Make sure that we start from off, since the tags are stateful;\r
+    // confusing things will happen if we don't reset them between reads.\r
+    FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
+    LED_D_OFF();\r
+    SpinDelay(200);\r
+\r
+    SetAdcMuxFor(GPIO_MUXSEL_HIPKD);\r
+    FpgaSetupSsc();\r
+\r
+    // Now give it time to spin up.\r
+    // Signal field is on with the appropriate LED\r
+    LED_D_ON();\r
+    FpgaWriteConfWord(\r
+       FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ);\r
+    SpinDelay(200);\r
+\r
+    CodeIso14443bAsReader(cmd1, sizeof(cmd1));\r
+    TransmitFor14443();\r
+//    LED_A_ON();\r
+    GetSamplesFor14443Demod(TRUE, 2000, FALSE);\r
+//    LED_A_OFF();\r
+}\r
+\r
+//-----------------------------------------------------------------------------\r
+// Read a SRI512 ISO 14443 tag.\r
+//\r
+// SRI512 tags are just simple memory tags, here we're looking at making a dump\r
+// of the contents of the memory. No anticollision algorithm is done, we assume\r
+// we have a single tag in the field.\r
+//\r
+// I tried to be systematic and check every answer of the tag, every CRC, etc...\r
+//-----------------------------------------------------------------------------\r
+void ReadSRI512Iso14443(DWORD parameter)\r
+{\r
+     ReadSTMemoryIso14443(parameter,0x0F);\r
+}\r
+void ReadSRIX4KIso14443(DWORD parameter)\r
+{\r
+     ReadSTMemoryIso14443(parameter,0x7F);\r
+}\r
+\r
+void ReadSTMemoryIso14443(DWORD parameter,DWORD dwLast)\r
+{\r
+    BYTE i = 0x00;\r
+\r

     // Make sure that we start from off, since the tags are stateful;\r
     // confusing things will happen if we don't reset them between reads.\r
     LED_D_OFF();\r
     // Make sure that we start from off, since the tags are stateful;\r
     // confusing things will happen if we don't reset them between reads.\r
     LED_D_OFF();\r


@@ -804,17 +895,116 @@ void AcquireRawAdcSamplesIso14443(DWORD parameter)
     FpgaSetupSsc();\r
 \r
     // Now give it time to spin up.\r
     FpgaSetupSsc();\r
 \r
     // Now give it time to spin up.\r

+    // Signal field is on with the appropriate LED\r
+    LED_D_ON();\r

     FpgaWriteConfWord(\r
        FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ);\r
     SpinDelay(200);\r
 \r
     FpgaWriteConfWord(\r
        FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ);\r
     SpinDelay(200);\r
 \r

+    // First command: wake up the tag using the INITIATE command\r
+    BYTE cmd1[] = { 0x06, 0x00, 0x97, 0x5b};\r
+    CodeIso14443bAsReader(cmd1, sizeof(cmd1));\r
+    TransmitFor14443();\r
+//    LED_A_ON();\r
+    GetSamplesFor14443Demod(TRUE, 2000,TRUE);\r
+//    LED_A_OFF();\r
+\r
+    if (Demod.len == 0) {\r
+       DbpString("No response from tag");\r
+       return;\r
+    } else {\r
+       Dbprintf("Randomly generated UID from tag (+ 2 byte CRC): %x %x %x",\r
+               Demod.output[0], Demod.output[1],Demod.output[2]);\r
+    }\r
+    // There is a response, SELECT the uid\r
+    DbpString("Now SELECT tag:");\r
+    cmd1[0] = 0x0E; // 0x0E is SELECT\r
+    cmd1[1] = Demod.output[0];\r
+    ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);\r

     CodeIso14443bAsReader(cmd1, sizeof(cmd1));\r
     TransmitFor14443();\r
     CodeIso14443bAsReader(cmd1, sizeof(cmd1));\r
     TransmitFor14443();\r

