maur keys
[RRG-proxmark3.git] / fpga / fpga_felica.v
blob2cdc0bdbed20aa85b91a01719551d1ab49325f8e
1 //-----------------------------------------------------------------------------
2 // The FPGA is responsible for interfacing between the A/D, the coil drivers,
3 // and the ARM. In the low-frequency modes it passes the data straight
4 // through, so that the ARM gets raw A/D samples over the SSP. In the high-
5 // frequency modes, the FPGA might perform some demodulation first, to
6 // reduce the amount of data that we must send to the ARM.
7 //
8 // I am not really an FPGA/ASIC designer, so I am sure that a lot of this
9 // could be improved.
11 // Jonathan Westhues, March 2006
12 // Added ISO14443-A support by Gerhard de Koning Gans, April 2008
13 // iZsh <izsh at fail0verflow.com>, June 2014
14 // Piwi, Feb 2019
15 //-----------------------------------------------------------------------------
18 // Defining commands, modes and options. This must be aligned to the definitions in fpgaloader.h
19 // Note: the definitions here are without shifts
21 // Commands:
22 `define FPGA_CMD_SET_CONFREG 1
23 `define FPGA_CMD_TRACE_ENABLE 2
25 // Major modes:
26 `define FPGA_MAJOR_MODE_HF_READER 0
27 `define FPGA_MAJOR_MODE_HF_SIMULATOR 1
28 `define FPGA_MAJOR_MODE_HF_ISO14443A 2
29 `define FPGA_MAJOR_MODE_HF_SNIFF 3
30 `define FPGA_MAJOR_MODE_HF_ISO18092 4
31 `define FPGA_MAJOR_MODE_HF_GET_TRACE 5
32 `define FPGA_MAJOR_MODE_OFF 7
34 // Options for the generic HF reader
35 `define FPGA_HF_READER_MODE_RECEIVE_IQ 0
36 `define FPGA_HF_READER_MODE_RECEIVE_AMPLITUDE 1
37 `define FPGA_HF_READER_MODE_RECEIVE_PHASE 2
38 `define FPGA_HF_READER_MODE_SEND_FULL_MOD 3
39 `define FPGA_HF_READER_MODE_SEND_SHALLOW_MOD 4
40 `define FPGA_HF_READER_MODE_SNIFF_IQ 5
41 `define FPGA_HF_READER_MODE_SNIFF_AMPLITUDE 6
42 `define FPGA_HF_READER_MODE_SNIFF_PHASE 7
43 `define FPGA_HF_READER_MODE_SEND_JAM 8
45 `define FPGA_HF_READER_SUBCARRIER_848_KHZ 0
46 `define FPGA_HF_READER_SUBCARRIER_424_KHZ 1
47 `define FPGA_HF_READER_SUBCARRIER_212_KHZ 2
49 // Options for the HF simulated tag, how to modulate
50 `define FPGA_HF_SIMULATOR_NO_MODULATION 0
51 `define FPGA_HF_SIMULATOR_MODULATE_BPSK 1
52 `define FPGA_HF_SIMULATOR_MODULATE_212K 2
53 `define FPGA_HF_SIMULATOR_MODULATE_424K 4
54 `define FPGA_HF_SIMULATOR_MODULATE_424K_8BIT 5
56 // Options for ISO14443A
57 `define FPGA_HF_ISO14443A_SNIFFER 0
58 `define FPGA_HF_ISO14443A_TAGSIM_LISTEN 1
59 `define FPGA_HF_ISO14443A_TAGSIM_MOD 2
60 `define FPGA_HF_ISO14443A_READER_LISTEN 3
61 `define FPGA_HF_ISO14443A_READER_MOD 4
63 //options for ISO18092 / Felica
64 `define FPGA_HF_ISO18092_FLAG_NOMOD 1 // 0001 disable modulation module
65 `define FPGA_HF_ISO18092_FLAG_424K 2 // 0010 should enable 414k mode (untested). No autodetect
66 `define FPGA_HF_ISO18092_FLAG_READER 4 // 0100 enables antenna power, to act as a reader instead of tag
68 `include "hi_reader.v"
69 `include "hi_simulate.v"
70 //`include "hi_iso14443a.v"
71 `include "hi_sniffer.v"
72 `include "util.v"
73 `include "hi_flite.v"
74 `include "hi_get_trace.v"
76 module fpga_felica(
77 input spck, output miso, input mosi, input ncs,
78 input pck0, input ck_1356meg, input ck_1356megb,
79 output pwr_lo, output pwr_hi,
80 output pwr_oe1, output pwr_oe2, output pwr_oe3, output pwr_oe4,
81 input [7:0] adc_d, output adc_clk, output adc_noe,
82 output ssp_frame, output ssp_din, input ssp_dout, output ssp_clk,
83 input cross_hi, input cross_lo,
84 output dbg
87 //-----------------------------------------------------------------------------
88 // The SPI receiver. This sets up the configuration word, which the rest of
89 // the logic looks at to determine how to connect the A/D and the coil
90 // drivers (i.e., which section gets it). Also assign some symbolic names
91 // to the configuration bits, for use below.
