e3b226ddef01d4ab5b51f9ab3aeed3e67cad2815
[goodfet] / firmware / apps / glitch / glitch.c
1 /*! \file glitch.c
2   \author Travis Goodspeed
3   \brief Glitching Support for GoodFET20
4   
5   See the TI example MSP430x261x_dac12_01.c for usage of the DAC.
6   This module sends odd and insufficient voltages on P6.6/DAC0
7   in order to bypass security restrictions of target devices.
8 */
9
10 #include "platform.h"
11 #include "command.h"
12 #include "glitch.h"
13
14 //! Disable glitch state at init.
15 void glitchsetup(){
16 #ifdef DAC12IR
17   //Set GSEL high to disable glitching.
18
19   P5DIR|=0x80;
20   P6DIR|=0x40;  
21   
22   P5OUT|=0x80;
23   P6OUT|=0x40;
24   
25   glitchsetupdac();
26
27   WDTCTL = WDTPW + WDTHOLD;             // Stop WDT                                                                                                                                
28   TACTL = TASSEL1 + TACLR;              // SMCLK, clear TAR                                                                                                                        
29   CCTL0 = CCIE;                         // CCR0 interrupt enabled                                                                                                                  
30   CCR0 = glitchcount;
31   TACTL |= MC1;                         // Start Timer_A in continuous mode                                                                                                        
32   _EINT();                              // Enable interrupts 
33 #endif
34 }
35
36 //! Setup analog chain for glitching.
37 void glitchsetupdac(){
38   glitchvoltages(glitchL,glitchH);
39 }
40
41 // Timer A0 interrupt service routine                                                                                                                                              
42 interrupt(TIMERA0_VECTOR) Timer_A (void)
43 {
44   
45   switch(glitchstate){
46   case 0:
47     P1OUT|=1;
48     glitchstate=1;
49     DAC12_0DAT = glitchH;
50     break;
51   case 1:
52     P1OUT|=1;
53     glitchstate=0;
54     DAC12_0DAT = glitchL;
55     break;
56   default:
57     P1OUT&=~1;
58     //Do nothing.
59     break;
60   }
61   CCR0 += glitchcount;                        // Add Offset to CCR0                                                                                                                      
62 }
63
64
65
66
67 u16 glitchH=0xfff, glitchL=0xfff,
68   glitchstate=2, glitchcount=0;
69
70 //! Glitch an application.
71 void glitchapp(u8 app){
72   debugstr("That app is not yet supported.");
73 }
74
75
76 //! Set glitching voltages.
77 void glitchvoltages(u16 low, u16 high){
78   int i;
79   glitchH=high;
80   glitchL=low;
81   
82   
83   #ifdef DAC12IR
84   ADC12CTL0 = REF2_5V + REFON;                  // Internal 2.5V ref on
85   // Delay here for reference to settle.
86   for(i=0;i!=0xFFFF;i++) asm("nop");
87   DAC12_0CTL = DAC12IR + DAC12AMP_5 + DAC12ENC; // Int ref gain 1
88   // 1.0V 0x0666, 2.5V 0x0FFF
89   DAC12_0DAT = high;
90   //DAC12_0DAT = 0x0880;
91   #endif 
92 }
93 //! Set glitching rate.
94 void glitchrate(u16 rate){
95   glitchcount=rate;
96 }
97
98
99 //! Handles a monitor command.
100 void glitchhandle(unsigned char app,
101                   unsigned char verb,
102                   unsigned long len){
103   switch(verb){
104   case GLITCHVOLTAGES:
105     glitchvoltages(cmddataword[0],
106                    cmddataword[1]);
107     txdata(app,verb,0);
108     break;
109   case GLITCHRATE:
110     glitchrate(cmddataword[0]);
111     txdata(app,verb,0);
112     break;
113   case START:
114   case STOP:
115   case GLITCHAPP:
116   case GLITCHVERB:
117   default:
118     debugstr("Unknown glitching verb.");
119     txdata(app,NOK,0);
120   }
121 }