-    LED_A_ON();\r
-    GetSamplesFor14443Demod(TRUE, 2000);\r
-    LED_A_OFF();\r
+//    LED_A_ON();\r
+    GetSamplesFor14443Demod(TRUE, 2000,TRUE);\r
+//    LED_A_OFF();\r
+    if (Demod.len != 3) {\r
+       Dbprintf("Expected 3 bytes from tag, got %d", Demod.len);\r
+       return;\r
+    }\r
+    // Check the CRC of the answer:\r
+    ComputeCrc14443(CRC_14443_B, Demod.output, 1 , &cmd1[2], &cmd1[3]);\r
+    if(cmd1[2] != Demod.output[1] || cmd1[3] != Demod.output[2]) {\r
+       DbpString("CRC Error reading select response.");\r
+       return;\r
+    }\r
+    // Check response from the tag: should be the same UID as the command we just sent:\r
+    if (cmd1[1] != Demod.output[0]) {\r
+       Dbprintf("Bad response to SELECT from Tag, aborting: %x %x", cmd1[1], Demod.output[0]);\r
+       return;\r
+    }\r
+    // Tag is now selected,\r
+    // First get the tag's UID:\r
+    cmd1[0] = 0x0B;\r
+    ComputeCrc14443(CRC_14443_B, cmd1, 1 , &cmd1[1], &cmd1[2]);\r
+    CodeIso14443bAsReader(cmd1, 3); // Only first three bytes for this one\r
+    TransmitFor14443();\r
+//    LED_A_ON();\r
+    GetSamplesFor14443Demod(TRUE, 2000,TRUE);\r
+//    LED_A_OFF();\r
+    if (Demod.len != 10) {\r
+       Dbprintf("Expected 10 bytes from tag, got %d", Demod.len);\r
+       return;\r
+    }\r
+    // The check the CRC of the answer (use cmd1 as temporary variable):\r
+    ComputeCrc14443(CRC_14443_B, Demod.output, 8, &cmd1[2], &cmd1[3]);\r
+           if(cmd1[2] != Demod.output[8] || cmd1[3] != Demod.output[9]) {\r
+       Dbprintf("CRC Error reading block! - Below: expected, got %x %x",\r
+               (cmd1[2]<<8)+cmd1[3], (Demod.output[8]<<8)+Demod.output[9]);\r
+       // Do not return;, let's go on... (we should retry, maybe ?)\r
+    }\r
+    Dbprintf("Tag UID (64 bits): %08x %08x",\r
+       (Demod.output[7]<<24) + (Demod.output[6]<<16) + (Demod.output[5]<<8) + Demod.output[4],\r
+       (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0]);\r
+\r
+    // Now loop to read all 16 blocks, address from 0 to 15\r
+    DbpString("Tag memory dump, block 0 to 15");\r
+    cmd1[0] = 0x08;\r
+    i = 0x00;\r
+    dwLast++;\r
+    for (;;) {\r
+           if (i == dwLast) {\r
+                   DbpString("System area block (0xff):");\r
+                   i = 0xff;\r
+           }\r
+           cmd1[1] = i;\r
+           ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);\r
+           CodeIso14443bAsReader(cmd1, sizeof(cmd1));\r
+           TransmitFor14443();\r
+//         LED_A_ON();\r
+           GetSamplesFor14443Demod(TRUE, 2000,TRUE);\r
+//         LED_A_OFF();\r
+           if (Demod.len != 6) { // Check if we got an answer from the tag\r
+               DbpString("Expected 6 bytes from tag, got less...");\r
+               return;\r
+           }\r
+           // The check the CRC of the answer (use cmd1 as temporary variable):\r
+           ComputeCrc14443(CRC_14443_B, Demod.output, 4, &cmd1[2], &cmd1[3]);\r
+            if(cmd1[2] != Demod.output[4] || cmd1[3] != Demod.output[5]) {\r
+               Dbprintf("CRC Error reading block! - Below: expected, got %x %x",\r
+                       (cmd1[2]<<8)+cmd1[3], (Demod.output[4]<<8)+Demod.output[5]);\r
+               // Do not return;, let's go on... (we should retry, maybe ?)\r
+           }\r
+           // Now print out the memory location:\r
+           Dbprintf("Address=%x, Contents=%x, CRC=%x", i,\r
+               (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0],\r
+               (Demod.output[4]<<8)+Demod.output[5]);\r
+           if (i == 0xff) {\r
+               break;\r
+           }\r
+           i++;\r
+    }\r

