CWHusky Clock Glitch Trigger delay

Embedded Security
1

Hello,

I have created a setup using cwhusky+cw313+cw312-a35 to perform clock glitches on custom designs, created based on ss2_xc7a35 project. The target’s execution triggers the scope to insert the glitch (trigger_src= ext_single). I monitor the clock through the CLKOUT pin, as well as the trigger, through GPIO4 pin using an oscilloscope. I ran into the following problem:

The glitches are inserted during the designs’ execution. I can see the glitch both on the oscilloscope, as well as it’s effect on the design’s output. I have set ext_offset=0, yet I see the glitch 7 clock cycles after the trigger goes high. I have also tested my code using the default bitstream file for cw312-a35 target, and the problem persists.

Am I missing something? I attach the scope settings:

cwhusky Device
sn             = 50203220325531583330343235323034
fpga_buildtime = 4/11/2024, 09:41
fw_version = 
    major = 1
    minor = 5
    debug = 0
gain = 
    mode = high
    gain = 65
    db   = 44.81651376146789
adc = 
    state                    = False
    basic_mode               = rising_edge
    timeout                  = 2
    offset                   = 0
    presamples               = 0
    samples                  = 5000
    decimate                 = 1
    trig_count               = 42
    stream_mode              = False
    test_mode                = False
    bits_per_sample          = 12
    segments                 = 1
    segment_cycles           = 0
    segment_cycle_counter_en = False
    clip_errors_disabled     = True
    lo_gain_errors_disabled  = True
    errors                   = False
clock = 
    clkgen_src             = system
    clkgen_freq            = 7370129.87012987
    adc_mul                = 4
    adc_freq               = 29480519.48051948
    freq_ctr               = 0
    freq_ctr_src           = extclk
    clkgen_locked          = True
    adc_phase              = 0
    extclk_monitor_enabled = False
    extclk_error           = False
    extclk_tolerance       = 19629383676.79548
trigger = 
    sequencer_enabled = False
    module            = basic
    triggers          = tio4
io = 
    tio1            = serial_rx
    tio2            = serial_tx
    tio3            = high_z
    tio4            = high_z
    pdid            = high_z
    pdic            = high
    nrst            = high_z
    glitch_hp       = False
    glitch_lp       = False
    extclk_src      = hs1
    hs2             = glitch
    target_pwr      = True
    tio_states      = (1, 1, 1, 0)
    cdc_settings    = bytearray(b'\x00\x00\x00\x00')
    aux_io_mcx      = high_z
    glitch_trig_mcx = trigger
glitch = 
    enabled           = True
    num_glitches      = 1
    clk_src           = pll
    mmcm_locked       = True
    width             = 0
    offset            = 0
    trigger_src       = ext_single
    arm_timing        = before_scope
    ext_offset        = 0
    repeat            = 1
    output            = clock_xor
    phase_shift_steps = 4592
SAD = 
    threshold            = 0
    reference            = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]
    sad_reference_length = 192
    half_pattern         = False
    multiple_triggers    = False
    num_triggers_seen    = 0
    always_armed         = False
ADS4128 = 
    mode      = normal
    low_speed = True
    hi_perf   = 2
LA = 
    present                  = True
    enabled                  = False
    clkgen_enabled           = False
    locked                   = False
    clk_source               = pll
    trigger_source           = glitch
    oversampling_factor      = 1
    sampling_clock_frequency = 0.0
    downsample               = 1
    capture_group            = glitch
    capture_depth            = 0
trace = 
    present      = True
    enabled      = False
    errors       = False
    trace_synced = False
    trace_mode   = parallel
    trace_width  = 4
    clock = 
        fe_clock_alive   = True
        fe_clock_src     = usb_clock
        clkgen_enabled   = False
        fe_freq          = 96000000.0
        swo_clock_locked = False
        swo_clock_freq   = 0.0
    capture = 
        trigger_source         = firmware trigger
        use_husky_arm          = False
        raw                    = True
        rules_enabled          = []
        rules                  = []
        mode                   = while_trig
        count                  = 0
        max_triggers           = 1
        triggers_generated     = 1
        record_syncs           = False
        matched_pattern_data   = 0000000000000000
        matched_pattern_counts = [0, 0, 0, 0, 0, 0, 0, 0]
XADC = 
    status                               = good
    current temperature [C]              = 50.9
    maximum temperature [C]              = 52.9
    user temperature alarm trigger [C]   = 80.0
    user temperature reset trigger [C]   = 59.9
    device temperature alarm trigger [C] = 84.9
    device temperature reset trigger [C] = 59.9
    vccint                               = 0.996
    vccaux                               = 1.805
    vccbram                              = 0.998
userio = 
    mode            = normal
    direction       = 0
    drive_data      = 0
    status          = 511
    Individual pins = 
        pin D0 = Target-driven, value = 1
        pin D1 = Target-driven, value = 1
        pin D2 = Target-driven, value = 1
        pin D3 = Target-driven, value = 1
        pin D4 = Target-driven, value = 1
        pin D5 = Target-driven, value = 1
        pin D6 = Target-driven, value = 1
        pin D7 = Target-driven, value = 1
        pin CK = Target-driven, value = 1
LEDs = 
    setting = 0 (default, as labelled)
errors = 
    sam_errors      = False
    sam_led_setting = Default
    XADC errors     = False
    ADC errors      = False
    extclk error    = False
    trace errors    = False

Thanks,
Amy

2

No this is normal, by design. There has to be some latency. What’s critically important is that the latency is constant (and it is).

If you need the glitch to happen earlier, then you’ll have to move the trigger earlier. I understand that in some scenarios this can be difficult, but Husky has a really rich set of options for triggering (see the Husky triggers and trigger sequencer notebooks).

Another option, if you have control over the target design, is to simply add some idle cycles after the trigger line is raised.

3

Thank you very much for your reply. I’m going to try both options and update the topic.

Amy