Glitch repeat count limit

Hi,

The glitch repeat count limit of 255 is too low for my target and I would like to increase it.

I have just changed the limit and of course hit a problem. In the code below, rest[6] is only a byte and setting anything bigger that 255 is not possible.

resp = self.oa.sendMessage(CODE_READ, glitchaddr, Validate=False, maxResp=8)

resp[6] = num-1
self.oa.sendMessage(CODE_WRITE, glitchaddr, resp, Validate=False)

Is there any documentation on what self.oa is and it’s message format?

Has anyone else hit this issue and know how to solve it?

Thanks,

Lechiffre

What I’ve seen is 255 repeat is enough. Like in my target if I set anything larger than 204 it would basically reset or hang the system. My target is running at 204Mhz so 204 repeat cycles is 1us glitch window. 204 cycles translate to maybe 100 ARM instructions.
You might want to remove some of the capacitors on your cpu core power rail to make it easier to glitch.

Hi,

I was looking into that code today so I figured I post something about this.

There is a direct relation between the code here and the FPGA code.
github.com/newaetech/chipwhispe … ch.py#L345
The code reads a register (8 bytes) and modifies byte 7 to insert the Repeat

    @setupSetParam("Repeat")
    def setNumGlitches(self, num):
        """Set number of glitches to occur after a trigger"""
        num = int(num)
        resp = self.oa.sendMessage(CODE_READ, glitchaddr, Validate=False, maxResp=8)

        if resp is None or len(resp) < 8:
            logging.warning('Glitch Module not present?')
            return

        if num < 1:
            num = 1
        resp[6] = num-1
        self.oa.sendMessage(CODE_WRITE, glitchaddr, resp, Validate=False)

and the FPGA code in
github.com/newaetech/chipwhispe … tch.v#L210

/*
	 Clock-glitch settings main registers (address 51)
	 [8..0]  = Glitch Offset Fine Phase 
	 [17..9] = Glitch Width Fine Phase
	 [18] = Load Phases
	 [..19] =  Glitch Offset current setting
	 [36..] =  Glitch Width current setting
	 [37] = Offset Fine loaded
	 [38] = Width Fine loaded
	 [39] (Byte 4, Bit 7)  = Offset DCM Locked
	 [40] (Byte 5, Bit 0)  = Width DCM Locked	 
	 [41] (Byte 5, Bit 1)  = DCM Reset
	 [43..42] (Byte 5, Bit [3..2]) = Glitch trigger source
	      00 = Manual
			01 = Capture Trigger (with offset, continous)
			10 = Continous
			11 = Capture Trigger (with offset, single-shot when manual glitch is '1')
	 
	 [46..44] (Byte 5, Bit [6..4]) = Glitch Type
			000 = Glitch is XORd with Clock (Positive or Negative going glitch)
		   001 = Glitch is ORd with Clock (Positive going glitch only)
			010 = Glitch Only
			011 = Clock Only	 
			100 = Glitch only based on enable, does not use phase-based difference.
			      Can generate very long glitch pulses.

	 [47] (Byte 5, Bit 7) = Manual Glitch. Set to 1 then 0, glitch on rising edge
	 
	 [55..48] (Byte 6, Bits [7..0])
	      Cycles to glitch-1 (e.g. 0 means 1 glitch)
			
	 [57..56] (Byte 7, Bits [1..0]) = Glitch Clock Source
	       00 = Source 0
			 01 = Source 1
			 
	 [63..58] (Byte 7, Bits [7..2]) = Unused
	 
	 
*/	
//and line 210 
assign max_glitches = clockglitch_settings_reg[55:48];
//line 257 where the count logic is.
 reg [7:0] glitch_cnt;
	 reg glitch_go;
	 always @(posedge sourceclk) begin
		if (glitch_trigger)
			glitch_go <= 'b1;
	 	else if (glitch_cnt >= max_glitches)
			glitch_go <= 'b0;
end

Modifying the python code means modifying the FPGA code to have a more bits assigned to the counter.