 }\r
 \r
 }\r
 \r

+\r

 //=============================================================================\r
 // Finally, the `sniffer' combines elements from both the reader and\r
 // simulated tag, to show both sides of the conversation.\r
 //=============================================================================\r
 // Finally, the `sniffer' combines elements from both the reader and\r
 // simulated tag, to show both sides of the conversation.\r


@@ -825,6 +1015,13 @@ void AcquireRawAdcSamplesIso14443(DWORD parameter)
 // triggering so that we start recording at the point that the tag is moved\r
 // near the reader.\r
 //-----------------------------------------------------------------------------\r
 // triggering so that we start recording at the point that the tag is moved\r
 // near the reader.\r
 //-----------------------------------------------------------------------------\r

+/*\r
+ * Memory usage for this function, (within BigBuf)\r
+ * 0-4095 : Demodulated samples receive (4096 bytes) - DEMOD_TRACE_SIZE\r
+ * 4096-6143 : Last Received command, 2048 bytes (reader->tag) - READER_TAG_BUFFER_SIZE\r
+ * 6144-8191 : Last Received command, 2048 bytes(tag->reader) - TAG_READER_BUFFER_SIZE\r
+ * 8192-9215 : DMA Buffer, 1024 bytes (samples) - DMA_BUFFER_SIZE\r
+ */\r

 void SnoopIso14443(void)\r
 {\r
     // We won't start recording the frames that we acquire until we trigger;\r
 void SnoopIso14443(void)\r
 {\r
     // We won't start recording the frames that we acquire until we trigger;\r


@@ -833,9 +1030,9 @@ void SnoopIso14443(void)
     BOOL triggered = FALSE;\r
 \r
     // The command (reader -> tag) that we're working on receiving.\r
     BOOL triggered = FALSE;\r
 \r
     // The command (reader -> tag) that we're working on receiving.\r

-    BYTE *receivedCmd = (((BYTE *)BigBuf) + 1024);\r
+    BYTE *receivedCmd = (BYTE *)(BigBuf) + DEMOD_TRACE_SIZE;\r

     // The response (tag -> reader) that we're working on receiving.\r
     // The response (tag -> reader) that we're working on receiving.\r

-    BYTE *receivedResponse = (((BYTE *)BigBuf) + 1536);\r
+    BYTE *receivedResponse = (BYTE *)(BigBuf) + DEMOD_TRACE_SIZE + READER_TAG_BUFFER_SIZE;\r

 \r
     // As we receive stuff, we copy it from receivedCmd or receivedResponse\r
     // into trace, along with its length and other annotations.\r
 \r
     // As we receive stuff, we copy it from receivedCmd or receivedResponse\r
     // into trace, along with its length and other annotations.\r


@@ -843,8 +1040,7 @@ void SnoopIso14443(void)
     int traceLen = 0;\r
 \r
     // The DMA buffer, used to stream samples from the FPGA.\r
     int traceLen = 0;\r
 \r
     // The DMA buffer, used to stream samples from the FPGA.\r

-//#   define DMA_BUFFER_SIZE 256\r
-    SBYTE *dmaBuf = ((SBYTE *)BigBuf) + 2048;\r
+    SBYTE *dmaBuf = (SBYTE *)(BigBuf) + DEMOD_TRACE_SIZE + READER_TAG_BUFFER_SIZE + TAG_READER_BUFFER_SIZE;\r

     int lastRxCounter;\r
     SBYTE *upTo;\r
     int ci, cq;\r
     int lastRxCounter;\r
     SBYTE *upTo;\r
     int ci, cq;\r


@@ -854,7 +1050,8 @@ void SnoopIso14443(void)
     // information in the trace buffer.\r
     int samples = 0;\r
 \r
     // information in the trace buffer.\r
     int samples = 0;\r
 \r

