Commit 78e4bb84 authored by CLAUDEPIERRE Ludovic's avatar CLAUDEPIERRE Ludovic
Browse files

ajout une led s'allume quand reception du trigger (push rst pour l'eteindre),...

ajout une led s'allume quand reception du trigger (push rst pour l'eteindre), màj des en-têtes licence et du Readme
parent dfe3fe8a
TRAITOR avec programmation en UART
# About this repository
De base, si on oublies de rentrer un nombre de cycle à glitcher, il va au moins
fauter sur 1 cycle d'horloge (faute classique).
- This is the source code of TRAITOR (**TRA**nsportable gl**I**tch a**T**tack
platf**OR**m), a FPGA platform used for fault injection, specifically clock
glitch fault injection. More details in our paper [1].
- VHDL has been created with Vivado version 2018.3. You should synthetized the
code with this specific version, or with another one that has been tested :
2019.2. Both versions produce a working synthesis. Results with other
versions is unknown.
- FPGA target is the Arty A7-35T [2]
- Attacked device in the paper is the STM32F100RB [3], *a.k.a.*
STM32F1Discovery-VL
- If you use TRAITOR, please cite our paper [1].
Amplitude du Glitch (entre E0 et F0) : adresse 0
# Usage
Delay de Glitch : adresse 1 + N*8
To configure the FPGA, use any software that can communicate on serial port and
use this configuration:
- Baud rate : 115200
- Bits : 8
- Stopbits : 1
- Parity : None
- Flow control : None
Width du Glitch (durée de la rafale de glitchs) ; adresse 5 + N*8
\ No newline at end of file
Here's the memory layout of the FPGA. Address `0x00` is used for a specific
parameter called **amplitude** (see paper). Each glitch is coded on 8 bytes: 4
bytes for the **delay**, 4 bytes for the **width**. User can encode up to 31
glitches.
| Variable | Adresse | Value | | |
|:---------:|:-------------:|:--------------:|---|---|
| Amplitude | `0x00` | `[0xE0-0xF0]` | | |
| Delay 1 | `[0x01-0x04]` | User defined | | |
| Width 1 | `[0x05-0x08]` | User defined | | |
| Delay 2 | `[0x09-0x0C]` | User defined | | |
| Width 2 | `[0x0D-0x10]` | Used defined | | |
| ... | ... | ... | | |
# References
* [1] Ludovic Claudepierre, Pierre-Yves Péneau, Damien Hardy, Erven Rohou.
TRAITOR: A Low-Cost Evaluation Platform for Multifault Injection. *In
International Symposium on Advanced Security on Software and Systems (ASSS)*,
ACM 2021
* [2] https://www.xilinx.com/products/boards-and-kits/1-elhaap.html
* [3] https://www.st.com/en/microcontrollers-microprocessors/stm32f100rb.html
----------------------------------------------------------------------------------
--{{ TRAITOR }}
--Copyright (C) {{ 2021 }} {{ INRIA }}
-- TRAITOR
--Copyright (C) 2019 - INRIA
--This program is free software: you can redistribute it and/or modify
--it under the terms of the GNU Affero General Public License as published by
......@@ -17,11 +17,11 @@
--along with this program. If not, see <http://www.gnu.org/licenses/>.
