From fa156e4ba0f6f9b4abecf08cf0a16e825b422c96 Mon Sep 17 00:00:00 2001 From: Niel Nielsen Date: Wed, 26 Aug 2026 19:49:00 +0200 Subject: [PATCH] Update BWM framing constants and functions Signed-off-by: Niel Nielsen --- armsrc/bwm_forward.h | 54 +++++++++++++++++++++++++++++++++++++++----- 1 file changed, 48 insertions(+), 6 deletions(-) diff --git a/armsrc/bwm_forward.h b/armsrc/bwm_forward.h index 09dc9a9f9..290410731 100644 --- a/armsrc/bwm_forward.h +++ b/armsrc/bwm_forward.h @@ -8,29 +8,71 @@ // // See LICENSE.txt for the text of the license. //----------------------------------------------------------------------------- +// Proxmark5 Battery Wireless Module (BWM) transport shim. +// +// The BWM (ESP32-C2, RfidResearchGroup/Proxmark5_BWM_esp32) bridges the AT32 +// host <-> BLE/WiFi. Its ESP<->AT32 UART link does NOT carry raw PacketCommandNG; +// it uses a framed "app_com" protocol. Transparent host<->wireless traffic rides +// inside that framing: +// +// AT32 -> ESP (our reply, toward wireless host): +// [0x7C 0xC7] cmd=APP_CMD_SEND_FORWARD_DATA(5000) len(LE) payload CRC16(LE) +// ESP -> AT32 (command from wireless host): +// [0xD2 0xD3] cmd=APP_BROADCAST_DATA_FORWARD(8089) len(LE) payload CRC16(LE) +// +// Frame = HDR1 HDR2 | CMD(LE16) | LEN(LE16) | PAYLOAD[LEN] | CRC(LE16) +// CRC = CRC-16/CCITT-FALSE (poly 0x1021, init 0xFFFF, MSB-first, no xorout) +// over HDR..PAYLOAD. (NOT compute_crc(CRC_14443_A) - different CRC.) +// +// This shim wraps outgoing NG/OLD reply bytes into a SEND_FORWARD_DATA frame and +// de-frames incoming DATA_FORWARD frames back into a raw NG byte stream, so the +// stock reply_ng()/receive_ng() paths work unchanged over the BWM link. +// +// Enabled by -DWITH_BWM_FORWARD (implies WITH_FPC_USART_HOST). +//----------------------------------------------------------------------------- #ifndef __BWM_FORWARD_H #define __BWM_FORWARD_H #include "common.h" -#define BWM_HDR_HOST_CMD_1 0x7C +// app_com framing constants (verified against BWM firmware app_cmd_uart.[ch] / +// app_com_defs.h). +#define BWM_HDR_HOST_CMD_1 0x7C // AT32 -> ESP (host command) #define BWM_HDR_HOST_CMD_2 0xC7 -#define BWM_HDR_SLAVE_BCAST_1 0xD2 +#define BWM_HDR_SLAVE_BCAST_1 0xD2 // ESP -> AT32 (slave broadcast) #define BWM_HDR_SLAVE_BCAST_2 0xD3 -#define BWM_HDR_SLAVE_RESP_1 0x2D +#define BWM_HDR_SLAVE_RESP_1 0x2D // ESP -> AT32 (slave response, skipped here) #define BWM_HDR_SLAVE_RESP_2 0x3D -#define BWM_CMD_SEND_FORWARD_DATA 5000 -#define BWM_CMD_DATA_FORWARD 8089 +#define BWM_CMD_SEND_FORWARD_DATA 5000 // host cmd: payload -> BLE/WiFi endpoint +#define BWM_CMD_DATA_FORWARD 8089 // slave bcast: payload came from endpoint +#define BWM_CMD_FLOW_CREDIT 8092 // slave bcast: payload = uint16 cumulative granted-frame count (LE) + +// Flow control (credit window). The ESP grants the ARM permission to send a +// bounded number of forward frames; it advances the cumulative grant as it +// drains frames to BLE. Sizing: BWM_FC_INITIAL_CREDIT frames must fit inside the +// ESP's UART RX FIFO + BLE mbuf pool so an in-flight window never overflows. +#define BWM_FC_INITIAL_CREDIT 8 // frames the ARM may send before the first grant +#ifndef BWM_FC_STALL_SPINS +#define BWM_FC_STALL_SPINS 200000 +#endif // safety valve: give up waiting for credit (avoid hard hang) #define BWM_CRC16_POLY 0x1021 #define BWM_CRC16_INIT 0xFFFF +// Wrap `len` raw reply bytes (a whole PacketResponseNG/OLD frame) into one +// SEND_FORWARD_DATA app_com frame and write it synchronously to the FPC USART. +// Returns PM3_SUCCESS or the underlying usart error. Drop-in for the FPC +// usart_writebuffer_sync() call in reply_ng_internal()/reply_old(). int bwm_fwd_writebuffer_sync(const uint8_t *data, size_t len); +// De-framed read: returns up to `len` raw NG bytes recovered from inbound +// DATA_FORWARD frames, blocking-with-timeout exactly like usart_read_ng(). +// Drop-in for usart_read_ng() as the receive_ng() read callback. uint32_t bwm_read_ng(uint8_t *data, size_t len); +// >0 when raw bytes are waiting on the FPC USART (gate for receive_ng()). uint16_t bwm_fwd_rxdata_available(void); -#endif +#endif // __BWM_FORWARD_H