-    memset(trace, 0x44, 1000);\r
+    // Initialize the trace buffer\r
+    memset(trace, 0x44, DEMOD_TRACE_SIZE);\r

 \r
     // Set up the demodulator for tag -> reader responses.\r
     Demod.output = receivedResponse;\r
 \r
     // Set up the demodulator for tag -> reader responses.\r
     Demod.output = receivedResponse;\r


@@ -867,7 +1064,20 @@ void SnoopIso14443(void)
     Uart.byteCntMax = 100;\r
     Uart.state = STATE_UNSYNCD;\r
 \r
     Uart.byteCntMax = 100;\r
     Uart.state = STATE_UNSYNCD;\r
 \r

+       // Print some debug information about the buffer sizes\r
+       Dbprintf("Snooping buffers initialized:");\r
+       Dbprintf("  Trace: %i bytes", DEMOD_TRACE_SIZE);\r
+       Dbprintf("  Reader -> tag: %i bytes", READER_TAG_BUFFER_SIZE);\r
+       Dbprintf("  tag -> Reader: %i bytes", TAG_READER_BUFFER_SIZE);\r
+       Dbprintf("  DMA: %i bytes", DMA_BUFFER_SIZE);\r
+       \r
+       // Use a counter for blinking the LED\r
+       long ledCount=0;\r
+       long ledFlashAt=200000;\r
+       \r

     // And put the FPGA in the appropriate mode\r
     // And put the FPGA in the appropriate mode\r

+    // Signal field is off with the appropriate LED\r
+    LED_D_OFF();\r

     FpgaWriteConfWord(\r
        FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ |\r
        FPGA_HF_READER_RX_XCORR_SNOOP);\r
     FpgaWriteConfWord(\r
        FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ |\r
        FPGA_HF_READER_RX_XCORR_SNOOP);\r


@@ -878,17 +1088,24 @@ void SnoopIso14443(void)
     upTo = dmaBuf;\r
     lastRxCounter = DMA_BUFFER_SIZE;\r
     FpgaSetupSscDma((BYTE *)dmaBuf, DMA_BUFFER_SIZE);\r
     upTo = dmaBuf;\r
     lastRxCounter = DMA_BUFFER_SIZE;\r
     FpgaSetupSscDma((BYTE *)dmaBuf, DMA_BUFFER_SIZE);\r

-\r
-    LED_A_ON();\r
-\r

     // And now we loop, receiving samples.\r
     for(;;) {\r
     // And now we loop, receiving samples.\r
     for(;;) {\r

-        int behindBy = (lastRxCounter - PDC_RX_COUNTER(SSC_BASE)) &\r
+               // Blink the LED while Snooping\r
+               ledCount++;\r
+               if (ledCount == ledFlashAt) {\r
+                       LED_D_ON();\r
+               }\r
+               if (ledCount >= 2*ledFlashAt) {\r
+                       LED_D_OFF();\r
+                       ledCount=0;\r
+               }\r
+               \r
+       int behindBy = (lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR) &\r

                                 (DMA_BUFFER_SIZE-1);\r
         if(behindBy > maxBehindBy) {\r
             maxBehindBy = behindBy;\r
                                 (DMA_BUFFER_SIZE-1);\r
         if(behindBy > maxBehindBy) {\r
             maxBehindBy = behindBy;\r

-            if(behindBy > 100) {\r
-                DbpString("blew circular buffer!");\r
+            if(behindBy > (DMA_BUFFER_SIZE-2)) { // TODO: understand whether we can increase/decrease as we want or not?\r
+                Dbprintf("blew circular buffer! behindBy=%x", behindBy);\r

                 goto done;\r
             }\r
         }\r
                 goto done;\r
             }\r
         }\r