92 //-----------------------------------------------------------------------------
95 Attempt to write up how its hooked up. Iceman 2020.
97 Communication between ARM / FPGA is done inside armsrc/fpgaloader.c see: function FpgaSendCommand()
98 Send 16 bit command / data pair to FPGA
99 The bit format is: C3 C2 C1 C0 D11 D10 D9 D8 D7 D6 D5 D4 D3 D2 D1 D0
100 where
101 C is 4bit command
102 D is 12bit data
104 shift_reg receive this 16bit frame
107 -----+--------- frame layout --------------------
108 bit | 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
109 -----+-------------------------------------------
110 cmd | x x x x
111 major| x x x
112 opt | x x x
113 divi | x x x x x x x x
114 thres| x x x x x x x x
115 -----+-------------------------------------------
118 reg [15:0] shift_reg;
119 reg [8:0] conf_word;
120 reg trace_enable;
122 // We switch modes between transmitting to the 13.56 MHz tag and receiving
123 // from it, which means that we must make sure that we can do so without
124 // glitching, or else we will glitch the transmitted carrier.
125 always @(posedge ncs)
126 begin
127 case(shift_reg[15:12])
128 `FPGA_CMD_SET_CONFREG: conf_word <= shift_reg[8:0];
129 `FPGA_CMD_TRACE_ENABLE: trace_enable <= shift_reg[0];
130 endcase
133 always @(posedge spck)
134 begin
135 if(~ncs)
136 begin
137 shift_reg[15:1] <= shift_reg[14:0];
138 shift_reg[0] <= mosi;
142 // select module (outputs) based on major mode
143 wire [2:0] major_mode = conf_word[8:6];
145 // configuring the HF reader
146 wire [1:0] subcarrier_frequency = conf_word[5:4];
147 wire [3:0] minor_mode = conf_word[3:0];
149 //-----------------------------------------------------------------------------
150 // And then we instantiate the modules corresponding to each of the FPGA's
151 // major modes, and use muxes to connect the outputs of the active mode to
152 // the output pins.
