Trigger error in Lab_2_1

Embedded Security
#1

I am trying to run the Lab_2_1 using a chipwhisperer Husky and a CW308 board with the STM32F target. My objective is to capture the RSA using the mbedtls library.

However when i get to the following cell:

import time
target.flush()
scope.arm()
target.simpleserial_write("t", bytearray([]))
    
ret = scope.capture()
if ret:
    print('Timeout happened during acquisition')
    
time.sleep(2)
if SS_VER=='SS_VER_2_1':
    output = target.simpleserial_read_witherrors('r', 128, timeout=10)
else:
    output = target.simpleserial_read_witherrors('r', 48, timeout=10)

I obtain the following error:

(ChipWhisperer Scope WARNING|File _OpenADCInterface.py:640) Timeout in OpenADC capture(), no trigger seen! Trigger forced, data is invalid. Status: 13 (ChipWhisperer Scope WARNING|File _OpenADCInterface.py:640) Timeout in OpenADC capture(), no trigger seen! Trigger forced, data is invalid. Status: 92 Timeout happened during acquisition

I don’t understand why, this happens or what should I modify in order to trigger correctly the operation. Any help will be appreciated.

Thanks in advance!

#2

Thanks for the report! This is not a Husky issue. The warning you see indicates that the target is not setting the trigger signal high. I see the same behaviour-- turns out the target is stuck in a hard fault, and that this commit is the culprit. We’ll sort out why this isn’t working as intended, but for now if you roll back that file you should be able to continue the lab.
Jean-Pierre

1 Like
#3

Thanks JP for the rapid response!

I rollback the file by using git checkout c73f434~1 -- hardware/victims/firmware/simpleserial-rsa/simpleserial-rsa-arm.c.

However the issue remains.
I have attached here the folder simpleserial-rsa and the current state of the notebook. Maybe you can find out whats wrong.

simpleserial-rsa+notebook.zip (1.1 MB)

#4

Hmm, there seems to be a problem when using SS_VER_1_1. If you change it to SS_VER_2_1 it should work. Also, in the notebook cell where you get the timeout, change:
if SS_VER=='SS_VER_2_0:

to:
if SS_VER=='SS_VER_2_1':

#5

I forgot to mention that I have already tried that and still get the trigger error.
n fact I left it as SS_VER_1_1, in order to minimize the changes in the notebook.

#6

Hmm strange… maybe try resetting the target after programming. Here’s my 2_1 binary:
hex.zip (25.2 KB)

#7

I tried with your binary and resetting the target after programming and I get the same error…

Maybe something with the connections? I only have the 20 pin connector, the measurement and the USB connected.

image
image1588Ă—893 261 KB

#8

Have you had success with this target on other labs? The red LED2 and LED3 (to the bottom right of the target) should be on. Try resetting the target by pushing the black nRST button. Finally, try a scope.default_setup().

#9
  1. I have completed all sca101 coursers with this target.
  2. LED 2 and LED3 are on.
  3. Tried resetting the target and scope.default_setup() didn’t work.
  4. Tried also with your .hex and no results.

image
image1403Ă—610 30.8 KB

#10

What’s cw.__version__, and what’s the output of print(scope)?

#11

cw.version

'5.6.1'

print(scope)

cwhusky Device
sn             = 50203120374a38503330343137303034
fpga_buildtime = 5/26/2022, 17:56
fw_version = 
    major = 1
    minor = 10
    debug = 0
gain = 
    mode = high
    gain = 22
    db   = 25.091743119266056
adc = 
    state                    = False
    basic_mode               = rising_edge
    timeout                  = 2
    offset                   = 0
    presamples               = 0
    samples                  = 5000
    decimate                 = 1
    trig_count               = 1081750417
    stream_mode              = False
    test_mode                = False
    bits_per_sample          = 12
    segments                 = 1
    segment_cycles           = 0
    segment_cycle_counter_en = False
    clip_errors_disabled     = False
    lo_gain_errors_disabled  = False
    errors                   = False
clock = 
    clkgen_src             = system
    clkgen_freq            = 7370129.87012987
    adc_mul                = 4
    adc_freq               = 29480519.48051948
    freq_ctr               = 57
    clkgen_locked          = True
    adc_phase              = 0
    extclk_monitor_enabled = False
    extclk_error           = False
    extclk_tolerance       = 102.996826171875
trigger = 
    module   = basic
    triggers = tio4
io = 
    tio1         = serial_rx
    tio2         = serial_tx
    tio3         = high_z
    tio4         = high_z
    pdid         = high_z
    pdic         = high_z
    nrst         = high_z
    glitch_hp    = False
    glitch_lp    = False
    extclk_src   = hs1
    hs2          = clkgen
    target_pwr   = True
    tio_states   = (1, 1, 1, 0)
    cdc_settings = bytearray(b'\x00\x00\x00\x00')
glitch = 
    enabled           = False
    mmcm_locked       = False
    num_glitches      = 1
    clk_src           = target
    width             = 0
    offset            = 0
    trigger_src       = manual
    arm_timing        = after_scope
    ext_offset        = 0
    repeat            = 1
    output            = clock_xor
    phase_shift_steps = 4592
ADS4128 = 
    mode      = normal
    low_speed = True
    hi_perf   = 2
LA = 
    present                  = True
    enabled                  = False
    clkgen_enabled           = False
    locked                   = False
    clk_source               = pll
    trigger_source           = glitch
    oversampling_factor      = 1
    sampling_clock_frequency = 0.0
    downsample               = 1
    capture_group            = glitch
    capture_depth            = 0
trace = 
    present      = True
    enabled      = False
    errors       = False
    trace_synced = False
    trace_mode   = parallel
    trace_width  = 4
    clock = 
        fe_clock_alive   = True
        fe_clock_src     = target_clock
        clkgen_enabled   = False
        fe_freq          = 7370281.219482422
        swo_clock_locked = False
        swo_clock_freq   = 0.0
    capture = 
        trigger_source         = trace trigger, rule #0
        use_husky_arm          = False
        raw                    = True
        rules_enabled          = []
        rules                  = []
        mode                   = while_trig
        count                  = 0
        max_triggers           = 1
        triggers_generated     = 0
        record_syncs           = False
        matched_pattern_data   = 0000000000000000
        matched_pattern_counts = [0, 0, 0, 0, 0, 0, 0, 0]
XADC = 
    status                               = good
    current temperature [C]              = 38.6
    maximum temperature [C]              = 40.2
    user temperature alarm trigger [C]   = 80.0
    user temperature reset trigger [C]   = 59.9
    device temperature alarm trigger [C] = 89.9
    device temperature reset trigger [C] = 59.9
    vccint                               = 1.003
    vccaux                               = 1.793
    vccbram                              = 1.002
userio = 
    mode       = normal
    direction  = 0
    drive_data = 0
    status     = 511
LEDs = 
    setting = 0 (default, as labelled)
errors = 
    XADC errors  = False
    ADC errors   = False
    extclk error = False
    trace errors = False