@@ -901,14 +1118,15 @@ void SnoopIso14443(void)
         if(upTo - dmaBuf > DMA_BUFFER_SIZE) {\r
             upTo -= DMA_BUFFER_SIZE;\r
             lastRxCounter += DMA_BUFFER_SIZE;\r
         if(upTo - dmaBuf > DMA_BUFFER_SIZE) {\r
             upTo -= DMA_BUFFER_SIZE;\r
             lastRxCounter += DMA_BUFFER_SIZE;\r

-            PDC_RX_NEXT_POINTER(SSC_BASE) = (DWORD)upTo;\r
-            PDC_RX_NEXT_COUNTER(SSC_BASE) = DMA_BUFFER_SIZE;\r
+            AT91C_BASE_PDC_SSC->PDC_RNPR = (DWORD) upTo;\r
+            AT91C_BASE_PDC_SSC->PDC_RNCR = DMA_BUFFER_SIZE;\r

         }\r
 \r
         samples += 2;\r
 \r
 #define HANDLE_BIT_IF_BODY \\r
             if(triggered) { \\r
         }\r
 \r
         samples += 2;\r
 \r
 #define HANDLE_BIT_IF_BODY \\r
             if(triggered) { \\r

+                               ledFlashAt=30000; \\r

                 trace[traceLen++] = ((samples >>  0) & 0xff); \\r
                 trace[traceLen++] = ((samples >>  8) & 0xff); \\r
                 trace[traceLen++] = ((samples >> 16) & 0xff); \\r
                 trace[traceLen++] = ((samples >>  0) & 0xff); \\r
                 trace[traceLen++] = ((samples >>  8) & 0xff); \\r
                 trace[traceLen++] = ((samples >> 16) & 0xff); \\r


@@ -958,17 +1176,19 @@ void SnoopIso14443(void)
             trace[traceLen++] = Demod.len;\r
             memcpy(trace+traceLen, receivedResponse, Demod.len);\r
             traceLen += Demod.len;\r
             trace[traceLen++] = Demod.len;\r
             memcpy(trace+traceLen, receivedResponse, Demod.len);\r
             traceLen += Demod.len;\r

-            if(traceLen > 1000) break;\r
+            if(traceLen > DEMOD_TRACE_SIZE) {          \r
+                               DbpString("Reached trace limit");\r
+                               goto done;\r
+                       }\r

 \r
             triggered = TRUE;\r
 \r
             triggered = TRUE;\r

-            LED_A_OFF();\r
-            LED_B_ON();\r

 \r
             // And ready to receive another response.\r
             memset(&Demod, 0, sizeof(Demod));\r
             Demod.output = receivedResponse;\r
             Demod.state = DEMOD_UNSYNCD;\r
         }\r
 \r
             // And ready to receive another response.\r
             memset(&Demod, 0, sizeof(Demod));\r
             Demod.output = receivedResponse;\r
             Demod.state = DEMOD_UNSYNCD;\r
         }\r

+               WDT_HIT();\r

 \r
         if(BUTTON_PRESS()) {\r
             DbpString("cancelled");\r
 \r
         if(BUTTON_PRESS()) {\r
             DbpString("cancelled");\r


@@ -976,13 +1196,13 @@ void SnoopIso14443(void)
         }\r
     }\r
 \r
         }\r
     }\r
 \r

-    DbpString("in done pt");\r
-\r
-    DbpIntegers(maxBehindBy, Uart.state, Uart.byteCnt);\r
-    DbpIntegers(Uart.byteCntMax, traceLen, 0x23);\r
-\r

 done:\r
 done:\r

-    PDC_CONTROL(SSC_BASE) = PDC_RX_DISABLE;\r
-    LED_A_OFF();\r
-    LED_B_OFF();\r
+       LED_D_OFF();\r
+    AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTDIS;\r
+       DbpString("Snoop statistics:");\r
+    Dbprintf("  Max behind by: %i", maxBehindBy);\r
+       Dbprintf("  Uart State: %x", Uart.state);\r
+       Dbprintf("  Uart ByteCnt: %i", Uart.byteCnt);\r
+       Dbprintf("  Uart ByteCntMax: %i", Uart.byteCntMax);\r
+       Dbprintf("  Trace length: %i", traceLen);\r

 }\r
 }\r