-- Engineer: R. Lashermes
-- Author: R. Lashermes
-- Target Devices: ArtiX7
-- Description: Testbench for configuration_manager
--
--
-- Revision:
-- Revision 0.01 - File Created
-- Additional Comments:
......@@ -55,23 +55,23 @@ architecture Behavioral of config_manager_tb is
end loop;
end procedure;
constant T : time := 20 ns;
constant T : time := 20 ns;
signal clk: std_logic := '0';
signal reset: std_logic;
component configuration_manager is
port(clk: in std_logic;
reset: in std_logic;
--fifo from Uart PC rx (cross clock domains)
din: in byte;
din_rdy: in std_logic;
din_read: out std_logic;-- send read order
--fifo to Uart PC tx (cross clock domains)
dout: out byte;
dout_write: out std_logic;-- send write order
-- triggers
trig_amplitude : out std_logic_vector(7 downto 0);
trig_confs: out TrigConfs
......@@ -105,7 +105,7 @@ architecture Behavioral of config_manager_tb is
signal pc_rx_data: std_logic_vector(7 downto 0);
signal pc_rx_write : std_logic;
begin
clk <= not clk after T/2;
......@@ -168,7 +168,7 @@ begin
begin
pc_rx_data <= x"00";
pc_rx_write <= '0';
wait_clocks(clk, 5);
-- push 00 to fifo rx
pc_rx_data <= x"00";
......@@ -186,7 +186,7 @@ begin
wait_clocks(clk, 1);
-- stop pushing
pc_rx_write <= '0';
-- wait end of simu
wait_clocks(clk, 10);
......
----------------------------------------------------------------------------------
--{{ TRAITOR }}
--Copyright (C) {{ 2021 }} {{ INRIA }}
-- TRAITOR
--Copyright (C) 2019 - INRIA
--This program is free software: you can redistribute it and/or modify
--it under the terms of the GNU Affero General Public License as published by
......@@ -17,11 +17,11 @@
--along with this program. If not, see <http://www.gnu.org/licenses/>.
-- Engineer: L. Claudepierre
-- Author: L. Claudepierre
-- Target Devices: ArtiX7
-- Description: Test-bench for TRAITOR
-- Description: Test-bench for TRAITOR
--
--
-- Revision:
-- Revision 0.01 - File Created
-- Additional Comments:
......@@ -52,7 +52,7 @@ entity traitor_tb is
trig_delay_in: out trig_delays;
trig_width_in : out trig_widths;
trig_amplitude_in : out STD_LOGIC_VECTOR(7 downto 0);
-- OUPUT--
led : in STD_LOGIC_VECTOR (15 downto 0);
Fault_trig_out : in STD_LOGIC;
......@@ -72,31 +72,31 @@ architecture Behavioral of traitor_tb is
signal s_delay : trig_delays;
signal s_width : trig_widths;
signal s_amplitude : STD_LOGIC_VECTOR(7 downto 0):=x"e0";
--// output from the glitchy module
signal s_led : STD_LOGIC_VECTOR (15 downto 0):=x"0000";
signal s_Fault_trig_out : STD_LOGIC;
signal s_clk_init : STD_LOGIC;
signal s_clk_dphase : STD_LOGIC;
signal s_clk_XOR_out : STD_LOGIC;
signal s_clk_fault_out : STD_LOGIC;
signal s_clk_fault_out2 : STD_LOGIC;
signal s_clk_fault_out : STD_LOGIC;
signal s_clk_fault_out2 : STD_LOGIC;
signal s_rst : STD_LOGIC :='0';
constant T100 : time := 10 ns;
constant Trst : time := 500 ns;
constant Twait : time := 100 ns;
constant T100 : time := 10 ns;
constant Trst : time := 500 ns;
constant Twait : time := 100 ns;
begin
UUT : entity work.mmcm_reset
UUT : entity work.mmcm_reset
port map (
clk_100 => s_clk_100,
Dswitch => s_Dswitch,
clk_100 => s_clk_100,
Dswitch => s_Dswitch,
stm_trig => s_stm_trig,
trig_delay_in =>s_delay ,
trig_width_in=>s_width ,
trig_amplitude_in=> s_amplitude,
-- OUPUT--
led => s_led,
Fault_trig_out => s_Fault_trig_out ,
......@@ -112,7 +112,7 @@ tb_clock100 : process
s_clk_100 <= '0';
wait for T100/2;
s_clk_100 <= '1';
wait for T100/2;
wait for T100/2;
end process;
s_stm_trig <= '0', '1' after 1*T100+0.25*T100+Trst;
......
