Husky Trigger Timeout

idkwhatimdoing · July 22, 2024, 1:39pm

I’ll preface this by saying I am new to ChipWhisperer and to side channel analysis in general. I have ChipWhisperer V5.7.0 installed and am trying to run the 02 - Husky Triggers demo using a CW Husky and the included SAM4S target board. I have been having problems with getting meaningful trigger data or getting triggers to work at all. Looking on GitHub, I see that “ADC triggering doesn’t work very well on the SAM4S target,” as seen here. I believe this may be why the trigger data I WAS getting (when working) was meaningless, as I was attempting to use ADC triggering. However, when trying to use UART triggering, I get the following error when trying to use the tio1 trigger:

(ChipWhisperer Scope WARNING|File _OpenADCInterface.py:642) Timeout in OpenADC capture(), no trigger seen! Trigger forced, data is invalid. Status: 13
(ChipWhisperer Scope WARNING|File _OpenADCInterface.py:642) Timeout in OpenADC capture(), no trigger seen! Trigger forced, data is invalid. Status: 12
(ChipWhisperer Scope WARNING|File __init__.py:504) Timeout happened during capture

I am getting this same error when attempting to go through Lab 2_1B - Power Analysis for Password Bypass when cap_pass_trace("h\n") is called. I have tried adding a delay before the scope is armed, as suggested in this forum post, but that did not work.

I am having similar problems when trying to run Fault2_1 - Introduction to Voltage Glitching.

My end goal is to successfully glitch the included iCE40UP5K FPGA target board, but I get the same issues as described above when attempting to set up and glitch that board.

Any and all help is appreciated, as I have been banging my head against the wall trying to solve this issue for a good while now. Thank you!

ic3_2k · July 22, 2024, 1:53pm

I’m facing the exact same issue, I tested with STM32L5, SM32F0 and the SAM4S failing with all three to get a valid capture because of the ** ```Timeout in OpenADC capture(), no trigger seen!

The only difference I notice is that it gives that timeout error when I use a jupyter notebook in which simpleserial is not used.

Alex_Dewar · July 22, 2024, 3:29pm

What sort of conditions are you looking to trigger off of? When you’re using the ADC trigger, is the target doing an sort of operation where you expect to see a spike in current? I’d recommend capturing a very long trace using streaming mode so you can get an idea of what your power trace looks like. We do something similar showcasing the streaming mode and SAD trigger of the CW Pro: chipwhisperer-jupyter/demos/CW-Pro Using SAD (Analog Pattern) Trigger - Attacking AES.ipynb at master · newaetech/chipwhisperer-jupyter · GitHub. That demo isn’t saying that the ADC trigger doesn’t work well on the SAM4S target, but more specifically that the STM target typically has a large power spike when AES starts, which makes it easy to trigger off of. The SAM4S doesn’t have this large power spike before AES.

For the UART trigger, again, what conditions do you want to trigger off of? Are you triggering off of the receive or transmit pins? What character are you trying to trigger off of?

idkwhatimdoing · July 22, 2024, 5:47pm

Alex, thanks for your quick reply.

I am attempting to trigger off of a logic level or edge; that is, I’m using scope.trigger.module = 'basic'. When attempting to capture a long trace using streaming mode, I get the same timeout error when I call cw.capture_trace().

For the UART trigger, I am trying to trigger off of two things: the p that I am sending and the r that I am receiving.

Alex_Dewar · July 22, 2024, 7:46pm

I’d recommend just using the the basic trigger for now since it’s a lot simpler than the UART trigger. The ADC level trigger is different in that it trigger based on voltage level, much like a normal oscilloscope trigger.

