Send only glitchs (not clock) to a target clock

1

Hello,
I would like to inject faults on a target with a clock integrated in the target, so with wires on the clock I would just inject faults (not the clock) and retrieve clock of the target. So I connected the output of the clock to HS1, and I use

scope.clock.clkgen_src = 'extclk' 
scope.io.hs2 = "glitch"
scope.glitch.output = "glitch_only"
scope.glitch.clk_src = "clkgen"
scope.clock.extclk_freq = 25E6
scope.glitch.trigger_src = "manual"

I understand scope.glitch.output = “glitch_only” as “send only glitches, not clock, on HS2”. But with an oscilloscope between HS2 and ground, I see 25 MHz instead of nothing (because I would like only glitches, not clock)

Also on a second same target I removed the clock and let the ChipWhisperer generate the clock but it’s not successful: the target has many problems with stability (some crashes, and ethernet connection isn’t stable). What is the precision of the clock generated by the ChipWhisperer? My chip asks for 25 MHz with a tolerance of 50 ppm, so 50 Hz if I am not mistaken.

Do you know how to have only glitches on HS2?
Regards,
Nuliel

2

Yeah, those settings should give you only glitches on hs2. I’m not able to replicate the behaviour you’re seeing. Can you try doing print(scope) and posting the output of that?

AFAIK, the clkgen stuff on FPGAs isn’t great in this respect - the output clock tends to be pretty jittery, so I wouldn’t recommend that for anything that needs a really stable clock.

Alex

3

Hello,
Thanks for your reply. Here are the parameters set

scope.clock.clkgen_src = 'extclk' 
scope.io.hs2 = "glitch"
scope.glitch.output = "glitch_only"
scope.glitch.clk_src = "clkgen"
scope.clock.extclk_freq = 25E6
scope.glitch.trigger_src = "manual"
print(scope)

and the response

cwlite Device
sn         = xxxxxxx
fw_version = 
    major = 0
    minor = 60
    debug = 0
gain = 
    mode = low
    gain = 0
    db   = 5.5
adc = 
    state          = False
    basic_mode     = low
    timeout        = 2
    offset         = 0
    presamples     = 0
    samples        = 24400
    decimate       = 1
    trig_count     = 129969765
    fifo_fill_mode = normal
clock = 
    adc_src       = clkgen_x1
    adc_phase     = 0
    adc_freq      = 96000000
    adc_rate      = 96000000.0
    adc_locked    = False
    freq_ctr      = 0
    freq_ctr_src  = extclk
    clkgen_src    = extclk
    extclk_freq   = 25000000
    clkgen_mul    = 0
    clkgen_div    = 1
    clkgen_freq   = 0.0
    clkgen_locked = False
trigger = 
    triggers = tio4
    module   = basic
io = 
    tio1         = serial_tx
    tio2         = serial_rx
    tio3         = high_z
    tio4         = high_z
    pdid         = high_z
    pdic         = high_z
    nrst         = high_z
    glitch_hp    = False
    glitch_lp    = False
    extclk_src   = hs1
    hs2          = glitch
    target_pwr   = True
    tio_states   = (1, 0, 0, 0)
    cdc_settings = bytearray(b'\x01\x00\x00\x00')
glitch = 
    clk_src     = clkgen
    width       = 10.15625
    width_fine  = 0
    offset      = 10.15625
    offset_fine = 0
    trigger_src = manual
    arm_timing  = after_scope
    ext_offset  = 0
    repeat      = 1
    output      = glitch_only

Ok for the stability, in fact it’s more or less stable for a UART connection (some kernels crashes), but ethernet is completely unstable.

4

Try setting scope.clock.clkgen_freq = 25E6. That’s what gets used for the glitch module, so it being 0 is probably why your glitch signal is messed up.

Alex

5

I added the parameter you give to the list of parameters, but it also output 25MHz on HS2.
Here are the parameters used:

    scope.clock.clkgen_src = 'extclk' 
    scope.io.hs2 = "glitch"
    scope.glitch.output = "glitch_only"
    scope.glitch.clk_src = "clkgen"
    scope.clock.extclk_freq = 25E6
    scope.clock.clkgen_freq = 25E6
    scope.glitch.trigger_src = "manual"
    print(scope)

cwlite Device
sn         = xxx
fw_version = 
    major = 0
    minor = 60
    debug = 0
gain = 
    mode = low
    gain = 0
    db   = 5.5
adc = 
    state          = False
    basic_mode     = low
    timeout        = 2
    offset         = 0
    presamples     = 0
    samples        = 24400
    decimate       = 1
    trig_count     = 2956152768
    fifo_fill_mode = normal
clock = 
    adc_src       = clkgen_x1
    adc_phase     = 0
    adc_freq      = 96000000
    adc_rate      = 96000000.0
    adc_locked    = False
    freq_ctr      = 0
    freq_ctr_src  = extclk
    clkgen_src    = extclk
    extclk_freq   = 25000000
    clkgen_mul    = 0
    clkgen_div    = 1
    clkgen_freq   = 0.0
    clkgen_locked = False
trigger = 
    triggers = tio4
    module   = basic
io = 
    tio1         = serial_tx
    tio2         = serial_rx
    tio3         = high_z
    tio4         = high_z
    pdid         = high_z
    pdic         = high_z
    nrst         = high_z
    glitch_hp    = False
    glitch_lp    = False
    extclk_src   = hs1
    hs2          = glitch
    target_pwr   = True
    tio_states   = (1, 0, 0, 0)
    cdc_settings = bytearray(b'\x01\x00\x00\x00')
glitch = 
    clk_src     = clkgen
    width       = 10.15625
    width_fine  = 0
    offset      = 10.15625
    offset_fine = 0
    trigger_src = manual
    arm_timing  = after_scope
    ext_offset  = 0
    repeat      = 1
    output      = glitch_only

In fact, I plug HS1 to the out of the clock, GND of CW and GND of target are connected, and I watch signals between HS2 and GND of CW a signal of 25 MHz

Edit: with scope.glitch.output = “clock_xor”, it doesn’t output the clock, and it seems to output glitches. I will try with this.

Reedit: after remodifying scope.glitch.output to glitch_only, I don’t have 25MHz, and it seems that I inject only glitches, but the clock needs to be correctly connected when we passed the parameters.

6

It also looks like you have 0MHz on the freq_ctr, which should be measuring extclk. Can you verify that the 25MHz is hooked up to HS1?

7

Oh, my wire on HS1 wasn’t well connected on clock, I think the problem came from here and not from parameters of CW. I will look for a good solution to hold correctly wires on the target clock (the clock is so small that it’s hard to do that :frowning: ).