Skip to content

chipshouter.md

Latest commit

 

History

History
58 lines (42 loc) · 2.94 KB

chipshouter.md

File metadata and controls

58 lines (42 loc) · 2.94 KB
Raw

EMFI Setup

ot-sca supports EMFI with the ChipShouter + ChipWhisperer Husky + ChipShover XYZ table.

Setup

To perform electromagnetic fault injection evaluations with ot-sca, you need to setup the gear as follows:

  • ChipShouter
    • Injects the electromagnetic pulse into the DUT (i.e., the CW310 FPGA board or the chip)
    • Configured by the ot-sca framework to receive a pulse at the hardware trigger (SMB) input from the ChipWhisperer Husky
    • Electromagnetic pulse is based on the received pulse from the Husky
  • ChipShover
    • Moves the XYZ position of the ChipShouter
    • Configured & controlled by ot-sca
  • ChipWhisperer Husky
    • Configured & controlled by ot-sca
    • Receives trigger signal from DUT
    • Generates pulse at the Trigger/Glitch out SMB output
    • Forwarded to the ChipShouter input

The picture above shows the entire setup. By connecting the Husky Trigger/Glitch out (SMB) port to the ChipShouter hardware trigger (SMB), the pulse is forwarded from the Husky to the ChipShouter. The DUT trigger is connected to the ChipWhisperer Husky IO4 port.

Electromagnetic Pulse Generation

The ChipShouter is configured by the ot-sca framework to receive a pulse at the hardware trigger (SMB) input that is generated by the ChipWhisperer Husky at the Trigger/Glitch out (SMB) output. The Trigger/Glitch out (SMB) output at the ChipWhisperer Husky is used to allow fine granular adjustment steps for the pulse width. Internally, the ChipShouter shapes the electromagnetic pulse based on this received pulse.

self.cwh.clock.clkgen_freq = 50e6
self.cwh.glitch.output = 'enable_only'
self.cwh.glitch.repeat = <width>
self.cwh.glitch.ext_offset = <offset>

The code snippet above shows the glitch width configuration. When using the enable_only mode, the minimum glitch length as well as the minimum glitch step width is the clkgen_freq, i.e., 20ns. The glitch width can be configured with the repeat setting. By setting this parameter to 5, the glitch width is 5 * 20ns = 100ns. Similar, to configure the trigger delay, set the ext_offset, i.e., a glitch offset of 10 means 10 * 20ns = 200ns.

The electromagnetic pulse voltage is directly set in the ChipShouter over the serial interface.

Timing Diagram

The timing diagram above shows the trigger signal generated by the DUT (yellow), the pulse generated by the Husky (red) and the electromagnetic pulse generated by the ChipShouter (blue).

When detecting the rising edge of the DUT trigger signal, the Huksy waits for trigger_delay ns before sending the pules out of the HS2 output port.

Please note that the ChipWhisperer Husky as well as the ChipShouter has a small latency, i.e., even with a trigger_delay = 0ns, the electromagnetic pulse is not injected immediately.