print(scope) after error:

cwhusky Device
sn             = 50203120374a38503330343137303034
fpga_buildtime = 5/26/2022, 17:56
fw_version = 
    major = 1
    minor = 10
    debug = 0
gain = 
    mode = high
    gain = 22
    db   = 25.091743119266056
adc = 
    state                    = False
    basic_mode               = rising_edge
    timeout                  = 2
    offset                   = 0
    presamples               = 0
    samples                  = 5000
    decimate                 = 1
    trig_count               = 0
    stream_mode              = False
    test_mode                = False
    bits_per_sample          = 12
    segments                 = 1
    segment_cycles           = 0
    segment_cycle_counter_en = False
    clip_errors_disabled     = False
    lo_gain_errors_disabled  = False
    errors                   = gain too low error, 
clock = 
    clkgen_src             = system
    clkgen_freq            = 7370129.87012987
    adc_mul                = 4
    adc_freq               = 29480519.48051948
    freq_ctr               = 57
    clkgen_locked          = True
    adc_phase              = 0
    extclk_monitor_enabled = False
    extclk_error           = False
    extclk_tolerance       = 102.996826171875
trigger = 
    module   = basic
    triggers = tio4
io = 
    tio1         = serial_rx
    tio2         = serial_tx
    tio3         = high_z
    tio4         = high_z
    pdid         = high_z
    pdic         = high_z
    nrst         = high_z
    glitch_hp    = False
    glitch_lp    = False
    extclk_src   = hs1
    hs2          = clkgen
    target_pwr   = True
    tio_states   = (1, 1, 1, 0)
    cdc_settings = bytearray(b'\x00\x00\x00\x00')
glitch = 
    enabled           = False
    mmcm_locked       = False
    num_glitches      = 1
    clk_src           = target
    width             = 0
    offset            = 0
    trigger_src       = manual
    arm_timing        = after_scope
    ext_offset        = 0
    repeat            = 1
    output            = clock_xor
    phase_shift_steps = 4592
ADS4128 = 
    mode      = normal
    low_speed = True
    hi_perf   = 2
LA = 
    present                  = True
    enabled                  = False
    clkgen_enabled           = False
    locked                   = False
    clk_source               = pll
    trigger_source           = glitch
    oversampling_factor      = 1
    sampling_clock_frequency = 0.0
    downsample               = 1
    capture_group            = glitch
    capture_depth            = 0
trace = 
    present      = True
    enabled      = False
    errors       = False
    trace_synced = False
    trace_mode   = parallel
    trace_width  = 4
    clock = 
        fe_clock_alive   = True
        fe_clock_src     = target_clock
        clkgen_enabled   = False
        fe_freq          = 7370281.219482422
        swo_clock_locked = False
        swo_clock_freq   = 0.0
    capture = 
        trigger_source         = trace trigger, rule #0
        use_husky_arm          = False
        raw                    = True
        rules_enabled          = []
        rules                  = []
        mode                   = while_trig
        count                  = 0
        max_triggers           = 1
        triggers_generated     = 0
        record_syncs           = False
        matched_pattern_data   = 0000000000000000
        matched_pattern_counts = [0, 0, 0, 0, 0, 0, 0, 0]
XADC = 
    status                               = good
    current temperature [C]              = 47.6
    maximum temperature [C]              = 49.5
    user temperature alarm trigger [C]   = 80.0
    user temperature reset trigger [C]   = 59.9
    device temperature alarm trigger [C] = 89.9
    device temperature reset trigger [C] = 59.9
    vccint                               = 1.002
    vccaux                               = 1.792
    vccbram                              = 1.001
userio = 
    mode       = normal
    direction  = 0
    drive_data = 0
    status     = 511
LEDs = 
    setting = 0 (default, as labelled)
errors = 
    XADC errors  = False
    ADC errors   = gain too low error, 
    extclk error = False
    trace errors = False
#12

All good there. I ran more experiments and it looks like what’s happening here is that the target is sensitive to getting its clock disturbed by the scope.clock.adc_src = "clkgen_x1" call. The solution is to reset the target after changing the clock setting:

image
image949Ă—446 51.4 KB

#13

That worked!!! :smiley:

Thank you very much!

1 Like