For now, can you post the output of print(scope) before trying to communicate with the target so that I can see what your scope settings are?

idkwhatimdoing · July 23, 2024, 12:23pm

Okay, sounds good. Sure, it is as follows:

cwhusky Device
sn             = a number
fpga_buildtime = a date and time
fw_version = 
    major = 1
    minor = 4
    debug = 0
gain = 
    mode = low
    gain = 59
    db   = 12.064220183486238
adc = 
    state                    = False
    basic_mode               = rising_edge
    timeout                  = 2
    offset                   = 0
    presamples               = 10000
    samples                  = 50000
    decimate                 = 1
    trig_count               = 132089428
    stream_mode              = False
    test_mode                = False
    bits_per_sample          = 12
    segments                 = 1
    segment_cycles           = 0
    segment_cycle_counter_en = False
    clip_errors_disabled     = False
    lo_gain_errors_disabled  = False
    errors                   = False
clock = 
    clkgen_src             = system
    clkgen_freq            = 7370129.87012987
    adc_mul                = 4
    adc_freq               = 29480519.48051948
    freq_ctr               = 0
    clkgen_locked          = True
    adc_phase              = 0
    extclk_monitor_enabled = False
    extclk_error           = False
    extclk_tolerance       = 102.996826171875
trigger = 
    module   = basic
    triggers = tio4
io = 
    tio1            = serial_rx
    tio2            = serial_tx
    tio3            = high_z
    tio4            = high_z
    pdid            = high_z
    pdic            = high_z
    nrst            = high_z
    glitch_hp       = False
    glitch_lp       = False
    extclk_src      = hs1
    hs2             = clkgen
    target_pwr      = True
    tio_states      = (1, 1, 1, 0)
    cdc_settings    = bytearray(b'\x00\x00\x00\x00')
    aux_io_mcx      = high_z
    glitch_trig_mcx = trigger
glitch = 
    enabled           = False
    mmcm_locked       = False
    num_glitches      = 1
    clk_src           = target
    width             = 0
    offset            = 0
    trigger_src       = manual
    arm_timing        = after_scope
    ext_offset        = 0
    repeat            = 1
    output            = clock_xor
    phase_shift_steps = 4592
ADS4128 = 
    mode      = normal
    low_speed = True
    hi_perf   = 2
LA = 
    present                  = True
    enabled                  = False
    clkgen_enabled           = False
    locked                   = False
    clk_source               = pll
    trigger_source           = glitch
    oversampling_factor      = 1
    sampling_clock_frequency = 0.0
    downsample               = 1
    capture_group            = glitch
    capture_depth            = 0
trace = 
    present      = True
    enabled      = False
    errors       = False
    trace_synced = False
    trace_mode   = parallel
    trace_width  = 4
    clock = 
        fe_clock_alive   = True
        fe_clock_src     = target_clock
        clkgen_enabled   = False
        fe_freq          = 7370246.887207031
        swo_clock_locked = False
        swo_clock_freq   = 0.0
    capture = 
        trigger_source         = firmware trigger
        use_husky_arm          = False
        raw                    = True
        rules_enabled          = []
        rules                  = []
        mode                   = while_trig
        count                  = 0
        max_triggers           = 1
        triggers_generated     = 1
        record_syncs           = False
        matched_pattern_data   = 0000000000000000
        matched_pattern_counts = [0, 0, 0, 0, 0, 0, 0, 0]
XADC = 
    status                               = VCCaux alarm, 
    current temperature [C]              = 32.1
    maximum temperature [C]              = 34.1
    user temperature alarm trigger [C]   = 80.0
    user temperature reset trigger [C]   = 59.9
    device temperature alarm trigger [C] = 89.9
    device temperature reset trigger [C] = 59.9
    vccint                               = 0.997
    vccaux                               = 1.788
    vccbram                              = 0.999
userio = 
    mode       = normal
    direction  = 0
    drive_data = 0
    status     = 511
LEDs = 
    setting = 0 (default, as labelled)
errors = 
    XADC errors  = VCCaux alarm, 
    ADC errors   = False
    extclk error = False
    trace errors = False

EDIT: In case it’s worth noting, I’ve tried triggers tio1 through tio4 and get similar errors for all of them.

