2 \author Travis Goodspeed
3 \brief Glitching Support for GoodFET20
5 See the TI example MSP430x261x_dac12_01.c for usage of the DAC.
6 This module sends odd and insufficient voltages on P6.6/DAC0
7 in order to bypass security restrictions of target devices.
15 //! Call this before the function to be glitched.
18 //Set to high voltage.
22 TACTL=0; //Clear dividers.
23 TACTL|=TACLR; //Clear TimerA Config
25 TASSEL_SMCLK | //SMCLK source,
26 MC_1; //Count up to CCR0
27 //TAIE; //Enable Interrupt
28 CCTL0 = CCIE; // CCR0 interrupt enabled
31 //Enable general interrupts, just in case.
39 //Set GSEL high to disable glitching.
49 WDTCTL = WDTPW + WDTHOLD; // Stop WDT
50 TACTL = TASSEL1 + TACLR; // SMCLK, clear TAR
51 CCTL0 = CCIE; // CCR0 interrupt enabled
53 TACTL |= MC1; // Start Timer_A in continuous mode
54 _EINT(); // Enable interrupts
58 //! Setup analog chain for glitching.
59 void glitchsetupdac(){
60 glitchvoltages(glitchL,glitchH);
63 // Timer A0 interrupt service routine
64 interrupt(TIMERA0_VECTOR) Timer_A (void)
67 //debugstr("Glitching.");
68 DAC12_0DAT = 0;//glitchL;
76 //DAC12_0DAT = glitchL;
101 u16 glitchH=0xfff, glitchL=0xfff,
102 glitchstate=2, glitchcount=0;
104 //! Glitch an application.
105 void glitchapp(u8 app){
106 debugstr("That app is not yet supported.");
110 //! Set glitching voltages.
111 void glitchvoltages(u16 low, u16 high){
116 //debugstr("Set glitching voltages.");
119 ADC12CTL0 = REF2_5V + REFON; // Internal 2.5V ref on
120 // Delay here for reference to settle.
121 for(i=0;i!=0xFFFF;i++) asm("nop");
122 DAC12_0CTL = DAC12IR + DAC12AMP_5 + DAC12ENC; // Int ref gain 1
123 // 1.0V 0x0666, 2.5V 0x0FFF
125 //DAC12_0DAT = 0x0880;
128 //! Set glitching rate.
129 void glitchrate(u16 rate){
133 //! Handles a monitor command.
134 void glitchhandle(unsigned char app,
139 glitchvoltages(cmddataword[0],
144 glitchrate(cmddataword[0]);
148 //FIXME parameters don't work yet.
150 handle(cmddata[0],cmddata[1],0);
153 _DINT();//disable interrupts
154 TACTL=0; //clear dividers
155 TACTL|=TACLR; //clear config
156 TACTL|=TASSEL_SMCLK| //smclk source
157 MC_2; //continuout mode.
159 //perform the function
160 silent++;//Don't want the function to return anything.
161 handle(cmddata[0],cmddata[1],0);
163 cmddataword[0]=TAR; //Return counter.
170 debugstr("Unknown glitching verb.");