1 //-----------------------------------------------------------------------------
2 // Copyright (C) Proxmark3 contributors. See AUTHORS.md for details.
4 // This program is free software: you can redistribute it and/or modify
5 // it under the terms of the GNU General Public License as published by
6 // the Free Software Foundation, either version 3 of the License, or
7 // (at your option) any later version.
9 // This program is distributed in the hope that it will be useful,
10 // but WITHOUT ANY WARRANTY; without even the implied warranty of
11 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 // GNU General Public License for more details.
14 // See LICENSE.txt for the text of the license.
15 //-----------------------------------------------------------------------------
17 // The FPGA is responsible for interfacing between the A/D, the coil drivers,
18 // and the ARM. In the low-frequency modes it passes the data straight
19 // through, so that the ARM gets raw A/D samples over the SSP. In the high-
20 // frequency modes, the FPGA might perform some demodulation first, to
21 // reduce the amount of data that we must send to the ARM.
22 //-----------------------------------------------------------------------------
25 Communication between ARM / FPGA is done inside armsrc/fpgaloader.c see: function FpgaSendCommand()
26 Send 16 bit command / data pair to FPGA with the bit format:
28 +------ frame layout circa 2020 ------------------+
29 | 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 |
30 +-------------------------------------------------+
31 | C C C C M M M M P P P P P P P P | C = FPGA_CMD_SET_CONFREG, M = FPGA_MAJOR_MODE_*, P = FPGA_LF_* or FPGA_HF_* parameter
32 | C C C C D D D D D D D D | C = FPGA_CMD_SET_DIVISOR, D = divisor
33 | C C C C T T T T T T T T | C = FPGA_CMD_SET_EDGE_DETECT_THRESHOLD, T = threshold
34 | C C C C E | C = FPGA_CMD_TRACE_ENABLE, E=0 off, E=1 on
35 +-------------------------------------------------+
37 +------ frame layout current ---------------------+
38 | 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 |
39 +-------------------------------------------------+
40 | C C C C M M M P P P P P P | C = FPGA_CMD_SET_CONFREG, M = FPGA_MAJOR_MODE_*, P = FPGA_LF_* or FPGA_HF_* parameter
41 | C C C C D D D D D D D D | C = FPGA_CMD_SET_DIVISOR, D = divisor
42 | C C C C T T T T T T T T | C = FPGA_CMD_SET_EDGE_DETECT_THRESHOLD, T = threshold (in LF mode)
43 | C C C C H H H H H H T T T T T T | C = FPGA_CMD_SET_EDGE_DETECT_THRESHOLD, H = threshold_high, T = threshold (in HF/14a mode)
44 | C C C C E | C = FPGA_CMD_TRACE_ENABLE, E=0 off, E=1 on
45 +-------------------------------------------------+
47 shift_reg receive this 16bit frame
51 shift_reg[15:12] == 4bit command
52 LF has three commands (FPGA_CMD_SET_CONFREG, FPGA_CMD_SET_DIVISOR, FPGA_CMD_SET_EDGE_DETECT_THRESHOLD)
53 Current commands uses only 2bits. We have room for up to 4bits of commands total (7).
57 shift_reg[11:0] == 12bit data
58 lf data is divided into MAJOR MODES and configuration values.
60 The major modes uses 3bits (0,1,2,3,7 | 000, 001, 010, 011, 111)
61 000 FPGA_MAJOR_MODE_LF_READER = Act as LF reader (modulate)
62 001 FPGA_MAJOR_MODE_LF_EDGE_DETECT = Simulate LF
63 010 FPGA_MAJOR_MODE_LF_PASSTHRU = Passthrough mode, CROSS_LO line connected to SSP_DIN. SSP_DOUT logic level controls if we modulate / listening
64 011 FPGA_MAJOR_MODE_LF_ADC = refactor hitag2, clear ADC sampling
65 111 FPGA_MAJOR_MODE_OFF = turn off sampling.
67 Each one of this major modes can have options. Currently these two major modes uses options.
68 - FPGA_MAJOR_MODE_LF_READER
69 - FPGA_MAJOR_MODE_LF_EDGE_DETECT
71 FPGA_MAJOR_MODE_LF_READER
72 -------------------------------------
73 lf_field = 1bit (FPGA_LF_ADC_READER_FIELD)
75 You can send FPGA_CMD_SET_DIVISOR to set with FREQUENCY the fpga should sample at
76 divisor = 8bits shift_reg[7:0]
78 FPGA_MAJOR_MODE_LF_EDGE_DETECT
79 ------------------------------------------
80 lf_ed_toggle_mode = 1bits
81 lf_ed_threshold = 8bits threshold defaults to 127
83 You can send FPGA_CMD_SET_EDGE_DETECT_THRESHOLD to set a custom threshold
84 lf_ed_threshold = 8bits threshold value.
