Unable to communicate to CW305 after some clock glitches

1

I am performing clock glitch attack on cw305. The bitstream uploaded is doing some DNN computation. Below is the code snippet i am running to inject glitch:

target.usb_clk_setenabled(1)
#Basic setup
scope.glitch.clk_src = "clkgen" # set glitch input clock
scope.glitch.output = "clock_xor" # glitch_out = clk ^ glitch
scope.glitch.trigger_src = "continuous" # glitch only after scope.arm() called
scope.glitch.width = -3
scope.glitch.offset = -27
scope.io.hs2 = "glitch"  # output glitch_out on the clock line
scope.io.glitch_lp = False
print(scope.glitch)


def reboot_flush():
    scope.io.nrst = False
    time.sleep(0.05)
    scope.io.nrst = "high_z"
    time.sleep(0.05)

    #Flush garbage too
    target.flush()
    

for i in range(20):
    ret = cw.capture_trace(scope, target, knownkey, knownkey)
    if(ret):
        print(ret.textout.hex())
    else:
        reboot_flush()

After some successful glitch, i see some errors like following:

(ChipWhisperer Scope WARNING|File __init__.py:500) Target did not finish operation
(ChipWhisperer Scope WARNING|File _OpenADCInterface.py:642) Timeout in OpenADC capture(), no trigger seen! Trigger forced, data is invalid. Status: 07
(ChipWhisperer Scope WARNING|File _OpenADCInterface.py:642) Timeout in OpenADC capture(), no trigger seen! Trigger forced, data is invalid. Status: 04
(ChipWhisperer Scope WARNING|File __init__.py:500) Target did not finish operation
(ChipWhisperer Scope WARNING|File _OpenADCInterface.py:642) Timeout in OpenADC capture(), no trigger seen! Trigger forced, data is invalid. Status: 07
(ChipWhisperer Scope WARNING|File _OpenADCInterface.py:642) Timeout in OpenADC capture(), no trigger seen! Trigger forced, data is invalid. Status: 04
(ChipWhisperer Scope WARNING|File __init__.py:500) Target did not finish operation
(ChipWhisperer Scope WARNING|File _OpenADCInterface.py:642) Timeout in OpenADC capture(), no trigger seen! Trigger forced, data is invalid. Status: 07
(ChipWhisperer Scope WARNING|File _OpenADCInterface.py:642) Timeout in OpenADC capture(), no trigger seen! Trigger forced, data is invalid. Status: 04
(ChipWhisperer Scope WARNING|File __init__.py:500) Target did not finish operation

After that even I have to restart the FPGA, load bitstream again to work with it even if i change the scope to no glitch. How can I solve that?

2

Hi,

One of the downsides of glitching an FPGA is that you can potentially corrupt the internal state of the FPGA, requiring you to have to reload the bitstream. Not really much you can do about that.

One recommendation that I can make is to use ext_single instead of continuous for your trigger source. You’re giving up a lot of control over glitching by just inserting a glitch every clock cycle and greatly increasing the risk that you corrupt the bitstream.

Alex

3

I have tried ext_single but it turns out that it does not make any difference in the computation in broad range of width and offset. Just to be clear, does ext_single mean that the fault will be injected only once in one clock cycle of the whole time span between trigger and done signal?

4

ext_single means a single glitch will be injected (or multiple in a row with scope.glitch.repeat) after calling scope.arm() and having a rising edge on the trigger pin. continuous injects a glitch on every clock cycle, almost guaranteeing that you crash the target. You can remove the arming requirement by using ext_continuous instead of ext_single, so that a glitch is inserted on every trigger rising edge.