Discussions on Python software that powers the ChipWhisperer system
#1573 by Lechiffre
Thu Sep 07, 2017 9:27 pm
Hi,

The glitch repeat count limit of 255 is too low for my target and I would like to increase it.

I have just changed the limit and of course hit a problem. In the code below, rest[6] is only a byte and setting anything bigger that 255 is not possible.

resp = self.oa.sendMessage(CODE_READ, glitchaddr, Validate=False, maxResp=8)
...
resp[6] = num-1
self.oa.sendMessage(CODE_WRITE, glitchaddr, resp, Validate=False)

Is there any documentation on what self.oa is and it's message format?

Has anyone else hit this issue and know how to solve it?

Thanks,

Lechiffre
#1584 by fuzzer
Wed Sep 13, 2017 1:11 pm
What I've seen is 255 repeat is enough. Like in my target if I set anything larger than 204 it would basically reset or hang the system. My target is running at 204Mhz so 204 repeat cycles is 1us glitch window. 204 cycles translate to maybe 100 ARM instructions.
You might want to remove some of the capacitors on your cpu core power rail to make it easier to glitch.
#1600 by keesj
Tue Sep 19, 2017 2:46 pm
Hi,

I was looking into that code today so I figured I post something about this.

There is a direct relation between the code here and the FPGA code.
https://github.com/newaetech/chipwhispe ... ch.py#L345
The code reads a register (8 bytes) and modifies byte 7 to insert the Repeat
Code: Select all    @setupSetParam("Repeat")
    def setNumGlitches(self, num):
        """Set number of glitches to occur after a trigger"""
        num = int(num)
        resp = self.oa.sendMessage(CODE_READ, glitchaddr, Validate=False, maxResp=8)

        if resp is None or len(resp) < 8:
            logging.warning('Glitch Module not present?')
            return

        if num < 1:
            num = 1
        resp[6] = num-1
        self.oa.sendMessage(CODE_WRITE, glitchaddr, resp, Validate=False)


and the FPGA code in
https://github.com/newaetech/chipwhispe ... tch.v#L210
Code: Select all/*
    Clock-glitch settings main registers (address 51)
    [8..0]  = Glitch Offset Fine Phase
    [17..9] = Glitch Width Fine Phase
    [18] = Load Phases
    [..19] =  Glitch Offset current setting
    [36..] =  Glitch Width current setting
    [37] = Offset Fine loaded
    [38] = Width Fine loaded
    [39] (Byte 4, Bit 7)  = Offset DCM Locked
    [40] (Byte 5, Bit 0)  = Width DCM Locked   
    [41] (Byte 5, Bit 1)  = DCM Reset
    [43..42] (Byte 5, Bit [3..2]) = Glitch trigger source
         00 = Manual
         01 = Capture Trigger (with offset, continous)
         10 = Continous
         11 = Capture Trigger (with offset, single-shot when manual glitch is '1')
   
    [46..44] (Byte 5, Bit [6..4]) = Glitch Type
         000 = Glitch is XORd with Clock (Positive or Negative going glitch)
         001 = Glitch is ORd with Clock (Positive going glitch only)
         010 = Glitch Only
         011 = Clock Only   
         100 = Glitch only based on enable, does not use phase-based difference.
               Can generate very long glitch pulses.

    [47] (Byte 5, Bit 7) = Manual Glitch. Set to 1 then 0, glitch on rising edge
   
    [55..48] (Byte 6, Bits [7..0])
         Cycles to glitch-1 (e.g. 0 means 1 glitch)
         
    [57..56] (Byte 7, Bits [1..0]) = Glitch Clock Source
          00 = Source 0
          01 = Source 1
         
    [63..58] (Byte 7, Bits [7..2]) = Unused
   
   
*/   
//and line 210
assign max_glitches = clockglitch_settings_reg[55:48];
//line 257 where the count logic is.
 reg [7:0] glitch_cnt;
    reg glitch_go;
    always @(posedge sourceclk) begin
      if (glitch_trigger)
         glitch_go <= 'b1;
       else if (glitch_cnt >= max_glitches)
         glitch_go <= 'b0;
end


Modifying the python code means modifying the FPGA code to have a more bits assigned to the counter.

Who is online

Users browsing this forum: No registered users and 1 guest