Alex_Dewar · July 24, 2024, 3:16am

Power, clock, and IO should be okay there, though your presample and sample settings are different than in lab, though that shouldn’t make a difference. If you press the reset button on the CW313, wait a second, then run print(target.read()), do you get anything back?

idkwhatimdoing · July 24, 2024, 12:29pm

No, that doesn’t give me any output. I’m calling it in the same location that I previously called print(scope); is that correct?

Alex_Dewar · July 24, 2024, 4:45pm

My guess is either that your target isn’t running, or you’ve got some serial mismatch. Are you running the code from chipwhisperer-jupyter/courses/sca101/Lab 2_1B - Power Analysis for Password Bypass (HARDWARE).ipynb at master · newaetech/chipwhisperer-jupyter · GitHub without modifications (except for setting SCOPETYPE, PLATFORM, etc.)?

idkwhatimdoing · July 24, 2024, 5:26pm

Yes, save for the cell that builds the firmware. I edited it to use cmd instead of bash so that it would successfully build on my machine:

%%cmd -s "$PLATFORM" "$SS_VER"
cd ../../../hardware/victims/firmware/basic-passwdcheck
make PLATFORM=CWHUSKY CRYPTO_TARGET=NONE SS_VER=SS_VER_2_1 -j

I have SCOPETYPE = 'OPENADC'

Alex_Dewar · July 24, 2024, 5:29pm

What the result of print(target.baud)? It should be 230400 for simpleserial v2.

idkwhatimdoing · July 24, 2024, 5:34pm

Output is correct: 230400

Alex_Dewar · July 24, 2024, 8:16pm

Can you try setting trigger_high() on boot? You should see scope.adc.state and tio_states[3] be set to 1 after boot.

ic3_2k · July 27, 2024, 7:33pm

Hi!

As I have the exact same problem want to add some data from test I’m doing…
Moved as you requested trigger_high to the start of the target’s firmware, of course after the trigger setup call
Attached the logic analyzer to the header on the CW313 and we can se the trigger in GPIO4

But the error on the notebook says the opposite

This is my print(scope) result as I’m in the noebook Lab 2_1B - Power Analysis for Password Bypass i have different baudrate than idkwhatimdoing