----------------------------------------------------------------------------------
--{{ TRAITOR }}
--Copyright (C) {{ 2021 }} {{ INRIA }}
-- TRAITOR
--Copyright (C) 2019 - INRIA
--This program is free software: you can redistribute it and/or modify
--it under the terms of the GNU Affero General Public License as published by
......@@ -17,7 +17,7 @@
--along with this program. If not, see <http://www.gnu.org/licenses/>.
-- Engineer: L. Claudepierre
-- Author: L. Claudepierre
-- Target Devices: ArtiX7
-- Description: Glitch generation. Parameterization of the MMCM phase difference according to the "amplitude" parameter at the address x00 (1 byte value).
-- Generation of the clk_glitch = clk1 xor clk2, and then generation of clk_out switching between clk1 and clk_glitch according to the burst parameters
......@@ -49,6 +49,7 @@ entity mmcm_reset is
clk_100 : in STD_LOGIC;
Dswitch : in STD_LOGIC_VECTOR(1 downto 0);
stm_trig: in STD_LOGIC;
rst: in STD_LOGIC;
trig_delay_in: in trig_delays;
trig_width_in : in trig_widths;
trig_amplitude_in : in STD_LOGIC_VECTOR(7 downto 0);
......@@ -82,7 +83,6 @@ architecture Behavioral of mmcm_reset is
signal den : std_logic := '0';
signal di : std_logic_vector(15 downto 0) := (others => '0');
signal dwe : std_logic := '0';
signal rst : std_logic := '0';
signal s_PSCLK : std_logic := '0';
signal s_PSEN : std_logic := '0';
......@@ -230,7 +230,7 @@ stm_evt<=(stm_trig_b xor stm_trig_b2) and stm_trig_b ;
-- Control Ports: 1-bit (each) input: MMCM control ports
CLKINSEL => '1',
PWRDWN => '0', -- 1-bit input: Power-down
RST => rst, -- 1-bit input: Reset
RST => '0', -- 1-bit input: Reset
-- DRP Ports: 16-bit (each) output: Dynamic reconfiguration ports
DCLK => clk_0, -- 1-bit input: DRP clock
DO => DO, -- 16-bit output: DRP data
......@@ -310,9 +310,14 @@ end process;
Trigger_event: process(clk_0)
begin
if rising_edge(clk_0) then
stm_trig_b2<=stm_trig_b;
stm_trig_b<=stm_trig;
if rst = '1' then
led(0) <= '0';
elsif rising_edge(clk_0) then
stm_trig_b2<=stm_trig_b;
stm_trig_b<=stm_trig;
if stm_trig = '1' then
led(0) <= '1';
end if;
end if;
end process;
......@@ -357,19 +362,19 @@ begin
end if;
end process;
--/----------------------------------------------------------------------/--
led_buffer: process(clk_0)
begin
if rising_edge(clk_0) then
--led<=s_led;
case Dswitch is
when "00" => s_led<= std_logic_vector(trig_delay_in(0)(15 downto 0)); -- address : 1
when "01" => s_led <= std_logic_vector(trig_delay_in(1)(15 downto 0)); -- address : 9
when "10" => s_led <= std_logic_vector(trig_delay_in(2)(15 downto 0)); -- address : 11
when "11" => s_led <= std_logic_vector(trig_delay_in(3)(15 downto 0)); -- address : 19
when others => s_led <= x"0000";
end case;
end if;
end process;
--led_buffer: process(clk_0)
--begin
-- if rising_edge(clk_0) then
-- --led<=s_led;
-- case Dswitch is
-- when "00" => s_led<= std_logic_vector(trig_delay_in(0)(15 downto 0)); -- address : 1
-- when "01" => s_led <= std_logic_vector(trig_delay_in(1)(15 downto 0)); -- address : 9
-- when "10" => s_led <= std_logic_vector(trig_delay_in(2)(15 downto 0)); -- address : 11
-- when "11" => s_led <= std_logic_vector(trig_delay_in(3)(15 downto 0)); -- address : 19
-- when others => s_led <= x"0000";
-- end case;
-- end if;
--end process;
buf_clk0: BUFG
port map (
......
