Is it possible to use HS1 and HS2 for 2 different clock out?

Embedded Security ChipWhisperer Software
1

Hi,

I try to analyze a target which is connected via USB to a custom host emulation board (MCU + USB Host controller).

In order to have reliable results I want to generate the clock for MCU + USB-Host + Target with my chipwhisperer lite.

Unfortunately the USB Host controller only can be used with a fixed clock source of 12 MHz while the target requires a fixed 8 MHz clock.

Is it possible to use HS1 to output 12 MHz and HS2 to output 8 MHz ?

Thanks,

Maik

2

I found another simple way to produce the 2nd clock correlated to the CW clock.

The helper MCU (XMega128A4) can initialize a PLL and can give out the resulting clock on a GPIO pin.

In “xmega_hal.c” in function “platform_init()” I changed:
…

[code]void platform_init(void)
{
OSC.XOSCCTRL = 0x00;
OSC.PLLCTRL = 0x00;
OSC.CTRL |= OSC_XOSCEN_bm;
while((OSC.STATUS & OSC_XOSCRDY_bm) == 0); // wait for external clock

//ORIG CCP = CCP_IOREG_gc;
//ORIG CLK.CTRL = CLK_SCLKSEL_XOSC_gc; // switch clock source

// NEW: 
OSC.PLLCTRL = OSC_PLLSRC_XOSC_gc | 3;          // setup PLL XOSC*3
OSC.CTRL |= OSC_PLLEN_bm;                      // enable PLL
while ((OSC.STATUS & OSC_PLLRDY_bm) == 0);     // wait PLL ready

CCP = CCP_IOREG_gc;
CLK.PSCTRL = CLK_PSADIV_1_gc | CLK_PSBCDIV_4_1_gc;  // 1:4:4

CCP = CCP_IOREG_gc;
CLK.CTRL = CLK_SCLKSEL_PLL_gc;                 // select PLL as clock source

PORTD.DIRSET =  PIN7_bm;
PORTCFG.CLKEVOUT = PORTCFG_CLKOUT_PD7_gc;      // output clock on PD7

[/code]
…

So now CW generates the target frequency 8 MHz / 16MHz / … MHz, the PLL inside of the XMega converts it to 12 MHz (e.g. 16 MHz *3 / 4 = 12 MHz) and outputs it on GPIO pin which is connected to the USB Host controller IC.

Result:
The XMega and the USB Host IC are running from the same clock source as the victim. This is extremely useful to reproduce attacks since everything is accurate down to a clock cycle.

Have fun :smiley:,

Maik

3

Wow - creative use :slight_smile: I hadn’t even thought of doing that myself, will have to add a note somewhere about that.

I’d only worked on the system before usign an external chip to generate a related frequency… there wasn’t enough room in the LX9 to have a second PLL, unless you disable some of the other stuff.

Thanks for documenting!