cwhusky Device
sn             = 502032204c5846303130323136303030
fpga_buildtime = 4/11/2024, 09:41
fw_version = 
    major = 1
    minor = 5
    debug = 0
gain = 
    mode = high
    gain = 13
    db   = 20.96330275229358
adc = 
    state                    = True
    basic_mode               = rising_edge
    timeout                  = 2
    offset                   = 0
    presamples               = 0
    samples                  = 3000
    decimate                 = 1
    trig_count               = 254468140
    stream_mode              = False
    test_mode                = False
    bits_per_sample          = 12
    segments                 = 1
    segment_cycles           = 0
    segment_cycle_counter_en = False
    clip_errors_disabled     = False
    lo_gain_errors_disabled  = False
    errors                   = ADC clipped, 
clock = 
    clkgen_src             = system
    clkgen_freq            = 7370129.87012987
    adc_mul                = 4
    adc_freq               = 29480519.48051948
    freq_ctr               = 0
    freq_ctr_src           = extclk
    clkgen_locked          = True
    adc_phase              = 0
    extclk_monitor_enabled = False
    extclk_error           = False
    extclk_tolerance       = 2570806145248.343
trigger = 
    sequencer_enabled = False
    module            = basic
    triggers          = tio4
io = 
    tio1            = serial_rx
    tio2            = serial_tx
    tio3            = high_z
    tio4            = high_z
    pdid            = high_z
    pdic            = high_z
    nrst            = high_z
    glitch_hp       = False
    glitch_lp       = False
    extclk_src      = hs1
    hs2             = clkgen
    target_pwr      = True
    tio_states      = (1, 1, 0, 1)
    cdc_settings    = bytearray(b'\x00\x00\x00\x00')
    aux_io_mcx      = high_z
    glitch_trig_mcx = trigger
glitch = 
    enabled           = False
    num_glitches      = 1
    clk_src           = target
    mmcm_locked       = False
    width             = 0
    offset            = 0
    trigger_src       = manual
    arm_timing        = after_scope
    ext_offset        = 0
    repeat            = 1
    output            = clock_xor
    phase_shift_steps = 4592
SAD = 
    threshold            = 0
    reference            = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]
    sad_reference_length = 192
    half_pattern         = False
    multiple_triggers    = False
    num_triggers_seen    = 0
    always_armed         = False
ADS4128 = 
    mode      = normal
    low_speed = True
    hi_perf   = 2
LA = 
    present                  = True
    enabled                  = False
    clkgen_enabled           = False
    locked                   = False
    clk_source               = pll
    trigger_source           = glitch
    oversampling_factor      = 1
    sampling_clock_frequency = 0.0
    downsample               = 1
    capture_group            = glitch
    capture_depth            = 0
trace = 
    present      = True
    enabled      = False
    errors       = False
    trace_synced = False
    trace_mode   = parallel
    trace_width  = 4
    clock = 
        fe_clock_alive   = True
        fe_clock_src     = usb_clock
        clkgen_enabled   = False
        fe_freq          = 96000000.0
        swo_clock_locked = False
        swo_clock_freq   = 0.0
    capture = 
        trigger_source         = firmware trigger
        use_husky_arm          = False
        raw                    = True
        rules_enabled          = []
        rules                  = []
        mode                   = while_trig
        count                  = 0
        max_triggers           = 1
        triggers_generated     = 1
        record_syncs           = False
        matched_pattern_data   = 0000000000000000
        matched_pattern_counts = [0, 0, 0, 0, 0, 0, 0, 0]
XADC = 
    status                               = good
    current temperature [C]              = 55.0
    maximum temperature [C]              = 56.4
    user temperature alarm trigger [C]   = 80.0
    user temperature reset trigger [C]   = 59.9
    device temperature alarm trigger [C] = 84.9
    device temperature reset trigger [C] = 59.9
    vccint                               = 1.001
    vccaux                               = 1.796
    vccbram                              = 1.000
userio = 
    mode            = normal
    direction       = 0
    drive_data      = 0
    status          = 511
    Individual pins = 
        pin D0 = Target-driven, value = 1
        pin D1 = Target-driven, value = 1
        pin D2 = Target-driven, value = 1
        pin D3 = Target-driven, value = 1
        pin D4 = Target-driven, value = 1
        pin D5 = Target-driven, value = 1
        pin D6 = Target-driven, value = 1
        pin D7 = Target-driven, value = 1
        pin CK = Target-driven, value = 1
LEDs = 
    setting = 0 (default, as labelled)
errors = 
    sam_errors      = False
    sam_led_setting = Default
    XADC errors     = False
    ADC errors      = ADC clipped, 
    extclk error    = False
    trace errors    = False

38400
(ChipWhisperer Scope WARNING|File _OpenADCInterface.py:730) Timeout in OpenADC capture(), no trigger seen! Trigger forced, data is invalid. Status: 17
(ChipWhisperer Scope WARNING|File _OpenADCInterface.py:730) Timeout in OpenADC capture(), no trigger seen! Trigger forced, data is invalid. Status: 16
Timeout happened during acquisition
✔️ OK to continue!

Alex_Dewar · July 29, 2024, 5:22am

Oh, adding a trigger high call to the beginning of the boot process is mostly just to check that the target board is running. You’ll need to remove that to have the lab work as normal.

idkwhatimdoing · July 29, 2024, 12:31pm

Apologies for the delayed response. After calling trigger_high() on boot, scope.adc.state and tio_states[1] are both successfully set to 1.