Clock glitching

Not sure if this post belongs in software/hardware/glitching… apologies if it’s the wrong one.

I’m using the ChipWhisperer Lite, and trying to experiment a bit with clock glitching. I’m getting a weird issue where configuring the glitching module sometimes breaks the clock generation, and I’m not sure why.

I’m using the CW to generate the target clock, and everything looks great when it starts up. When I go to the glitching module and attempt to use a percentage glitching offset (negative or positive), the clock generation stops. This happens even when the glitching module isn’t “in use” (so regardless of how Target HS-IO-Out or Clock Source is set).

When the clock generation stops (measured HZ by the Freq Counter with the CLKGEN output as the src), it goes to 0Hz, and nothing I can seem to do (resetting the DCM for the glitch module or clock, removing the values from the glitch module, trying to toggle other values) enables it back again. A power cycle of the ChipWhisperer fixes things.

Any ideas what’s going on? I’m not sure if it’s some weird issue with the partial reconfiguration on the FPGA, or if it’s a sillier bug, or if I’m just doing something wrong.

Cheers

Hello,

There is some weird issue w.r.t. the partial reconfiguration - I do know about this, as discovered it last week while updating the documentation. I was hoping to push a new release out shortly (which will fix the issue), but in the mean-time will try to create a quick patch.

I’m not sure exactly what happened… I might have forgotten to update the partial configuration data with the latest release. Huge apologies on the issue and delay in getting this fixed - I was traveling last week & then have been out sick, but want to get this updated ASAP! I ran the scripts overnight to regenerate the PR data for the FPGA, will have time in a few hours to check if that is working and post a patch here… check back soon hopefully!

Warm Regards,

-Colin

Great, thanks! I didn’t realize partial reconfiguration was a thing FPGA synthesizers could do before seeing it in the CW docs, I’m not surprised it’s a bit finicky.

Anyway, not a problem, just let me know when it should be working :slight_smile:

Yeah, the partial reconfig on the Spartan 6 isn’t “officially” supported so has some special headaches too. Anyway I got this fixed now, confirmed quickly it works here.

The updated file is called cwlite_firmware.zip, you can download directly from GIT here. Replace the file located at “chipwhisperer/hardware/capture/chipwhisperer-lite” to fix the issue, and be sure to power cycle the CW-Lite. If you are using CW Instant (the VMWare image) you can just do a “git pull” to pull down the latest code.

Let me know if it works!

Awesome!

I just tested it and it seems to be working with the new firmware blob! Thanks for the super quick turnaround.

FYI there is now a complete tutorial for clock glitching at newae.com/sidechannel/cwdocs/tutorialglitch.html . This also includes a video of the attack.

You’ll have to use the CW software from GIT, or if using the instant chipwhisperer VMWare image just do a “git pull” to update. There were a few improvements in the Capture software for this tutorial.