153 //-----------------------------------------------------------------------------
155 // 000 - HF reader
156 hi_reader hr(
157 ck_1356megb,
158 hr_pwr_lo, hr_pwr_hi, hr_pwr_oe1, hr_pwr_oe2, hr_pwr_oe3, hr_pwr_oe4,
159 adc_d, hr_adc_clk,
160 hr_ssp_frame, hr_ssp_din, ssp_dout, hr_ssp_clk,
161 hr_dbg,
162 subcarrier_frequency, minor_mode
165 // 001 - HF simulated tag
166 hi_simulate hs(
167 ck_1356meg,
168 hs_pwr_lo, hs_pwr_hi, hs_pwr_oe1, hs_pwr_oe2, hs_pwr_oe3, hs_pwr_oe4,
169 adc_d, hs_adc_clk,
170 hs_ssp_frame, hs_ssp_din, ssp_dout, hs_ssp_clk,
171 hs_dbg,
172 minor_mode
175 // 011 - HF sniff
176 hi_sniffer he(
177 ck_1356megb,
178 he_pwr_lo, he_pwr_hi, he_pwr_oe1, he_pwr_oe2, he_pwr_oe3, he_pwr_oe4,
179 adc_d, he_adc_clk,
180 he_ssp_frame, he_ssp_din, he_ssp_clk
183 // 100 - HF ISO18092 FeliCa
184 hi_flite hfl(
185 ck_1356megb,
186 hfl_pwr_lo, hfl_pwr_hi, hfl_pwr_oe1, hfl_pwr_oe2, hfl_pwr_oe3, hfl_pwr_oe4,
187 adc_d, hfl_adc_clk,
188 hfl_ssp_frame, hfl_ssp_din, ssp_dout, hfl_ssp_clk,
189 hfl_dbg,
190 minor_mode
193 // 101 - HF get trace
194 hi_get_trace gt(
195 ck_1356megb,
196 adc_d, trace_enable, major_mode,
197 gt_ssp_frame, gt_ssp_din, gt_ssp_clk
200 // Major modes:
201 // 000 -- HF reader; subcarrier frequency and modulation depth selectable
202 // 001 -- HF simulated tag
203 // 010 -- HF ISO14443-A - removed for space...
204 // 011 -- HF sniff
205 // 100 -- HF ISO18092 FeliCa
206 // 101 -- HF get trace
207 // 110 -- unused
208 // 111 -- FPGA_MAJOR_MODE_OFF
210 // 000 001 010 011 100 101 110 111
211 mux8 mux_ssp_clk (major_mode, ssp_clk, hr_ssp_clk, hs_ssp_clk, 1'b0, he_ssp_clk, hfl_ssp_clk, gt_ssp_clk, 1'b0, 1'b0);
212 mux8 mux_ssp_din (major_mode, ssp_din, hr_ssp_din, hs_ssp_din, 1'b0, he_ssp_din, hfl_ssp_din, gt_ssp_din, 1'b0, 1'b0);
213 mux8 mux_ssp_frame (major_mode, ssp_frame, hr_ssp_frame, hs_ssp_frame, 1'b0, he_ssp_frame, hfl_ssp_frame, gt_ssp_frame, 1'b0, 1'b0);
214 mux8 mux_pwr_oe1 (major_mode, pwr_oe1, hr_pwr_oe1, hs_pwr_oe1, 1'b0, he_pwr_oe1, hfl_pwr_oe1, 1'b0, 1'b0, 1'b0);
215 mux8 mux_pwr_oe2 (major_mode, pwr_oe2, hr_pwr_oe2, hs_pwr_oe2, 1'b0, he_pwr_oe2, hfl_pwr_oe2, 1'b0, 1'b0, 1'b0);
216 mux8 mux_pwr_oe3 (major_mode, pwr_oe3, hr_pwr_oe3, hs_pwr_oe3, 1'b0, he_pwr_oe3, hfl_pwr_oe3, 1'b0, 1'b0, 1'b0);
217 mux8 mux_pwr_oe4 (major_mode, pwr_oe4, hr_pwr_oe4, hs_pwr_oe4, 1'b0, he_pwr_oe4, hfl_pwr_oe4, 1'b0, 1'b0, 1'b0);
218 mux8 mux_pwr_lo (major_mode, pwr_lo, hr_pwr_lo, hs_pwr_lo, 1'b0, he_pwr_lo, hfl_pwr_lo, 1'b0, 1'b0, 1'b0);
219 mux8 mux_pwr_hi (major_mode, pwr_hi, hr_pwr_hi, hs_pwr_hi, 1'b0, he_pwr_hi, hfl_pwr_hi, 1'b0, 1'b0, 1'b0);
220 mux8 mux_adc_clk (major_mode, adc_clk, hr_adc_clk, hs_adc_clk, 1'b0, he_adc_clk, hfl_adc_clk, 1'b0, 1'b0, 1'b0);
221 mux8 mux_dbg (major_mode, dbg, hr_dbg, hs_dbg, 1'b0, he_dbg, hfl_dbg, 1'b0, 1'b0, 1'b0);
223 // In all modes, let the ADC's outputs be enabled.
224 assign adc_noe = 1'b0;
226 endmodule