87 conf_word[7:5] = 3bit major mode.
88 conf_word[0] = 1bit lf_field
89 conf_word[1] = 1bit lf_ed_toggle_mode
90 conf_word[7:0] = 8bit divisor
91 conf_word[7:0] = 8bit threshold
94 // Defining commands, modes and options. This must be aligned to the definitions in armsrc/fpgaloader.h
95 // Note: the definitions here are without shifts
97 // Definitions for the FPGA commands.
98 `define FPGA_CMD_SET_CONFREG 1
99 `define FPGA_CMD_SET_DIVISOR 2
100 `define FPGA_CMD_SET_EDGE_DETECT_THRESHOLD 3
101 `define FPGA_CMD_TRACE_ENABLE 2
104 `define FPGA_MAJOR_MODE_LF_READER 0
105 `define FPGA_MAJOR_MODE_LF_EDGE_DETECT 1
106 `define FPGA_MAJOR_MODE_LF_PASSTHRU 2
107 `define FPGA_MAJOR_MODE_LF_ADC 3
108 `define FPGA_MAJOR_MODE_HF_READER 0
109 `define FPGA_MAJOR_MODE_HF_SIMULATOR 1
110 `define FPGA_MAJOR_MODE_HF_ISO14443A 2
111 `define FPGA_MAJOR_MODE_HF_SNIFF 3
112 `define FPGA_MAJOR_MODE_HF_ISO18092 4
113 `define FPGA_MAJOR_MODE_HF_GET_TRACE 5
114 `define FPGA_MAJOR_MODE_OFF 7
116 // Options for LF_READER
117 `define FPGA_LF_ADC_READER_FIELD 1
119 // Options for LF_EDGE_DETECT
120 `define FPGA_LF_EDGE_DETECT_READER_FIELD 1
121 `define FPGA_LF_EDGE_DETECT_TOGGLE_MODE 2
123 // Options for the generic HF reader
124 `define FPGA_HF_READER_MODE_RECEIVE_IQ 0
125 `define FPGA_HF_READER_MODE_RECEIVE_AMPLITUDE 1
126 `define FPGA_HF_READER_MODE_RECEIVE_PHASE 2
127 `define FPGA_HF_READER_MODE_SEND_FULL_MOD 3
128 `define FPGA_HF_READER_MODE_SEND_SHALLOW_MOD 4
129 `define FPGA_HF_READER_MODE_SNIFF_IQ 5
130 `define FPGA_HF_READER_MODE_SNIFF_AMPLITUDE 6
131 `define FPGA_HF_READER_MODE_SNIFF_PHASE 7
132 `define FPGA_HF_READER_MODE_SEND_JAM 8
133 `define FPGA_HF_READER_MODE_SEND_SHALLOW_MOD_RDV4 9
135 `define FPGA_HF_READER_SUBCARRIER_848_KHZ 0
136 `define FPGA_HF_READER_SUBCARRIER_424_KHZ 1
137 `define FPGA_HF_READER_SUBCARRIER_212_KHZ 2
138 `define FPGA_HF_READER_2SUBCARRIERS_424_484_KHZ 3
140 // Options for the HF simulated tag, how to modulate
141 `define FPGA_HF_SIMULATOR_NO_MODULATION 0
142 `define FPGA_HF_SIMULATOR_MODULATE_BPSK 1
143 `define FPGA_HF_SIMULATOR_MODULATE_212K 2
144 `define FPGA_HF_SIMULATOR_MODULATE_424K 4
145 `define FPGA_HF_SIMULATOR_MODULATE_424K_8BIT 5
147 // Options for ISO14443A
148 `define FPGA_HF_ISO14443A_SNIFFER 0
149 `define FPGA_HF_ISO14443A_TAGSIM_LISTEN 1
150 `define FPGA_HF_ISO14443A_TAGSIM_MOD 2
151 `define FPGA_HF_ISO14443A_READER_LISTEN 3
152 `define FPGA_HF_ISO14443A_READER_MOD 4
154 // Options for ISO18092 / Felica
155 `define FPGA_HF_ISO18092_FLAG_NOMOD 1 // 0001 disable modulation module
156 `define FPGA_HF_ISO18092_FLAG_424K 2 // 0010 should enable 414k mode (untested). No autodetect
157 `define FPGA_HF_ISO18092_FLAG_READER 4 // 0100 enables antenna power, to act as a reader instead of tag