OpenPuck/OpenPuck/radio.cpp

#include "radio.h"
#include "bonds.h" // g_slot[]

// Pairing rendezvous bytes from IBEX rodata. The 0x91A2A793 key preceding "ibex" is a DIFFERENT key,
// NOT the discovery address.
const uint8_t PAIR_BASE[4] = { 0x69, 0x62, 0x65, 0x78 }; // "ibex"
uint8_t g_rfPrefix = 0x10;
uint8_t g_rfCh = 2;
uint8_t g_rfBase[4] = { 0x69, 0x62, 0x65, 0x78 }; // "ibex"
// ch18: clean channel in the real puck's active hop set {18,2,80}; bad channels collide with trackpad
// data bursts -> reply-rate crash. Tunable 'C'.
uint8_t g_sessCh = 18;

// Safe defaults; rfGenSessionAddr(slot) overwrites each used slot at boot. Discovery base "ibex" as a
// degenerate starting point means an UN-bonded slot (and a not-yet-initialized one) won't accidentally
// cross-talk with itself before the real address is set.
uint8_t g_sessBase[NSLOT][4];
uint8_t g_sessPrefix[NSLOT];
static void sessSetDefault(int slot)
{
	for (int i = 0; i < 4; i++)
		g_sessBase[slot][i] = g_rfBase[i];
	g_sessPrefix[slot] = g_rfPrefix;
}
void rfGenSessionAddr(int slot)
{
	if (slot < 0 || slot >= NSLOT) {
		sessSetDefault(0);
		return;
	}
	sessSetDefault(slot);
	// Per-bond UUID (rec[0..8]) + FICR DEVICEID (8 bytes) -> 5-byte on-air address. Mixing the bond UUID in
	// makes the address deterministic per (puck, controller) pair: a slot's address is stable across reboots
	// without storing anything new in bonds.bin, and the same controller bonded to two OpenPucks gets two
	// different session addresses (DEVICEID differs) so the two pucks never collide on-air. The original
	// generator (UUID-free) is preserved as the no-UUID fallback for an empty/zero bond record.
	const uint8_t *uuid = g_slot[slot].rec;
	bool uuidLive = false;
	for (int i = 0; i < 8; i++)
		if (uuid[i]) {
			uuidLive = true;
			break;
		}
	uint32_t h, h2;
	if (uuidLive) {
		h = (uint32_t)uuid[0] * 0x9E3779B1u ^
		    (uint32_t)uuid[2] * 0x85EBCA6Bu ^
		    (uint32_t)uuid[4] * 0xC2B2AE35u ^ (uint32_t)uuid[6] ^
		    NRF_FICR->DEVICEID[0];
		h2 = (uint32_t)uuid[1] * 0x27D4EB2Fu ^
		     (uint32_t)uuid[3] * 0x165667B1u ^ (uint32_t)uuid[5] ^
		     (uint32_t)uuid[7] * 0x9E3779B1u ^ NRF_FICR->DEVICEID[1];
	} else {
		h = NRF_FICR->DEVICEID[0] * 0x9E3779B1u ^ NRF_FICR->DEVICEID[1];
		h2 = NRF_FICR->DEVICEID[1] * 0x85EBCA6Bu ^
		     NRF_FICR->DEVICEID[0];
	}
	// Scrub degenerate bytes (0x00/0xFF) for clean preamble correlation.
	for (int i = 0; i < 4; i++) {
		uint8_t b = (uint8_t)(h >> (i * 8));
		if (b == 0x00 || b == 0xFF)
			b ^= 0x5A;
		g_sessBase[slot][i] = b;
	}
	uint8_t p = (uint8_t)(h2 >> 16);
	if (p == 0x00 || p == 0xFF)
		p = 0x5C;
	g_sessPrefix[slot] = p;
	// Never reproduce the shared discovery base "ibex" (else the on-air address is shared with every other
	// controller scanning the rendezvous -> isolation is lost).
	if (g_sessBase[slot][0] == g_rfBase[0] &&
	    g_sessBase[slot][1] == g_rfBase[1] &&
	    g_sessBase[slot][2] == g_rfBase[2] &&
	    g_sessBase[slot][3] == g_rfBase[3])
		g_sessBase[slot][0] ^= 0x80;
}

uint8_t rfrx[100], rftx[100];
uint32_t g_rfRxCount = 0;

