2 \author Travis Goodspeed
3 \brief Glitching Support for GoodFET20
5 See the TI example MSP430x261x_dac12_01.c for usage of the DAC.
6 This module sends odd and insufficient voltages on P6.6/DAC0
7 in order to bypass security restrictions of target devices.
16 //! Handles a monitor command.
17 void glitch_handle_fn( uint8_t const app,
21 // define the glitch app's app_t
22 app_t const glitch_app = {
34 "\tThe GLITCH app adds support for doing glitch research.\n"
35 "\tSee the TI example MSP430x261x_dac12_01.c for usage of the DAC.\n"
36 "\tThis module sends odd and insufficient voltages on P6.6/DAC0\n"
37 "\tin order to bypass security restrictions of target devices.\n"
40 //! Call this before the function to be glitched.
43 WDTCTL = WDTPW + WDTHOLD; // Stop WDT
55 //Set GSEL high to disable glitching.
57 //Normal voltage, use resistors instead of output.
58 //P5DIR=0x80; //ONLY glitch pin is output.
59 P5DIR|=0x80; //glitch pin is output.
60 P5OUT|=0x80; //It MUST begin high.
61 //P5REN|=0x7F; //Resistors pull high and low weakly.
66 WDTCTL = WDTPW + WDTHOLD; // Stop WDT
67 TACTL = TASSEL1 + TACLR; // SMCLK, clear TAR
68 CCTL0 = CCIE; // CCR0 interrupt enabled
69 CCR0 = glitchcount+0x10; // Compare Value
70 TACTL |= MC_2; // continuous mode.
74 // Timer A0 interrupt service routine
75 void __attribute__((interrupt(TIMERA0_VECTOR))) Timer_A (void){
76 //This oughtn't be necessary, but glitches repeat without it.
77 TACTL=0; //disable counter.
81 //asm("nop"); //delay deepens glitch.
84 //This oughtn't be necessary, but glitches repeat without it.
85 TACTL=0; //disable counter.
87 //P5OUT^=BIT7;//Normal
94 //! Glitch an application.
95 void glitchapp(u8 app){
96 debugstr("That app is not yet supported.");
100 //! Set glitching voltages.
101 void glitchvoltages(u16 gnd, u16 vcc){
103 //debugstr("Set glitching voltages: GND and VCC");
107 /** N.B., because this is confusing as hell. As per Page 86 of
108 SLAS541F, P6SEL is not what controls the use of the DAC0/DAC1
109 functions on P6.6 and P6.5. Instead, CAPD or DAC12AMP>0 sets
115 ADC12CTL0 = REF2_5V + REFON; // Internal 2.5V ref on
116 // Delay here for reference to settle.
117 for(i=0;i!=0xFFFF;i++) asm("nop");
118 DAC12_0CTL = DAC12IR + DAC12AMP_5 + DAC12ENC; // Int ref gain 1
119 DAC12_1CTL = DAC12IR + DAC12AMP_5 + DAC12ENC; // Int ref gain 1
120 // 1.0V 0x0666, 2.5V 0x0FFF
121 DAC12_0DAT = vcc; //high;
122 DAC12_1DAT = gnd; //low;
125 //! Set glitching rate.
126 void glitchrate(u16 rate){
130 //! Handles a monitor command.
131 void glitch_handle_fn( uint8_t const app,
137 glitchvoltages(cmddataword[0],
142 glitchrate(cmddataword[0]);
146 //FIXME parameters don't work yet.
148 TAR=0; //Reset clock.
149 handle(cmddata[0],cmddata[1],0);
150 TACTL |= MC0;// Stop Timer_A;
153 debugstr("Measuring start time.");
154 __dint();//disable interrupts
155 TACTL=0; //clear dividers
156 TACTL|=TACLR; //clear config
158 TASSEL_2 //smclk source
159 | MC_2; //continuous mode.
161 //perform the function
162 silent++;//Don't want the function to return anything.
164 handle(cmddata[0],cmddata[1],0);
165 cmddataword[0]=TAR; //Return counter.
167 debugstr("Measured start time.");
168 debughex(cmddataword[0]);
172 //Testing mode, for looking at the glitch waveform.
173 glitchvoltages(0,0xFFF);//Minimum glitch, for noise test.
174 //glitchvoltages(0,0);//Drop VCC
175 //glitchvoltages(0xFFF,0xFFF);//Raise Ground
179 P5OUT&=~BIT7;//Glitch
180 //asm("nop"); //Not Necessary
182 asm("nop");asm("nop");asm("nop");asm("nop");asm("nop");asm("nop");
183 asm("nop");asm("nop");asm("nop");asm("nop");asm("nop");asm("nop");
190 debugstr("Unknown glitching verb.");