----------------------------------------------------------------------------------
--{{ TRAITOR }}
--Copyright (C) {{ 2021 }} {{ INRIA }}
-- TRAITOR
--Copyright (C) 2019 - INRIA
--This program is free software: you can redistribute it and/or modify
--it under the terms of the GNU Affero General Public License as published by
......@@ -17,7 +17,7 @@
--along with this program. If not, see <http://www.gnu.org/licenses/>.
-- Engineer: R. Lashermes
-- Author: R. Lashermes
-- Target Devices: ArtiX7
-- Description:
......
----------------------------------------------------------------------------------
--{{ TRAITOR }}
--Copyright (C) {{ 2021 }} {{ INRIA }}
-- TRAITOR
--Copyright (C) 2019 - INRIA
--This program is free software: you can redistribute it and/or modify
--it under the terms of the GNU Affero General Public License as published by
......@@ -17,11 +17,11 @@
--along with this program. If not, see <http://www.gnu.org/licenses/>.
-- Engineer: R. Lashermes
-- Author: R. Lashermes
-- Target Devices: ArtiX7
-- Description: Constant and global data
--
--
-- Revision:
-- Revision 0.01 - File Created
-- Additional Comments:
......
----------------------------------------------------------------------------------
--{{ TRAITOR }}
--Copyright (C) {{ 2021 }} {{ INRIA }}
-- TRAITOR
--Copyright (C) 2019 - INRIA
--This program is free software: you can redistribute it and/or modify
--it under the terms of the GNU Affero General Public License as published by
......@@ -17,7 +17,7 @@
--along with this program. If not, see <http://www.gnu.org/licenses/>.
-- Engineer: R. Lashermes & L. Claudepierre
-- Author: R. Lashermes & L. Claudepierre
-- Target Devices: ArtiX7
-- Description: Interface UART to read memory and send the results to the Host
......
----------------------------------------------------------------------------------
--{{ TRAITOR }}
--Copyright (C) {{ 2021 }} {{ INRIA }}
-- TRAITOR
--Copyright (C) 2019 - INRIA
--This program is free software: you can redistribute it and/or modify
--it under the terms of the GNU Affero General Public License as published by
......@@ -17,7 +17,7 @@
--along with this program. If not, see <http://www.gnu.org/licenses/>.
-- Engineer: R. Lashermes
-- Author: R. Lashermes
-- Target Devices: ArtiX7
-- Description: Fifo autoreader
......
----------------------------------------------------------------------------------
--{{ TRAITOR }}
--Copyright (C) {{ 2021 }} {{ INRIA }}
-- TRAITOR
--Copyright (C) 2019 - INRIA
--This program is free software: you can redistribute it and/or modify
--it under the terms of the GNU Affero General Public License as published by
......@@ -17,7 +17,7 @@
--along with this program. If not, see <http://www.gnu.org/licenses/>.
-- Engineer: R. Lashermes
-- Author: R. Lashermes
-- Target Devices: ArtiX7
-- Description: pulse generation for the autoreader
......
----------------------------------------------------------------------------------
--{{ TRAITOR }}
--Copyright (C) {{ 2021 }} {{ INRIA }}
-- TRAITOR
--Copyright (C) 2019 - INRIA
--This program is free software: you can redistribute it and/or modify
--it under the terms of the GNU Affero General Public License as published by
......@@ -17,11 +17,11 @@
--along with this program. If not, see <http://www.gnu.org/licenses/>.