// Puck-link config decoded from real-puck capture: puck TX = Ble_2Mbit, ENDIAN=Big (MSB-first), NO whitening,
// addr "ibex", CRC16 0x11021/0xFFFF; static-length frame.
uint32_t g_crcinit = 0xFFFF;
uint8_t g_whiteiv = 37;
uint8_t g_mode = RADIO_MODE_MODE_Ble_2Mbit;

// S0LEN0, LFLEN8, S1LEN3 (ESB DPL) - CRC-VALIDATED
uint32_t g_pcnf0 = 0x00030008UL;
uint8_t g_statlen = 0x20;

// ENDIAN=Big, BALEN4, MAXLEN=96. MAXLEN must be >=66 or the controller's 0x43-battery-augmented F1 (66B)
// truncates -> CRC-fail -> battery never arrives.
uint32_t g_pcnf1 = 0x01040060;
uint32_t g_crcpoly = 0x11021UL;
uint16_t g_crccnf = 0x2; // CRC16, address included
uint8_t g_pid = 0;
uint8_t g_balen = 4; // ESB 5-byte addr
bool g_prefixRaw = false;

uint8_t rfBitrev8(uint8_t x)
{
	uint8_t y = 0;
	for (int i = 0; i < 8; i++) {
		y = (y << 1) | (x & 1);
		x >>= 1;
	}
	return y;
}

void rfSetAddr(const uint8_t b4[4], uint8_t prefix)
{
	uint8_t b[4];
	for (int i = 0; i < 4; i++)
		b[i] = rfBitrev8(b4[i]);
	NRF_RADIO->BASE0 = ((uint32_t)b[0] << 24) | ((uint32_t)b[1] << 16) |
			   ((uint32_t)b[2] << 8) | b[3];
	NRF_RADIO->PREFIX0 = g_prefixRaw ? prefix : rfBitrev8(prefix);
	NRF_RADIO->TXADDRESS = 0;
	NRF_RADIO->RXADDRESSES = 1u << 0;
}

void rfConfig(uint8_t ch)
{
	NRF_RADIO->TASKS_DISABLE = 1;
	RWAIT_DISABLED();
	NRF_RADIO->EVENTS_DISABLED = 0;
	NRF_RADIO->MODE = ((uint32_t)g_mode << RADIO_MODE_MODE_Pos);
	NRF_RADIO->FREQUENCY = ch;
	// +8dBm = the nRF52840's max TX power (was 0dBm). The link margin is thin on
	// the Pro Micro's PCB-trace antenna (RSSI reads ~20dB below a real puck), and
	// 2.4GHz is crowded, so weak polls the controller can't hear -> no reply ->
	// the reply gaps that read as intermittent disconnects. This only lifts the
	// puck->controller side (poll/beacon reach); the controller's own TX (the F1
	// reply) is fixed -- but the poll MUST land for the controller to answer, so
	// the extra 8dB of headroom directly cuts missed-poll dropouts. USB-powered,
	// so the higher current draw is free.
	NRF_RADIO->TXPOWER =
		(RADIO_TXPOWER_TXPOWER_Pos8dBm << RADIO_TXPOWER_TXPOWER_Pos);
#if defined(RADIO_MODECNF0_RU_Fast)
	NRF_RADIO->MODECNF0 = (RADIO_MODECNF0_RU_Fast << RADIO_MODECNF0_RU_Pos);
#endif
	NRF_RADIO->PCNF0 = g_pcnf0;

	// g_pcnf1=0 -> build static-length config from g_statlen/g_balen (ENDIAN=Big, WHITEEN=0)
	NRF_RADIO->PCNF1 =
		g_pcnf1 ? g_pcnf1 :
			  ((1u << RADIO_PCNF1_ENDIAN_Pos) |
			   ((uint32_t)g_balen << RADIO_PCNF1_BALEN_Pos) |
			   ((uint32_t)g_statlen << RADIO_PCNF1_STATLEN_Pos) |
			   ((uint32_t)g_statlen << RADIO_PCNF1_MAXLEN_Pos));
	NRF_RADIO->CRCCNF = g_crccnf; // CRC16, address included
	NRF_RADIO->CRCPOLY = g_crcpoly;
	NRF_RADIO->CRCINIT = g_crcinit;
	NRF_RADIO->DATAWHITEIV = g_whiteiv;
	NRF_RADIO->PACKETPTR = (uint32_t)rfrx;
}