-- Engineer: R. Lashermes
-- Author: R. Lashermes
-- Target Devices: ArtiX7
-- Description: constant and data for the glitch and memorisation
--
--
-- Revision:
-- Revision 0.01 - File Created
-- Additional Comments:
......@@ -58,7 +58,7 @@ package triggy_common is
end record;
type TrigConfs is array (0 to NB_TRIGGERS-1) of TrigConf;
type trig_delays is array (0 to NB_TRIGGERS-1) of unsigned(LENGTH_DELAY*8-1 downto 0);
type trig_widths is array (0 to NB_TRIGGERS-1) of unsigned(LENGTH_WIDTH*8-1 downto 0);
......
----------------------------------------------------------------------------------
--{{ TRAITOR }}
--Copyright (C) {{ 2021 }} {{ INRIA }}
-- TRAITOR
--Copyright (C) 2019 - INRIA
--This program is free software: you can redistribute it and/or modify
--it under the terms of the GNU Affero General Public License as published by
......@@ -17,7 +17,7 @@
--along with this program. If not, see <http://www.gnu.org/licenses/>.
-- Engineer: L. Claudepierre
-- Author: L. Claudepierre
-- Target Devices: ArtiX7
-- Description: Wrapper of Glitch generation and Memory/UART communication
......@@ -82,6 +82,7 @@ component mmcm_reset IS
clk_100 : in STD_LOGIC;
Dswitch : in STD_LOGIC_VECTOR(1 downto 0);
stm_trig: in STD_LOGIC;
rst: in std_logic;
led : out STD_LOGIC_VECTOR (15 downto 0);
......@@ -126,6 +127,7 @@ glitch_uart: mmcm_reset
Dswitch => Dswitch,
stm_trig => stm_trig,
rst => rst,
led => led,
clk_init => clk_init,
clk_dphase => clk_dphase,
......
----------------------------------------------------------------------------------
--{{ TRAITOR }}
--Copyright (C) {{ 2021 }} {{ INRIA }}
-- TRAITOR
--Copyright (C) 2019 - INRIA
--This program is free software: you can redistribute it and/or modify
--it under the terms of the GNU Affero General Public License as published by
......@@ -17,7 +17,7 @@
--along with this program. If not, see <http://www.gnu.org/licenses/>.
-- Engineer: R. Lashermes & L.Claudepierre
-- Author: R. Lashermes & L.Claudepierre
-- Target Devices: ArtiX7
-- Description: Wrapper of Memory and UART communication
......
----------------------------------------------------------------------------------
--{{ TRAITOR }}
--Copyright (C) {{ 2021 }} {{ INRIA }}
-- TRAITOR
--Copyright (C) 2019 - INRIA
--This program is free software: you can redistribute it and/or modify
--it under the terms of the GNU Affero General Public License as published by
......@@ -17,7 +17,7 @@
--along with this program. If not, see <http://www.gnu.org/licenses/>.
-- Engineer: R. Lashermes
-- Author: R. Lashermes
-- Target Devices: ArtiX7
-- Description: communication with UART interface
......
----------------------------------------------------------------------------------
--{{ TRAITOR }}
--Copyright (C) {{ 2021 }} {{ INRIA }}
-- TRAITOR
--Copyright (C) 2019 - INRIA
--This program is free software: you can redistribute it and/or modify
--it under the terms of the GNU Affero General Public License as published by
......@@ -17,7 +17,7 @@
--along with this program. If not, see <http://www.gnu.org/licenses/>.
-- Engineer: R. Lashermes
-- Author: R. Lashermes
-- Target Devices: ArtiX7
-- Description:
......
----------------------------------------------------------------------------------
--{{ TRAITOR }}
--Copyright (C) {{ 2021 }} {{ INRIA }}
-- TRAITOR
--Copyright (C) 2019 - INRIA
--This program is free software: you can redistribute it and/or modify
--it under the terms of the GNU Affero General Public License as published by
......@@ -17,7 +17,7 @@
--along with this program. If not, see <http://www.gnu.org/licenses/>.
-- Engineer: R. Lashermes
-- Author: R. Lashermes
-- Target Devices: ArtiX7
-- Description:
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment