Scope API

The scope object is used to control the capture/glitch portion of the ChipWhisperer device.

The easiest way to create a scope object is via the chipwhisperer.scope() function, which will connect to a ChipWhisperer device and return a scope object of the correct type:

import chipwhisperer as cw
scope = cw.scope()

There are currently two types of scopes:

These scope objects also inherit common methods from Common Scope Attributes

scope(scope_type=None, name=None, sn=None, idProduct=None, bitstream=None, force=False, prog_speed=10000000, **kwargs) chipwhisperer.scope()

Create a scope object and connect to it.

This function allows any type of scope to be created. By default, the object created is based on the attached hardware (OpenADC for CWLite/CW1200, CWNano for CWNano).

Scope Types:

If multiple chipwhisperers are connected, the serial number of the one you want to connect to can be specified by passing sn=<SERIAL_NUMBER>

Parameters:

  • scope_type (Optional[Type[Union[OpenADC, CWNano]]]) – Scope type to connect to. Types can be found in chipwhisperer.scopes. If None, will try to detect the type of ChipWhisperer connected. Defaults to None.

  • name (Optional[str]) –

    model name of the ChipWhisperer that you want to connect to. Alternative to specifying the serial number when multiple ChipWhisperers, all of different type, are connected. Defaults to None. Valid values:

    • Lite

    • Pro

    • Husky

  • idProduct (Optional[int]) –

    idProduct of the ChipWhisperer that you want to connect to. Alternative to specifying the serial number when multiple ChipWhisperers, all of different type, are connected. Defaults to None. Valid values:

    • 0xace2: CW-Lite

    • 0xace3: CW-Pro

    • 0xace5: CW-Husky

  • sn (Optional[str]) – Serial number of ChipWhisperer that you want to connect to. sn is required if more than one ChipWhisperer of the same type is connected (i.e. two CWNano’s or a CWLite and CWPro). Defaults to None.

  • bitstream (Optional[str]) – Path to bitstream to program. If None, programs default bitstream. Optional, defaults to None. Ignored on Nano.

  • force (bool) – If True, always erase and program FPGA. If False, only erase and program FPGA if it is currently blank. Defaults to False. Ignored on Nano.

  • prog_speed (int) – Sets the FPGA programming speed for Lite, Pro, and Husky. If you get programming errors, try turning this down.

Return type:

Union[OpenADC, CWNano]

Returns:

Connected scope object.

Raises:

  • OSError – Can be raised for issues connecting to the chipwhisperer, such as not having permission to access the USB device or no ChipWhisperer being connected.

  • Warning – Raised if multiple chipwhisperers are connected, but the type and/or the serial numbers are not specified

Changed in version 5.1: Added autodetection of scope_type

Changed in version 5.5: Added idProduct, name, bitstream, and force parameters.

As of ChipWhisperer 5.6.2, ChipWhisperer can find all connected devices:

list_devices(idProduct=None, get_sn=True, get_hw_loc=True) chipwhisperer.list_devices()

Get a list of devices by NewAE (VID 0x2b3e) currently connected

Parameters:

  • idProduct (Optional[List[int]], optional) – List of PIDs to restrict devices to. If None, do not restrict. Defaults to None.

  • get_sn (bool, optional) – Whether or not to try to access serial number. Can fail if another process is connected or if we don’t have permission to access the device. Defaults to True.

  • get_hw_loc (bool, optional) – Whether or not to access the hardware location of the device. Can fail due to the same reasons as above. Defaults to True.

Returns:

A list of dicts with fields {‘name’: str, ‘sn’, str, ‘hw_loc’: (int, int)}

Return type:

List[dict]

If an unknown NewAE device is connected, ‘name’ will be ‘unknown’. If ‘sn’ or ‘hw_loc’ are not desired, or cannot be accessed, they will be None.

New in version 5.6.2.

OpenADC Scope

Supported scopes:

Usage examples:

class OpenADC
DEFAULT_ADC_MUL = 4

OpenADC scope object.

This class contains the public API for the OpenADC hardware, including the ChipWhisperer Lite/ CW1200 Pro boards. It includes specific settings for each of these devices.

To connect to one of these devices, the easiest method is:

import chipwhisperer as cw
scope = cw.scope(scope_type=cw.scopes.OpenADC)

Some sane default settings are available via:

scope.default_setup()

This code will automatically detect an attached ChipWhisperer device and connect to it.

For more help about scope settings, try help() on each of the ChipWhisperer scope submodules (scope.gain, scope.adc, scope.clock, scope.io, scope.trigger, and scope.glitch):

If you have a CW1200 ChipWhisperer Pro/Husky, you have access to some additional features:

Inherits from chipwhisperer.capture.api.cwcommon.ChipWhispererCommonInterface

arm()

Setup scope to begin capture/glitching when triggered.

The scope must be armed before capture or glitching (when set to ‘ext_single’) can begin.

Raises:

  • OSError – Scope isn’t connected.

  • Exception – Error when arming. This method catches these and disconnects before reraising them.

capture(poll_done=False)

Captures trace. Scope must be armed before capturing.

Blocks until scope triggered (or times out), then disarms scope and copies data back.

Read captured data out with scope.get_last_trace()

Parameters:

poll_done (bool) – Supported by Husky only. Poll Husky to find out when it’s done capturing, instead of calculating the capture time based on the capture parameters. Can result in slightly faster captures when the number of samples is high. Defaults to False.

Return type:

bool

Returns:

True if capture timed out, false if it didn’t.

Raises:

IOError – Unknown failure.

Changed in version 5.6.1: Added poll_done parameter for Husky

capture_segmented()

Captures trace in segment mode, returns as many segments as buffer holds.

Timeouts not handled yet properly (function will lock). Be sure you are generating enough triggers for segmented mode.

Returns:

True if capture timed out, false if it didn’t.

Raises:

IOError – Unknown failure.

New in version 5.5: Added segmented capture (requires custom bitstream)

cglitch_setup(default_setup=True)

Sets up sane defaults for clock glitching

  • glitch clk_src = clkgen

  • output = clock_xor

  • trigger_src = ext_single

  • hs2 = glitch

  • LP and HP glitch disabled

con(sn=None, idProduct=None, bitstream=None, force=False, prog_speed=10000000.0, **kwargs)

Connects to attached chipwhisperer hardware (Lite, Pro, or Husky)

Parameters:

  • sn (str) – The serial number of the attached device. Does not need to be specified unless there are multiple devices attached.

  • idProduct (int) – The product ID of the ChipWhisperer. If None, autodetects product ID. Optional.

  • bitstream (str) – Path to bitstream to program. If None, programs default bitstream. Optional.

  • force (bool) – Force reprogramming of bitstream. If False, only program bitstream if no bitstream is currently programmed. Optional.

Returns:

True if connection is successful, False otherwise

Changed in version 5.5: Added idProduct, bitstream, and force parameters.

default_setup(verbose=True)

Sets up sane capture defaults for this scope

  • 25dB gain

  • 5000 capture samples

  • 0 sample offset

  • rising edge trigger

  • 7.37MHz clock output on hs2

  • 4*7.37MHz ADC clock

  • tio1 = serial rx

  • tio2 = serial tx

  • tio4 = highZ

  • CDC settings change off

New in version 5.1: Added default setup for OpenADC

dis()

Disconnects the current scope object.

Returns:

True if the disconnection was successful, False otherwise.

property fpga_buildtime

When the FPGA bitfile was generated. Husky only.

get_last_trace(as_int=False)

Return the last trace captured with this scope.

Can return traces as floating point values (as_int=False) or as integers.

Floating point values are scaled and shifted to be between -0.5 and 0.5.

Integer values are raw readings from the ChipWhisperer ADC. The ChipWhisperer-Lite has a 10-bit ADC, the Nano has an 8-bit ADC, and the Husky can read either 8-bits or 12-bits of ADC data.

Parameters:

as_int (bool) – If False, return trace as a float. Otherwise, return as an int.

Return type:

ndarray

Returns:

Numpy array of the last capture trace.

Changed in version 5.6.1: Added as_int parameter

get_last_trace_segmented()

Return last trace assuming it was captued with segmented mode.

NOTE: The length of each returned trace is 1 less sample than requested.

Returns:

2-D numpy array of the last captured traces.

New in version 5.5: Added segmented capture (requires custom bitstream)

get_name()

Gets the name of the attached scope

Returns:

‘ChipWhisperer Lite’ if a Lite, ‘ChipWhisperer Pro’ if a Pro, ‘ChipWhisperer Husky’ if a Husky

glitch_disable()

Disables glitch and glitch outputs

reload_fpga(bitstream=None, reconnect=True, prog_speed=1000000.0)

(Re)loads a FPGA bitstream (even if already configured).

Will cause a reconnect event, all settings become default again. If no bitstream specified default is used based on current configuration settings.

Parameters:

  • bitstream (str or None) – Path to new bitstream file. Optional, defaults to None

  • reconnect (True) – Whether or not to reconnect to the scope

  • prog_speed (int) – Speed at which to program the FPGA

reset_fpga()

Reset Husky FPGA. This causes all FPGA-based settings to return to their default values.

scope_diff(scope_dict1, scope_dict2)

Reports differences between two sets of scope settings.

Parameters:

  • scope_dict1 – dictionaries of scope settings (obtained with scope._dict_repr())

  • scope_dict2 – dictionaries of scope settings (obtained with scope._dict_repr())

try_wait_clkgen_locked(count, delay=0)

Tries to wait for clkgen to lock.

Returns:

True if clkgen locked within the timeout, else False for a timeout.

vglitch_setup(glitcht, default_setup=True)

Sets up sane defaults for voltage glitch

  • glitch clk_src = clkgen

  • output = glitch_only

  • trigger_src = ext_single

  • hs2 = clkgen

  • LP glitch if glitcht = ‘lp’ or ‘both’

  • HP glitch if glitcht = ‘hp’ or ‘both’

scope.gain

Class to control ADC gain

class GainSettings(oaiface, adc)
property db: float

The gain of the ChipWhisperer’s low-noise amplifier in dB. Ranges from -6.5 dB to 56 dB, depending on the amplifier settings.

Getter:

Return the current gain in dB (float)

Setter:

Set the gain level in dB

Raises:

ValueError – if new gain is outside of [-6.5, 56]

Examples:

# reading and storing
gain_db = scope.gain.db

# setting
scope.gain.db = 20
Return type:

float

property gain: int

The current LNA gain setting.

This gain is a dimensionless number in the range [0, 78]. Higher value causes higher gain in dB.

Note that this function is unnecessary - the dB gain can be set directly. This property is only here to help convert old scripts.

Getter:

Return the current gain setting (int)

Setter:

Set the gain

Raises:

ValueError – if gain outside [0, 78]

Return type:

int

property mode: str

The current mode of the LNA.

The LNA can operate in two modes: low-gain or high-gain. Generally, the high-gain setting is better to use. Note that this value will be automatically updated if the dB gain is set.

Getter:

Return the current gain mode (“low” or “high”)

Setter:

Set the gain mode

Raises:

ValueError – if mode not one of “low” or “high”

Return type:

str

scope.adc

Class to control non-gain, non-clock ADC settings

class TriggerSettings(oaiface)
property basic_mode

The type of event to use as a trigger.

Only applies to the ADC capture - the glitch module is always a rising edge trigger.

There are four possible types of trigger events:

  • “low”: triggers when line is low (logic 0)

  • “high”: triggers when line is high (logic 1)

  • “rising_edge”: triggers when line transitions from low to high

  • “falling_edge:” triggers when line transitions from high to low

Warning

This must be set to “rising_edge” if a trigger other than “basic” is used. The SAD/DecodeIO triggers will not work with any other setting!

Getter:

Return the current trigger mode (one of the 4 above strings)

Setter:

Set the trigger mode

Raises:

ValueError – if value is not one of the allowed strings

clear_clip_errors()

ADC clipping errors are sticky until manually cleared by calling this.

property clip_errors_disabled

By default, ADC clipping is flagged as an error. Disable if you do not want this error notification.

property decimate

The ADC downsampling factor.

This value instructs the ChipWhisperer to only record 1 sample in every <decimate>. In other words, if this value is set to 10, the sampling rate is set to 1/10th of the sampling clock.

This setting is helpful for recording very long operations or for reducing the sampling rate for streaming mode.

Getter:

Return an integer with the current decimation factor

Setter:

Set the decimation factor

Raises:

ValueError – if the new factor is not positive

property fifo_fill_mode

The ADC buffer fill strategy - allows segmented usage for CW-lite and CW-pro.

Warning

THIS REQUIRES NEW FPGA BITSTREAM - NOT YET IN THE PYTHON.

Only the ‘Normal’ mode is well supported, the other modes can be used carefully.

For segmenting on CW-Husky, see ‘segments’ instead.

There are four possible modes:

  • “normal”: Trigger line & logic work as expected.

  • “enable”: Capture starts with rising edge, but writing samples

    is enabled by active-high state of trigger line.

  • “segment”: Capture starts with rising edge, and writes trigger.samples

    to buffer on each rising edge, stopping when the buffer is full. For this to work adc.samples must be a multiple of 3 (will be enforced by API).

Warning

The “enable” and “segment” modes requires you to fill the full buffer (~25K on CW-Lite, ~100K on CW-Pro). This requires you to ensure the physical trigger line will be high (enable mode) or toggle (segment mode) enough. The ChipWhisperer hardware will currently stall until the internal buffer is full, and future commands will fail.

Warning

adc.basic_mode must be set to “rising_edge” if a fill_mode other than “normal” is used. Bad things happen if not.

Getter:

Return the current fifo fill mode (one of the 3 above strings)

Setter:

Set the fifo fill mode

Raises:

ValueError – if value is not one of the allowed strings

property fifo_state

return the state of the Husky FIFO FSM.

Type:

Husky only, for debugging

property lo_gain_errors_disabled

By default, captures which use less than a quarter of the ADC’s dynamic range flag an error, to indicate that the gain should be increased. Disable if you do not want this error notification.

property offset

The number of samples to wait before recording data after seeing a trigger event.

This offset is useful for long operations. For instance, if an encryption is 1 million samples long, it’s difficult to capture the entire power trace, but an offset can be used to skip to the end of the encryption.

The offset must be a 32 bit unsigned integer.

Getter:

Return the current offset (integer)

Setter:

Set a new offset

Raises:

ValueError – if offset outside of range [0, 2**32)

property presamples

The number of samples to record from before the trigger event.

This setting must be a positive integer, and it cannot be larger than the number of samples. When streaming mode is enabled, this value is set to 0.

Getter:

Return the current number of presamples

Setter:

Set the number of presamples.

Raises:

ValueError – if presamples is outside of range [0, samples]

property samples

The number of ADC samples to record in a single capture.

The maximum number of samples is hardware-dependent: - cwlite: 24400 - cw1200: 96000 - cwhusky: 131070

Getter:

Return the current number of total samples (integer)

Setter:

Set the number of samples to capture

Raises:

ValueError – if number of samples is negative

property state

The current state of the trigger input.

This is a digital value (ie: high or low), which is some combination of the pins in the triggermux object. Read-only.

Getter: Return the current state (True or False).

property timeout

The number of seconds to wait before aborting a capture.

If no trigger event is detected before this time limit is up, the capture fails and no data is returned.

Getter:

Return the number of seconds before a timeout (float)

Setter:

Set the timeout in seconds

property trig_count

The number of samples that the trigger input was active.

This value indicates how long the trigger was high or low last time a trace was captured. It is the number of samples where the input was low (in “low” or “falling edge” modes) or high (in “high” or “rising edge” modes). Read-only.

This counter is not meaningful if the trigger is still active.

Getter:

Return the last trigger duration (integer)

scope.adc Pro/Husky Only

The following scope.adc members are only available on ChipWhisperer-Husky, ChipWhisperer-Pro, or both.

class TriggerSettings(oaiface)
property TriggerSettings.stream_mode

The ChipWhisperer’s streaming status. Only available on CW1200 and CW-Husky.

When stream mode is enabled, the ChipWhisperer sends back ADC data as soon as it is recorded. In this mode, there is no hardware limit on the maximum number of samples per trace (although Python may run out of memory when recording billions of points). However, there is a maximum streaming data rate, which is approximately 10 Msamp/s.

Note that no pre-trigger samples can be recorded when stream mode is enabled.

Getter:

Return True if stream mode is enabled and False otherwise

Setter:

Enable or disable stream mode

property TriggerSettings.segment_cycles

Number of clock cycles separating segments.

Warning

Supported by CW-Husky only. For segmenting on CW-lite or CW-pro, see ‘fifo_fill_mode’ instead.

This setting must be a 20-bit positive integer.

When ‘segments’ is greater than one, set segment_cycles to a non-zero value to capture a new segment every ‘segment_cycles’ clock cycles following the initial trigger event. ‘segment_cycle_counter_en’ must also be set.

Typically, segment_cycles should be much greater than scope.adc.samples. If they are too close, capture will fail (indicated by the blinking red lights and scope.adc.errors showing either a segmenting error or a FIFO over/underflow error). When presamples = 0, segment_cycles >= samples + 10. When presamples > 0, segment_cycles >= samples + presamples AND segment_cycles >= samples + 10.

Getter:

Return the current value of segment_cycles.

Setter:

Set segment_cycles.

Raises:

ValueError – if segments is outside of range [0, 2^20-1]

property TriggerSettings.segment_cycle_counter_en

Number of clock cycles separating segments.

Warning

Supported by CW-Husky only. For segmenting on CW-lite or CW-pro, see ‘fifo_fill_mode’ instead.

Set to 0 to capture a new power trace segment every time the target issues a trigger event.

Set to 1 to capture a new power trace segment every ‘segment_cycles’ clock cycles after a single trigger event.

Getter:

Return the current value of segment_cycle_counter_en.

Setter:

Set segment_cycles.

property TriggerSettings.first_error_state

Reports the state the FPGA FSM state at the time of the first flagged error. Useful for debugging. Read-only.

Warning

Supported by CW-Husky only.

Getter:

Return the error flags.

property TriggerSettings.errors

Internal error flags (FPGA FIFO over/underflow)

Warning

Supported by CW-Husky only.

Error types and their causes:
  • ‘presample error’: capture trigger occurs before the requested

    number of presamples have been collected. Reduce scope.adc.presamples or delay the capture trigger.

  • ‘ADC clipped’: gain is too high; reduce it (scope.gain) or disable

    this error (scope.adc.clip_errors_disabled).

  • ‘gain too low error’: gain is “too low” (4 bits or more of the ADC’s

    dynamic range did not get used); increase it (scope.gain) or disable this error (scope.adc.lo_gain_errors_disabled).

  • ‘invalid downsample setting’: using downsampling (aka decimating) with

    presamples and multiple segments is not allowed.

  • ‘segmenting error’: the condition for starting the capture of the next

    segment came true before the capture of the current segment completed. Reduce the segment size and/or increase the time between segments.

  • ‘fast FIFO underflow’: shouldn’t occur in isolation without

    other errors being flagged.

  • ‘fast FIFO overflow’: data is coming in fast than it’s being read;

    reduce scope.clock.adc_freq.

  • ‘slow FIFO underflow’: host tried to read more ADC samples than are

    available.

  • ‘slow FIFO overflow’: data is coming in faster than it’s being

    read; reduce scope.clock.adc_freq.

To fully understand the four different FIFO errors (fast/slow over/underflows), some background on Husky’s sample storage architecture is required. ADC samples are first stored in a “fast” FIFO which runs at the ADC sampling rate, then moved to a wider and “slower” FIFO which is read by the host. Overflows or underflows can occur in either FIFO. Errors can be caused from an illegal configuration of scope.adc (e.g. too many samples), or attempting to stream too fast.

Getter:

Return the error flags.

Setter:

Clear error flags.

property TriggerSettings.segments

Number of sample segments to capture.

Warning

Supported by CW-Husky only. For segmenting on CW-lite or CW-pro, see ‘fifo_fill_mode’ instead.

This setting must be a 16-bit positive integer.

In normal operation, segments=1.

Multiple segments are useful in two scenarios:

  1. Capturing only subsections of a power trace, to allow longer

    effective captures. After a trigger event, the requested number of samples is captured every ‘segment_cycles’ clock cycles, ‘segments’ times. Set ‘segment_cycle_counter_en’ to 1 for this segment mode.

  2. Speeding up capture times by capturing ‘segments’ power traces from

    a single arm + capture event. Here, the requested number of samples is captured at every trigger event, without having to re-arm and download trace data between every trigger event. Set ‘segment_cycle_counter_en’ to 0 for this segment mode.

Warning

when capturing multiple segments with presamples, the total number of samples per segment must be a multiple of 3. Incorrect sample data will be obtained if this is not the case.

Getter:

Return the current number of presamples

Setter:

Set the number of presamples.

Raises:

ValueError – if segments is outside of range [1, 2^16-1]

property TriggerSettings.bits_per_sample

Bits per ADC sample. Only available on CW-Husky.

Husky has a 12-bit ADC; optionally, we read back only 8 bits per sample. This does not allow for more samples to be collected; it only allows for a faster sampling rate in streaming mode.

Getter:

return the number of bits per sample that will be received.

Setter:

set the number of bits per sample to receive.

scope.clock

scope.clock (Lite/Pro Only)

Warning

ChipWhisperer-Lite/Pro only. See scope.clock (Husky) for Husky clock documentation.

Class to control target/ADC clocks. A block diagram of the clock module is shown below:

class ClockSettings(oaiface, hwinfo=None)
property adc_freq

The current frequency of the ADC clock in Hz. Read-only.

This clock frequency is derived from one of the ADC clock sources as described in adc_src.

Getter:

Return the current frequency in Hz (int). May take up to 0.5s to stabilize after adc_locked is True.

property adc_locked

The current status of the ADC DCM. Read-only.

To try re-locking the ADC, see reset_adc().

Getter:

Return whether the ADC DCM is locked (True or False)

property adc_phase

Fine adjustment for the ADC sampling point.

This setting moves the sampling point approximately 5 ns forward or backward, regardless of the sampling frequency. It may be helpful to improve the stability of the measurement.

The value of this setting is dimensionless and has a non-linear effect on the phase adjustment.

Getter:

Return the current phase setting (integer) NOTE: This getter is currently broken due to an FPGA bug.

Setter:

Set a new phase offset

Raises:

  • ValueError – if offset not in [-32767, 32767] (Husky) or [-255, 255] (others)

  • TypeError – if offset not integer

property adc_rate

The current sampling rate of the ADC clock in samples/s. Read-only.

Note that the sampling rate may be less than the clock frequency if the downsampling factor is greater than 1.

Getter:

Return the current sampling rate in samples/s (float)

property adc_src

The clock source for the ADC module.

The ADC can be clocked by one of five possible sources:

  • “clkgen_x1”: CLKGEN output via DCM

  • “clkgen_x4”: CLKGEN output via DCM with x4 clk multiplier

  • “extclk_x1”: External clock input via DCM

  • “extclk_x4”: External clock input via DCM with x4 clk multiplier

  • “extclk_dir”: External clock input with no DCM

Getter:

Return the current ADC clock source (one of five strings above)

Setter:

Set the ADC clock source and reset the ADC DCM to lock it.

Raises:

ValueError – if string not in valid settings

property clkgen_div

The divider in the CLKGEN DCM.

This divider must be in the range [1, 256].

Getter:

Return the current CLKGEN divider (integer)

Setter:

Set a new CLKGEN divider.

property clkgen_freq

The CLKGEN output frequency in Hz.

The CLKGEN module takes the input source and multiplies/divides it to get a faster or slower clock as desired. Minimum clock in practice is 3.2MHz.

Getter:

Return the current calculated CLKGEN output frequency in Hz (float). Note that this is the theoretical frequency - use the freq counter to determine the actual output. May take up to 0.5s to stabilize after clkgen_locked is True.

Setter:

Attempt to set a new CLKGEN frequency in Hz. When this value is set, all possible DCM multiply/divide settings are tested to find which is closest to the desired output speed. If EXTCLK is the CLKGEN source, the EXTCLK frequency must be properly set for this to work. Also, both DCMs are reset.

property clkgen_locked

The current status of the CLKGEN DCM. Read-only.

Getter:

Return whether the CLKGEN DCM is locked (True or False)

property clkgen_mul

The multiplier in the CLKGEN DCM.

This multiplier must be in the range [2, 256].

Getter:

Return the current CLKGEN multiplier (integer)

Setter:

Set a new CLKGEN multiplier.

property clkgen_src

The input source for the CLKGEN DCM.

This DCM can receive input from one of two places:

  • “extclk”: The external clock input

  • “system” or “internal”: The system clock (96 MHz)

Getter:

Return the current CLKGEN input (either “extclk” or “system”)

Setter:

Change the CLKGEN source and reset all the DCMs.

Raises:

ValueError – if source is not one of three strings above

property enabled

Controls whether the Xilinx MMCM used to generate the target clock is powered on or not. In Husky, an external PLL is used instead; this FPGA PLL is still present but disabled by default because MMCMs are quite power-hungry.

property extclk_freq

The input frequency from the EXTCLK source in Hz.

This value is used to help calculate the correct CLKGEN settings to obtain a desired output frequency when using EXTCLK as CLKGEN input. It is not a frequency counter - it is only helpful if the EXTCLK frequency is already known.

Getter:

Return the last set EXTCLK frequency in MHz (int)

Setter:

Update the EXTCLK frequency

property freq_ctr

The current frequency at the frequency counter in Hz. Read-only.

The frequency counter can be used to check the speed of the CLKGEN output or the EXTCLK input. This value shows the current frequency reading.

Getter:

Return the current frequency in Hz (int)

property freq_ctr_src

The current input to the frequency counter.

There are two possible inputs to the frequency counter: - “clkgen”: The CLKGEN DCM output - “extclk”: The external input clock signal

Getter:

Return the frequency counter input (one of the above strings)

Setter:

Set the frequency counter source

Raises:

ValueError – if source is not “clkgen” or “extclk”

reset_adc()

Reset the ADC DCM.

After changing frequencies, the ADC DCM may become unlocked from its input signal. This function resets the DCM to re-lock it.

If the DCM is still unlocked after calling this function, the clock may be too fast for the ADC.

reset_clkgen()

Reset the CLKGEN DCM.

After changing frequencies or input sources, the CLKGEN DCM may not be locked. This function resets the DCM to re-lock it.

If the DCM is still unlocked after calling this function, the clock may be too fast for the CLKGEN module.

reset_dcms()

Reset the CLKGEN DCM, then the ADC DCM.

This order is necessary because the ADC may depend on having a locked clock from the CLKGEN output.

scope.clock (Husky Only)

class ChipWhispererHuskyClock(oaiface, fpga_clk_settings, mmcm1, mmcm2, adc)
property adc_freq

Calculates the ADC frequency based on clkgen_freq and adc_mul

Read-only

property adc_locked

Convenience function for backwards compatibility with how ADC clocks are managed on CW-lite and CW-pro.

property adc_mul

Sets a new ADC clock frequency by multiplying this value by clkgen_freq

Must be a positive integer, or 0. If 0, turns the ADC clock off.

adc_freq = adc_mul * clkgen_freq

Note that the value of adc_mul affects how closely clkgen_freq can be matched to the requested frequency. See clkgen_freq for more information.

Getter:

The currently set adc multiplier

Setter:

Set the adc multiplier

property adc_phase

Changes the phase of the ADC clock relative to the target clock

Positive values delay the ADC clock compared to the target clock and vice versa.

Negative values are not possible when scope.clock.clkgen_src is ‘extclk’.

Note: The actual phase is only a 6 bit signed value compared to a 9 bit signed value on the Lite/Pro. This is mapped onto the same [-255, 255] range, meaning not all phases between -255 and 255 are possible.

Getter:

Gets the current adc_phase

Setter:

Sets the adc_phase. Must be in the range [-255, 255]

property adc_src

Convenience function for backwards compatibility with how ADC clocks are set on CW-lite and CW-pro.

The ADC can be clocked by one of five possible sources:

  • “clkgen_x1”: CLKGEN output via DCM

  • “clkgen_x4”: CLKGEN output via DCM with x4 clk multiplier

  • “extclk_x1”: External clock input via DCM

  • “extclk_x4”: External clock input via DCM with x4 clk multiplier

  • “extclk_dir”: External clock input with no DCM

Getter:

Return the current ADC clock source (one of five strings above)

Setter:

Set the ADC clock source and reset the ADC DCM to lock it.

Raises:

ValueError – if string not in valid settings

clear_adc_unlock()

Use this to decorate methods that can cause the PLL to momentarily unlock. Clears the unlock status and then re-enables it. If PLL lock is regained, then the user will see the ADC LED turn on for a short time. If the PLL remains unlocked, then the ADC LED will turn on, flicker off, then turn back on and stay on. We do this because the ADC LED is sticky (i.e. stays on after an unlock event, even when the PLL re-locks, until manually cleared).

property clkgen_freq

The target clock frequency in Hz.

The PLL takes the input clock frequency and multiplies it/divides to match as closely as possible to the set clkgen_freq. If set to 0, turns both the target and ADC clocks off.

Some important notes for setting this value:

  • The minimum output frequency is 500kHz and the maximum is 350MHz

  • The ADC clock output frequency (clkgen_freq * adc_mul) must be

    below 200MHz. Therefore, if you want to use a clkgen_freq above 200MHz, you must set adc_mul=0

  • The accuracy of the actual clkgen_freq will depend

    on adc_mul, as the output divisor for the clkgen_freq must divide cleanly by adc_mul. For example, if you try to use a clkgen_freq of 7.37MHz and and adc_mul of 16, the closest valid clkgen_freq will be 7.5MHz.

Getter:

Return the calculated target clock frequency in Hz

Setter:

Attempt to set a new target clock frequency in Hz. This also blindly clears extclk_error if there is one, but it only assumes, and does not verify, that the frequency has been updated to the correct value.

property clkgen_locked

Checks if the Husky PLL is locked

property clkgen_src

The input for the Husky’s PLL, which generates clocks for the target and the ADC.

The PLL can receive input from two places:

  • “system” or “internal”: An onboard crystal

  • “extclk”: An external clock (e.g. generated by the target).

When clkgen_src is set to “extclk”, the external clock frequency is measured to set the ADC clock accordingly. If the external clock frequency is later modified, then clkgen_src must be re-set to “extclk” in order for the frequency change to be recognized. Otherwise, the ADC sampling clock will remain tied to the previous external clock frequency.

A variant on “extclk” is “extclk_aux_io”, when the external clock is supplied on the AUX I/O MCX instead of the HS1 pin (scope.io.aux_io_mcx must be set to “high_z” in this case).

Getter:

Return the current PLL input (“system”, “extclk” or “extclk_aux_io”)

Setter:

Change the CLKGEN source

Raises:

ValueError – if source is not one of the above

property extclk_error

When the external clock is used, a change in clock frequency exceeding extclk_error will flag an error. The purpose of this is to remind you that you need to set scope.clock.clkgen_freq to the frequency of your external clock.

Getter:

Whether the external clock monitor has flagged an error.

Setter:

Clear the error.

property extclk_monitor_enabled

When enabled, any change in the external clock frequency input exceeding the amount set in self.extclk_tolerance will trigger an error.

When using an external clock to drive ChipWhisperer (i.e. self.clkgen_src == ‘extclk’), Husky must know the frequency of that clock (by setting scope.clock.clkgen_freq). This clock monitor is a convenience to flag when the frequency changes without Husky being informed of that change.

Getter:

Whether the external clock monitor is enabled.

Setter:

Enable/disable the external clock monitor.

property extclk_tolerance

Tolerance for external clock frequency change, measured in Hz. If the difference between consecutive measurements exceeds this, an error is flagged. Defaults to ~100 Hz.

Getter:

Get the frequency change tolerance [Hz].

Setter:

Set the frequency change tolerance [Hz].

property fpga_vco_freq

Set the FPGA clock glitch PLL’s VCO frequency.

Affects scope.glitch.phase_shift_steps

Allowed range: 600 - 1200 MHz.

Getter:

Calculate vco from last set value [Hz]

Setter:

Set the vco frequency [Hz]

Raises:

ValueError – set vco out of valid range

property freq_ctr

Reads the frequency of the external input clock

property freq_ctr_src

The current input to the frequency counter.

There are two possible inputs to the frequency counter: - “clkgen”: The CLKGEN DCM output - “extclk”: The external input clock signal

Getter:

Return the frequency counter input (one of the above strings)

Setter:

Set the frequency counter source

Raises:

ValueError – if source is not “pll” or “extclk”

scope.io

Module to control IO pins

class GPIOSettings(cwextra)
property aux_io_mcx

Set the function of the AUX I/O MCX on Husky.

Options:

  • “high_z”: input: to use as a trigger (scope.trigger.triggers = ‘aux’) or clock (scope.clock.clkgen_src = ‘extclk_aux_io’).

  • “hs2”: output: provide the same clock that’s on HS2.

property cdc_settings

Check or set whether USART settings can be changed via the USB CDC connection

i.e. whether you can change USART settings (baud rate, 8n1) via a serial client like PuTTY

Getter:

An array of length four for four possible CDC serial ports (though only one is used)

Setter:

Can set either via an integer (which sets both ports) or an array of length 4 (which sets each port)

Returns None if using firmware before the CDC port was added

property extclk_src

The clock signal being used as input for EXTCLK.

Currently, this can only be HS1, which is the clock from the target. As such, this value is read-only.

property glitch_hp

Whether the high-power crowbar MOSFET is enabled.

The glitch output is an SMA-connected output line that is normally connected to a target’s power rails. If this setting is enabled, a high-powered MOSFET shorts the power-rail to ground when the glitch module’s output is active.

Warning

Use with caution - ensure that the glitch module is properly configured before enabling this setting, as it is possible to permanently damage hardware with this output.

Getter:

Return True if enabled or False if disabled

Setter:

Turn the high-power MOSFET on or off

property glitch_lp

Whether the low-power crowbar MOSFET is enabled.

This is the low-power version of glitch_hp - see that documentation for more details.

Warning

Use with caution - ensure that the glitch module is properly configured before enabling this setting, as it is possible to permanently damage hardware with this output.

property glitch_trig_mcx

Set the function of the Trigger/Glitch Out MCX on Husky. Options:

  • “glitch”: glitch output (clock or voltage glitch signal, as defined by scope.glitch settings)

  • “trigger”: internal trigger signal (as defined by scope.trigger)

  • “inverted [glitch | trigger]”: inverted glitch or trigger signal

property hs2

The clock signal routed to the HS2 high speed output pin.

Allowed clock signals are:

  • “clkgen”: The output from the CLKGEN module

  • “glitch”: The output from the glitch module

  • “disabled” / None: No clock; output driven low

Getter:

Return one of “clkgen”, “glitch”, or “disabled”

Setter:

Set the clock to be output on HS2.

Raises: ValueError: if new value not listed above

property miso_state

Reads the logic level of the MISO pin. Supported by Husky only.

property mosi_state

Reads the logic level of the MOSI pin. Supported by Husky only.

property nrst

The state of the NRST pin.

See pdic for more information.

property nrst_state

Reads the logic level of the nRST pin. Supported by Husky only.

property pdic

The function of the PDIC pin output pin.

PDIC is often used to selecting between normal boot and its bootloader. See the rtfm.newae.com page for your target for more information.

This is a GPIO pin. The following values are allowed:

  • “high” / True: logic 1

  • “low” / False: logic 0

  • “disabled” / “default” / “high_z” / None: undriven

Getter:

Return one of “high”, “low”, or “high_z”. This shows how ChipWhisperer is driving this pin; it does not show its actual logic level.

Setter:

Set the pin’s state

Raises: ValueError: if new state not listed above

property pdic_state

Reads the logic level of the PDIC pin. Supported by Husky only.

property pdid

The state of the PDID pin.

See pdic for more information.

property pdid_state

Reads the logic level of the PDID pin. Supported by Husky only.

property sck_state

Reads the logic level of the SCK pin. Supported by Husky only.

property target_pwr

Whether the target board is powered by the ChipWhisperer.

If True, the ChipWhisperer is currently supplying power to the target board; if False, it is not. This setting can be used to cycle power to the target or to help program it.

If the target board is powered through an external supply, this setting may have no effect.

Getter:

Return the current power state of the target (True or False)

Setter:

Turn the target power on or off.

property tio1

The function of the Target IO1 pin.

TIO1 can be used for the following functions:

  • “serial_rx”: UART input

  • “serial_tx”: UART output

  • “high_z” / None: High impedance input

  • “gpio_low” / False: Driven output: logic 0

  • “gpio_high” / True: Driven output: logic 1

  • “gpio_disabled”: Driven output: no effect

Default value is “serial_rx”.

Getter:

Return one of the above strings. This shows how ChipWhisperer is driving this pin; it does not show its actual logic level. Use scope.io.tio_states to see the actual logic level.

Setter:

Set the Target IO1 mode.

Raises:

ValueError – if new value is not one of the above modes

property tio2

The function of the Target IO2 pin.

TIO2 can be used for the following functions:

  • “serial_rx”: UART input

  • “serial_tx”: UART output

  • “high_z” / None: High impedance input

  • “gpio_low” / False: Driven output: logic 0

  • “gpio_high” / True: Driven output: logic 1

  • “gpio_disabled”: Driven output: no effect

Default value is “serial_tx”.

Getter:

Return one of the above strings. This shows how ChipWhisperer is driving this pin; it does not show its actual logic level. Use scope.io.tio_states to see the actual logic level.

Setter:

Set the Target IO2 mode.

Raises:

ValueError – if new value is not one of the above modes

property tio3

The function of the Target IO3 pin.

TIO3 can be used for the following functions:

  • “serial_rx”: UART input

  • “serial_tx”: UART output

  • “serial_tx_rx”: UART 1-wire I/O (for smartcards)

  • “high_z” / None: High impedance input

  • “gpio_low” / False: Driven output: logic 0

  • “gpio_high” / True: Driven output: logic 1

  • “gpio_disabled”: Driven output: no effect

Default value is “high_z”.

Getter:

Return one of the above strings. This shows how ChipWhisperer is driving this pin; it does not show its actual logic level. Use scope.io.tio_states to see the actual logic level.

Setter:

Set the Target IO3 mode.

Raises:

ValueError – if new value is not one of the above modes

property tio4

The function of the Target IO4 pin.

TIO4 can be used for the following functions:

  • “serial_tx”: UART output

  • “high_z” / None: High impedance input

  • “gpio_low” / False: Driven output: logic 0

  • “gpio_high” / True: Driven output: logic 1

  • “gpio_disabled”: Driven output: no effect

Default value is “high_z”. Typically, this pin is used as a trigger input.

Getter:

Return one of the above strings. This shows how ChipWhisperer is driving this pin; it does not show its actual logic level. Use scope.io.tio_states to see the actual logic level.

Setter:

Set the Target IO4 mode

Raises:

ValueError – if new value is not one of the above modes

property tio_states

Reads the logic level of the TIO pins (1-4) and returns them as a tuple of the logic levels.

Warning

ChipWhisperer firmware before release 5.2.1 does not support reading the TIO pins!

Getter:

Read TIO states

Returns:

A tuple of 1’s and 0’s representing the logic levels of each TIO pin

New in version 5.3: Add documented interface for the old method of reading TIO pins

property vcc_glitcht

Gets a bitmask indicating which VCC glitch MOSFET’s are enabled, based on the VCC_GLITCHT_* consts.

Returns:

A bitmask with the VCC_GLITCHT_HP/LP set if enabled.

vglitch_disable()

Disables both glitch mosfets.

vglitch_reset(delay=0.005)

Disables and reenables the glitch mosfets that were previously enabled.

scope.trigger

Basic trigger control module

class TriggerSettings(cwextra)
property module

The trigger module in use.

The trigger modules available depend on the hardware. On the CWLite, only the basic trigger module can be used; on the CW1200, the serial data and SAD triggers are available too.

Available trigger modules:

  • ‘basic’: Trigger on a logic level or edge

Getter:

Returns ‘basic’

property triggers

The logical input into the trigger module.

The trigger module uses some combination of the scope’s I/O pins to produce a single value, which it uses for edge/level detection or UART triggers. This trigger output can combine 5 pins using one of 3 different boolean operations. N/A for ‘trace’ trigger module (see scope.trace.trace_mode for how to connect trace pins.)

Pins:

  • tio1-4: Target I/O pins 1-4. Note that these pins can be in any mode.

  • nRST: Target I/O pin nRST. Note that these pins can be in any mode.

  • sma: An auxiliary SMA input, if available (only on CW1200)

Boolean operations:

  • OR: True if any inputs are True; False if none are

  • AND: True if all inputs are True; False if any are not

  • NAND: False if all inputs are True; True if any are not

Note that only one boolean operation can be used over all input pins.

Examples of acceptable trigger inputs:

  • “tio1”

  • “tio3 OR tio4”

  • “tio1 NAND tio2 NAND sma”

  • “nrst”

Examples of unallowed trigger inputs:

  • “tio1 tio2”

  • “tio1 AND tio2 OR tio3”

  • “tio1 OR tio1”

  • “tio1 XOR tio2”

  • “serial-tx”

Getter:

Return a string describing the trigger mode (see examples)

Setter:

Set the trigger mode using a string like the ones above

Raises:

ValueError – if string cannot be converted to a legal mode

scope.trigger (Pro Only)

class ProTrigger(cwextra)
property aux_out

Controls AUX out on the CWPro

CWPro only

Getter:

Returns True for ‘trigger’, ‘glitch’ for ‘glitch’, ‘clock’ for ‘clock’ or False for no output.

Setter:

Set False or 0 to disable, True or 'trigger' for trig_out, 'glitch' for glitch out, or 'clock' for clock_out

property module

The trigger module in use.

The trigger modules available depend on the hardware. On the CWLite, only the basic trigger module can be used; on the CW1200, the serial data and SAD triggers are available too.

Available trigger modules:

  • ‘basic’: Trigger on a logic level or edge

  • ‘SAD’: Trigger from SAD module (CWPro only)

  • ‘DECODEIO’: Trigger from decode_IO module (CWPro only)

Getter:

Return the active trigger module

Setter:

Sets the active trigger module

Raises:

ValueError – module isn’t one of the available strings

scope.trigger (Husky Only)

class HuskyTrigger(cwextra)

Husky trigger object. Communicates with all the trigger modules inside CW-Husky. Usage depends on the active trigger module.

property edges

For triggering on edge counts, when scope.trigger.module = 'edge_counter'.

Sets the number of rising+falling edges on scope.trigger.triggers that need to be seen for a trigger to be issued.

Edges are sampled by the ADC sampling clock (scope.clock.adc_freq), so ensure that scope.trigger.triggers does not change faster than what can be seen by that clock.

Parameters:

val (int) – number of edges, non-zero 16-bit integer.

property edges_seen

Returns the number of edges seen.

Under normal operation this should be the same as scope.trigger.edges. When trigger generation failed, Can be useful to understand why. Resets upon scope.arm().

get_trigger_times()

Retrieve the timestamped trigger times.

When multiple triggers occur, the number of ADC clock cycles between successive triggers is recorded. Up to 1024 triggers can be timestamped. The counter for each timestamp is 32-bits wide; overflows are noted. Recorded triggers are automatically reset when the scope is armed.

property level

For triggering on ADC sample exceeding a treshold, when scope.trigger.module = ‘ADC’.

Sets the trigger threshold, in the range [-0.5, 0.5].

If positive, triggers when the ADC sample exceeds this setting; if negative, triggers when the ADC sample is below this setting.

Only a single trigger is issued (i.e. multiple samples exceeding the threshold do not each generate a trigger; cannot be used in conjunction with segmented capture).

property max_sequenced_triggers

Maximum number of triggers in the trigger sequence.

property module

The trigger module in use.

The trigger modules available depend on the hardware. On the CWLite, only the basic trigger module can be used; on the CW1200, the serial data and SAD triggers are available too.

Available trigger modules:

  • ‘basic’: Trigger on a logic level or edge

  • ‘ADC’: Trigger on ADC sample exceeding a threshold

  • ‘SAD’: Trigger from SAD module

  • ‘UART’: Trigger from UART module

  • ‘edge_counter’: Trigger after a number of rising/falling edges

  • ‘trace’: Trigger from TraceWhisperer

Getter:

Return the active trigger module

Setter:

Sets the active trigger module

Raises:

ValueError – module isn’t one of the available strings

property num_triggers

Number of triggers in the trigger sequence.

property sad_always_active

Make the SAD trigger module always active. Its associated trigger window will still be used: only SAD triggers inside its window will be recognized as part of the trigger sequence, but setting this allows the SAD module to fire outside of its window, which can be helpful in tuning SAD parameters.

property sequencer_enabled

Enable the trigger sequencer.

property window_end

Maximum number of clock cycles (of the ADC sampling clock) that can follow trigger #0 before trigger #1 is allowed to complete the sequence. 0 = no limit. :param end: 16-bit integer

property window_start

Minimum number of clock cycles (of the ADC sampling clock) that must follow trigger #0 before trigger #1 is allowed to complete the sequence. 0 = no limit. :param start: 16-bit integer

scope.glitch

Module to control glitching. A block diagram of the module is shown below:

class GlitchSettings(cwglitch)
property arm_timing

When to arm the glitch in single-shot mode.

If the glitch module is in “ext_single” trigger mode, it must be armed when the scope is armed. There are two timings for this event:

  • “no_glitch”: The glitch module is not armed. Gives a moderate speedup to capture.

  • “before_scope”: The glitch module is armed first.

  • “after_scope”: The scope is armed first. This is the default.

This setting may be helpful if trigger events are happening very early.

If the glitch module is not in external trigger single-shot mode, this setting has no effect.

Getter:

Return the current arm timing (“before_scope” or “after_scope”)

Setter:

Change the arm timing

Raises:

ValueError – if value not listed above

property clk_src

The clock signal that the glitch DCM is using as input.

This DCM can be clocked from three different sources:

  • “target”: The HS1 clock from the target device (can also be AUX clock for Husky)

  • “clkgen”: The CLKGEN DCM output (N/A for Husky)

  • “pll”: Husky’s on-board PLL clock (Husky only)

Getter:

Return the clock signal currently in use

Setter:

Change the glitch clock source

Raises:

ValueError – New value not one of “target”, “clkgen” or “pll”

property ext_offset

How long the glitch module waits between a trigger and a glitch.

After the glitch module is triggered, it waits for a number of clock cycles before generating glitch pulses. This delay allows the glitch to be inserted at a precise moment during the target’s execution to glitch specific instructions.

For CW-Husky when scope.glitch.num_glitches > 1, this parameter is a list with scope.glitch.num_glitches elements, each element representing the ext_offset value for the corresponding glitch, relative to the previous glitch. If ext_offset[i] = j, glitch i will be issued 2+j cycles after the start of glitch i-1.

For CW-Lite/Pro, scope.glitch.num_glitches is not supported so this is a simply an integer.

Has no effect when trigger_src = ‘manual’ or ‘continuous’.

Note

It is possible to get more precise offsets by clocking the glitch module faster than the target board.

This offset must be in the range [0, 2**32).

Getter:

Return the current external trigger offset(s). For CW-lite/pro or when num_glitches=1, this is an integer (for backwards compatibility). Otherwise, it is a MultiGlitchList, which behaves as a list, but allows ext_offset[x] = y to set settings for glitch x.

Setter:

Set the external trigger offset(s). Integer for CW-lite/pro, list of integers for Husky.

Raises:

  • TypeError – if offset not an integer, or list of integers for Husky

  • ValueError – if any offset outside of range [0, 2**32)

manual_trigger()

Manually trigger the glitch output.

This trigger is most useful in Manual trigger mode, where this is the only way to cause a glitch.

Note that for ChipWhisperer-Husky, this method will only cause a glitch in manual mode, while on the Lite/Pro, this method will always insert a glitch.

property offset

The offset from a rising clock edge to a glitch pulse rising edge.

For CW-Husky, offset is expressed as the number of phase shift steps. Minimum offset is obtained at 0 (rising edge of glitch aligned with rising edge of glitch source clock). At scope.glitch.phase_shift_steps/2, the glitch rising edge is aligned with the glitch source clock falling edge. Negative values are allowed, but -x is equivalent to scope.glitch.phase_shift_steps-x. The setting rolls over (+x is equivalent to scope.glitch.phase_shift_steps+x). Run the notebook in jupyter/demos/husky_glitch.ipynb to visualize glitch settings.

For other capture hardware (CW-lite, CW-pro), offset is expressed as a percentage of one period. A pulse may begin anywhere from -49.8% to 49.8% away from a rising edge, allowing glitches to be swept over the entire clock cycle.

Warning

very large negative offset <-45 may result in double glitches (CW-lite/pro only).

Getter:

Return an int (Husky) or float (CW-lite/pro) with the current glitch offset.

Setter:

Set the glitch offset. For CW-lite/pro, the new value is rounded to the nearest possible offset.

Raises:

UserWarning – value outside range [-50, 50] (value is rounded) (CW-lite/pro only)

property offset_fine

The fine adjustment value on the glitch offset. N/A for Husky.

This is a dimensionless number that makes small adjustments to the glitch pulses’ offset. Valid range is [-255, 255].

Warning

This value is write-only. Reads will always return 0.

Getter:

Returns 0

Setter:

Update the glitch fine offset

Raises:

  • TypeError – if offset not an integer

  • ValueError – if offset is outside of [-255, 255]

property output

The type of output produced by the glitch module.

There are 5 ways that the glitch module can combine the clock with its glitch pulses:

  • “clock_only”: Output only the original input clock.

  • “glitch_only”: Output only the glitch pulses - do not use the clock.

  • “clock_or”: Output is high if either the clock or glitch are high.

  • “clock_xor”: Output is high if clock and glitch are different.

  • “enable_only”: Output is high for glitch.repeat cycles.

Some of these settings are only useful in certain scenarios:

  • Clock glitching: “clock_or” or “clock_xor”

  • Voltage glitching: “glitch_only” or “enable_only”

Getter:

Return the current glitch output mode (one of above strings)

Setter:

Change the glitch output mode.

Raises:

ValueError – if value not in above strings

readStatus()

Read the status of the two glitch DCMs.

Returns:

A tuple with 4 elements:

* phase1: Phase shift of DCM1 (N/A for Husky),
* phase2: Phase shift of DCM2 (N/A for Husky),
* lock1: Whether DCM1 is locked,
* lock2: Whether DCM2 is locked

property repeat

The number of glitch pulses to generate per trigger.

When the glitch module is triggered, it produces a number of pulses that can be combined with the clock signal. This setting allows for the glitch module to produce stronger glitches (especially during voltage glitching).

For CW-Husky when scope.glitch.num_glitches > 1, this parameter is a list with scope.glitch.num_glitches elements, each element representing the repeat value for the corresponding glitch. The maximum legal value for repeat[i] is ext_offset[i+1]+1. If an illegal value is specified, the glitch output may be held high for up to 8192 cycles.

For CW-Lite/Pro, scope.glitch.num_glitches is not supported so this is a simply an integer.

Has no effect when trigger_src = ‘continuous’.

Repeat counter must be in the range [1, 8192].

Getter:

Return the current repeat value. For CW-lite/pro or when num_glitches=1, this is an integer (for backwards compatibility). Otherwise, it is a list of integers.

Setter:

Set the repeat counter. Integer for CW-lite/pro, list of integers for Husky.

Raises:

  • TypeError – if value not an integer, or list of integers for Husky

  • ValueError – if any value outside [1, 8192]

resetDCMs(keepPhase=True)

Reset the two glitch DCMs.

This is automatically run after changing the glitch width or offset, so this function is typically not necessary.

property state

Glitch FSM state. CW-Husky only. For debug. Writing any value resets the FSM to its idle state.

property trigger_src

The trigger signal for the glitch pulses.

The glitch module can use four different types of triggers:
  • “continuous”: Constantly trigger glitches. The following

    scope.glitch parameters have no bearing in this mode: ext_offset, repeat, num_glitches.

  • “manual”: Only trigger glitches by calling manual_trigger(). The

    following scope.glitch parameters have no bearing in this mode: ext_offset, num_glitches. In this mode, calling scope.arm() will trigger a glitch as well.

  • “ext_single”: Use the trigger module. Once the scope is armed, one

    set of glitch events is emitted when the trigger condition is satisfied. Subsequent trigger conditions are ignored unless the scope is re-armed.

  • “ext_continuous”: Use the trigger module. A set of glitch events is

    emitted each time the trigger condition is satisfied, whether or not the scope is armed.

Warning

calling scope.arm() in manual gitch mode will cause a glitch to trigger.

Getter:

Return the current trigger source.

Setter:

Change the trigger source.

Raises:

ValueError – value not listed above.

property width

The width of a single glitch pulse.

For CW-Husky, width is expressed as the number of phase shift steps. Minimum width is obtained at 0. Maximum width is obtained at scope.glitch.phase_shift_steps/2. Negative values are allowed, but -x is equivalent to scope.glitch.phase_shift_steps-x. The setting rolls over (+x is equivalent to scope.glitch.phase_shift_steps+x). Run the notebook in jupyter/demos/husky_glitch.ipynb to visualize glitch settings.

For other capture hardware (CW-lite, CW-pro), width is expressed as a percentage of one period. One pulse can range from -49.8% to roughly 49.8% of a period. The system may not be reliable at 0%. Note that negative widths are allowed; these act as if they are positive widths on the other half of the clock cycle.

Getter:

Return an int (Husky) or float (others) with the current glitch width.

Setter:

Update the glitch pulse width. For CW-lite/pro, the value is adjusted to the closest possible glitch width.

Raises:

UserWarning – Width outside of [-49.8, 49.8]. The value is rounded to one of these. (CW-lite/pro only)

property width_fine

The fine adjustment value on the glitch width. N/A for Husky.

This is a dimensionless number that makes small adjustments to the glitch pulses’ width. Valid range is [-255, 255].

Warning

This value is write-only. Reads will always return 0.

Getter:

Returns 0

Setter:

Update the glitch fine width

Raises:

  • TypeError – offset not an integer

  • ValueError – offset is outside of [-255, 255]

scope.glitch (Husky Only)

The following attributes are only available on, or differ substantially on the ChipWhisperer-Husky

class GlitchSettings(cwglitch)
GlitchSettings.enabled

Husky only. Whether the Xilinx MMCMs used to generate glitches are powered on or not. 7-series MMCMs are power hungry and are estimated to consume half of the FPGA’s power. If you run into temperature issues and don’t require glitching, you can power down these MMCMs.

GlitchSettings.width

The width of a single glitch pulse.

For CW-Husky, width is expressed as the number of phase shift steps. Minimum width is obtained at 0. Maximum width is obtained at scope.glitch.phase_shift_steps/2. Negative values are allowed, but -x is equivalent to scope.glitch.phase_shift_steps-x. The setting rolls over (+x is equivalent to scope.glitch.phase_shift_steps+x). Run the notebook in jupyter/demos/husky_glitch.ipynb to visualize glitch settings.

For other capture hardware (CW-lite, CW-pro), width is expressed as a percentage of one period. One pulse can range from -49.8% to roughly 49.8% of a period. The system may not be reliable at 0%. Note that negative widths are allowed; these act as if they are positive widths on the other half of the clock cycle.

Getter:

Return an int (Husky) or float (others) with the current glitch width.

Setter:

Update the glitch pulse width. For CW-lite/pro, the value is adjusted to the closest possible glitch width.

Raises:

UserWarning – Width outside of [-49.8, 49.8]. The value is rounded to one of these. (CW-lite/pro only)

GlitchSettings.offset

The offset from a rising clock edge to a glitch pulse rising edge.

For CW-Husky, offset is expressed as the number of phase shift steps. Minimum offset is obtained at 0 (rising edge of glitch aligned with rising edge of glitch source clock). At scope.glitch.phase_shift_steps/2, the glitch rising edge is aligned with the glitch source clock falling edge. Negative values are allowed, but -x is equivalent to scope.glitch.phase_shift_steps-x. The setting rolls over (+x is equivalent to scope.glitch.phase_shift_steps+x). Run the notebook in jupyter/demos/husky_glitch.ipynb to visualize glitch settings.

For other capture hardware (CW-lite, CW-pro), offset is expressed as a percentage of one period. A pulse may begin anywhere from -49.8% to 49.8% away from a rising edge, allowing glitches to be swept over the entire clock cycle.

Warning

very large negative offset <-45 may result in double glitches (CW-lite/pro only).

Getter:

Return an int (Husky) or float (CW-lite/pro) with the current glitch offset.

Setter:

Set the glitch offset. For CW-lite/pro, the new value is rounded to the nearest possible offset.

Raises:

UserWarning – value outside range [-50, 50] (value is rounded) (CW-lite/pro only)

GlitchSettings.clk_src

The clock signal that the glitch DCM is using as input.

This DCM can be clocked from three different sources:

  • “target”: The HS1 clock from the target device (can also be AUX clock for Husky)

  • “clkgen”: The CLKGEN DCM output (N/A for Husky)

  • “pll”: Husky’s on-board PLL clock (Husky only)

Getter:

Return the clock signal currently in use

Setter:

Change the glitch clock source

Raises:

ValueError – New value not one of “target”, “clkgen” or “pll”

GlitchSettings.phase_shift_steps

The number of phase shift steps per target clock period. Husky only. To change, modify clock.pll.update_fpga_vco()

Getter:

Returns the number of steps.

GlitchSettings.mmcm_locked

Husky only. Whether the Xilinx MMCMs used to generate glitches are locked or not.

GlitchSettings.num_glitches

The number of glitch events to generate. CW-Husky only.

Each glitch event uses the same offset and width settings. Glitch event x uses repeat[x] and ext_offset[x].

This parameter has no effect when scope.glitch.trigger_src is set to “manual” or “continuous”.

Note

Subsequent glitches are offset from the previous glitch.

Raises:

ValueError – number outside of [1, 32].

Pro/Husky Only Featuers

SAD

Communicates with and drives the Sum of Absolute Differences module on the ChipWhisperer Pro.

Example for triggering off of some previously collected scope data:

scope.SAD.reference = trace.wave[1000:1000+128] # change 128 to 32 on Husky
scope.SAD.threshold = 5000
scope.SAD.start()
scope.trigger.module = "SAD"
scope.adc.basic_mode = "rising_edge"

#can now capture as normal
trace = cw.capture_trace(scope, target, text, key)
class ChipWhispererSAD(oa)

Communicates with the SAD module inside the CW Pro

This submodule is only available on the ChipWhisperer1200 Pro

Example:

trace, ret = cw.capture_trace(scope, data, text, key)
cw.SAD.reference = trace[400:528]
cw.SAD.threshold = 1000
cw.SAD.start()
cw.trigger.module = 'SAD'

#SAD trigger active
trace, ret = cw.capture_trace(scope, data, text, key)
check_status()

Check if the SAD module is running & outputting valid data

getThreshold()

Get the threshold. When the SAD output falls below this threshold the system triggers

property reference

Set the reference data for the SAD Trigger.

The reference must be 128 samples long. Through this interface, it is represented as a numpy array of floats between -0.5 and 0.5 (the same as trace data).

Getter:

Gets the currently set SAD reference

Setter:

Sets the SAD reference

Raises:

ValueError – Data not 128 samples long

reset()

Reset the SAD hardware block. The ADC clock must be running!

setRefWaveform(dataRef)

Download a reference waveform. Resets the SAD module & starts it again after loading the new data. ADC Clock must be running!

setThreshold(threshold)

Set the threshold. When the SAD output falls below this threshold the system triggers

start()

Start the SAD algorithm, which causes the reference data to be loaded from the FIFO

property threshold

The threshold for the SAD trigger.

The threshold has a maximum value of 100 000. You should set the reference waveform via SAD.reference before setting this value.

Getter:

Return the current threshold

Setter:

Set the current threshold

Raises:

  • ValueError – The user attempted to set a threshold above 100 000

  • IOError – User attempted to set the threshold before the reference waveform.

Husky Only Features

scope.UARTTrigger

UART Pattern Matching Trigger. Must set scope.trigger.module = 'UART' to select this trigger.

class UARTTrigger(scope, trace_reg_select, main_reg_select)

Husky UART trigger module settings. Basic usage for triggering on ‘r’:

#assuming setup scope:
scope.trigger.triggers = 'tio1'
scope.trigger.module = 'UART'
scope.UARTTrigger.enabled = True
scope.UARTTrigger.baud = 38400
scope.UARTTrigger.set_pattern_match(0, 'r')
scope.UARTTrigger.trigger_source = 0

TraceWhisperer runs on the same hardware as this, so configuration changes in one affects the other and vice-versa.

property baud

Set the desired baud rate.

property enabled

Controls whether trace data collecting is enabled or not. Mostly affects configuration of the front 20-pin header. :param enable: :type enable: bool

property matched_pattern_counts

Return the actual trace data seen for the last matched pattern.

matched_pattern_data(as_string=True)

Return the actual trace data seen for the last matched pattern. :param as_string: convert each byte to its boolean string; otherwise, :type as_string: bool :param results are returned as a list of self.data_bits-sized words.:

property rules

Shortcut to self.capture.rules

property rules_enabled

Shortcut to self.capture.rules_enabled

property sampling_clock

Shorthand for accessing the measured frequency of the sampling clock. Indirectly set via ‘baud’ setting.

set_pattern_match(index, pattern, mask=None, enable_rule=True)

Sets pattern match and mask parameters. The pattern may be specified as a string (if the UART word size is 8 bits), or as a list of self.data_bits-sized integers (as is done for trace). Refer to set_pattern_match() documentation in parent TraceWhisperer class for more details.

Parameters:

  • index – match index [0-7]

  • pattern – string or list of self.data_bits-sized integers. Maximum size given by self.pattern_size.

  • mask (list, optional) – list of self.data_bits-sized integers, must have same size as ‘pattern’ if set.

property trigger_source

Set which pattern match rule is used to generate a trigger. :param rule: :type rule: int

uart_data(rawdata, prepend_matched_pattern=True, return_ascii=True)

Helper function to parse the captured UART data. :param rawdata: raw capture data, list of lists, e.g. obtained from read_capture_data() :type rawdata: list :param prepend_matched_pattern: :type prepend_matched_pattern: bool :param return_ascii: return data as ASCII (otherwise hex) :type return_ascii: bool

scope.LA

Built in logic analyzer for visualizing internal FPGA signals. Notably can be used for visualizing glitch parameters, as in the Husky Glitch Notebook

class LASettings(oaiface, mmcm, scope)

Husky logic analyzer settings. For accessing recorded glitch generation, IO, and USERIO signals.

property capture_depth

Number of bits captured for each signal.

Parameters:

depth (int) – capture <depth> samples of each signal. 16-bit value, in range [1, scope.LA.max_capture_depth]

property capture_group

Sets which group of signals are captured.

There are three groups. The signals captured for each group are as follows: ‘glitch’ (group 0):

  1. glitch output

  2. source clock of glitch module

  3. glitch internal MMCM1 (offset) output

  4. glitch internal MMCM2 (width) output

  5. glitch go internal signal

  6. capture trigger

  7. glitch enable

  8. manual glitch trigger in source clock domain (e.g. signal 1 of this group)

  9. glitch trigger in MMCM1 clock domain

‘CW 20-pin’ (group 1):

  1. IO1

  2. IO2

  3. IO3

  4. IO4

  5. HS1

  6. HS2

  7. AUX MCX

  8. TRIG MCX

  9. ADC sampling clock

‘USERIO 20-pin’ (group 2):

  1. D0

  2. D1

  3. D2

  4. D3

  5. D4

  6. D5

  7. D6

  8. D7

  9. CK

‘trigger debug’ (group 3) ‘internal trace 1’ (group 4) ‘internal trace 2’ (group 5) ‘glitch debug’ (group 6)

Getter:

Return the capture group currently in use.

Setter:

Change the capture group.

Raises:

ValueError – invalid capture group.

property clk_source

The clock signal that the logic analyzer is using to generate its sampling clock.

There are three different sources:

  • “target”: The clock from the target device (from HS1 or AUX, as per scope.clock.clkgen_src)

  • “usb”: The 96 MHz internal USB clock.

  • “pll”: Husky’s on-board PLL clock.

Getter:

Return the clock signal currently in use

Setter:

Change the clock source

Raises:

ValueError – New value not one of “target”, “usb” or “pll”

property clkgen_enabled

Controls whether the Xilinx MMCM used to generate the sampling clock is powered on or not. 7-series MMCMs are power hungry. In the Husky FPGA, MMCMs are estimated to consume close to half of the FPGA’s power. If you run into temperature issues and don’t require the logic analyzer or debug trace functionality, power down this MMCM.

property downsample

Downsample setting.

Parameters:

downsample (int) – capture every <downsample> samples. 16-bit value, in range [1, 2**16].

property enabled

Controls whether this block is active for recording data. The LA and trace components share the same FPGA storage, so they cannot be simultaneously enabled.

property errors

Indicate whether internal FPGA errors have occurred. Write to clear.

static extract(raw, index)
fifo_empty()

Returns True if the capture FIFO is empty, False otherwise.

property locked

Return whether the sampling clock MMCM is locked (True or False).

property max_capture_depth

Maximum capture depth.

property oversampling_factor

Multiplier for the sampling clock. Can be fractional, but an integer is probably what you want. Whether the desired oversampling factor can be achieved depends on the source clock frequency; a warning is issued if it can’t.

Getter:

Return the actual oversampling factor.

Setter:

Set the desired oversampling factor.

property present

Return whether the logic analyzer functionality is present in this build (True or False). If it is not present, none of the functionality of this class is available.

read_capture(source, length=None)

Returns captured data for specified signal source. What you get depends on the capture group; see the capture_group documentation.

Parameters:

  • source (int) – signal to read

  • length (int) – number of byte to read. If unspecified, returns the full capture size (which is implementation-dependent and can be learned from capture_depth)

Returns:

Numpy array of binary values.

Raises:

ValueError – invalid source

read_capture_data(check_empty=False)

Read captured data.

Returns: List of captured entries. Each list element is itself a 3-element list, containing the 3 bytes that make up a capture entry. Use extract() to parse.

reset_MMCM()

Reset the sampling clock’s MMCM.

property sampling_clock_frequency

Report the actual sampling clock frequency.

property source_clock_frequency

Report the actual clock frequency of the input clock to the shared LA/trace MMCM.

trigger_now()

Trigger the capture manually.

property trigger_source

The trigger used by the logic analyzer to capture.

There are several different sources:
  • “glitch”: The internal glitch enable trigger, one cycle earlier than the

    glitch output seen when scope.glitch.output = ‘enable_only’. This signal is in the MMCM1 clock glitch domain.

  • “capture”: The internal ADC capture trigger.

  • “glitch_source”: The internal manual glitch trigger in the source or target clock

    domain (as per scope.glitch.clk_src), which accounts for scope.glitch.ext_offset but not scope.glitch.offset. Should only be used with scope.glitch.trigger_src = ‘manual’; may not fire reliably with other settings.

  • “glitch_trigger”: The internal glitch trigger in the MMCM1 clock domain.

  • “trigger_glitch”: The trigger for the glitch module (aka scope.trigger.triggers).

  • “HS1”: The HS1 input clock.

  • “rising_userio_d[0-7]”: a rising edge (0->1) on a USERIO pin

  • “falling_userio_d[0-7]”: a falling edge (1->0) on a USERIO pin

  • “rising_tio[0-3]”: a rising edge (0->1) on a tio pin

  • “failling_tio[0-3]”: a falling edge (0->1) on a tio pin

In addition, capture can be triggered manually, irrespective of the trigger_source setting, by calling scope.LA.trigger_now()

Getter:

Return the trigger source currently in use

Setter:

Change the trigger source

Raises:

ValueError – New value not one of the options listed above.

scope.ADS4128Settings

class ADS4128Settings(oaiface)

Husky ADS4128 ADC settings. Mostly for testing, not needed in normal use.

adc_reset()

Resets the ADC. Note this is done by the FPGA - see reg_husky_adc.v

property hi_perf

High performance mode setting. Valid values are 0 (high performance off), 1, and 2. See ADS4128 datasheet for more information.

Getter:

Return the high performance mode setting.

Setter:

Set the high performance mode setting.

property low_speed

Whether the ADC is set to “low speed” operation; recommended for sampling rates below 80 MS/s.

Getter:

Return whether the ADC is set to low speed mode.

Setter:

Set the low speed mode.

property mode

The current mode of the ADC.

Getter:

Return the current ADC operating mode (“normal” or “test ramp”)

Setter:

Set the operating mode.

Raises:

ValueError – if mode not one of “normal” or “test ramp”

scope.LEDs

class LEDSettings(oaiface)

Set source of Husky front-panel LEDs

property setting

Front-panel LED sources.

  1. default: green=armed, blue=capture, top red=PLL lock fail, bottom red=glitch

  2. green: USB clock heartbeat, blue=CLKGEN clock heartbeat

  3. green: ADC sampling clock heartbeat, blue=PLL reference clock heartbeat

  4. green: PLL clock heartbeat, blue=external clock change detected

In all cases, blinking red lights indicate a temperature, voltage, or sampling error (see scope.XADC.status and scope.adc.errors for details), whlie blinking green and blue lights indicate that a frequency change was detected on the external clock input (and that scope.clock should be updated to account for this).

scope.errors

class HuskyErrors(oaiface, XADC, adc, clock, trace)

Gather all the Husky error sources in one place. Use scope.errors.clear() to clear them.

scope.userio

class USERIOSettings(oaiface)

Control Husky’s USERIO (20-pin front connector) interface.

property direction

Set the direction of the USERIO data pins (D0-D7) with an 8-bit integer, where bit <x> determines the direction of D<x>; bit x = 0: D<x> is an input to Husky. bit x = 1: D<x> is driven by Husky. When scope.userio.mode is not “normal”, then this setting is controlled by the FPGA and cannot be changed by the user. Use with care.

property drive_data

8-bit data to drive on the USERIO data bus.

property fpga_mode

When scope.userio.mode = ‘fpga_debug’, selects which FPGA signals are routed to the USERIO pins. Print the scope.userio object to obtain the signal definition corresponding to the current fpga_mode setting.

property mode

Set mode for USERIO pins: “normal”: as defined by scope.userio.direction. “trace”: for target trace capture. “target_debug_jtag”: for target debugging with ChipWhisperer using MPSSE in JTAG mode “target_debug_swd”: for target debugging with ChipWhisperer using MPSSE in SWD mode “fpga_debug”: for FPGA debug (print the scope.userio object to obtain current signal definition, which is determined by scope.userio.fpga_mode). “swo_trace_plus_debug”: pins D0-D2 are used for SWO trace, D3-D7 for fpga_debug.

property status

Returns current value of header pins. LSB=D0, MSB=CK.

scope.XADC

class XADCSettings(oaiface)

Husky FPGA XADC temperature and voltage monitoring. XADC alarms are sticky and shut down generated clocks and SAD logic; the error condition must be manually cleared (scope.XADC.status = 0) to re-enable shutdown logic.

get_temp(addr=0)

Read XADC temperature. :param addr: DRP address (0: current; 32: max; 36: min) :type addr: int

Returns:

Temperature in celcius (float).

get_vcc(rail='vccint', value='current')

Read XADC vcc. :param rail: ‘vccint’, ‘vccaux’, or ‘vccbram’ :type rail: string :param value: ‘current’, ‘min’, or ‘max’ :type value: string

Returns:

voltage (float).

property max_temp

Returns the highest observed FPGA temperature.

property ot_temp_reset

FPGA over-temperature reset. When the FPGA temperature returns below this value, the error condition triggered by ot_temp_trigger is cleared.

property ot_temp_trigger

FPGA over-temperature trigger. If the FPGA temperature exceeds this value, an error is flagged, and all clock-generating modules are shut down until the temperature returns below ot_temp_reset (since they are very power hungry). Read-only.

set_temp(temp, addr=0)

Set XADC temperature thresholds. :param addr: DRP address :type addr: int :param temp: temperature threshold [celcius] :type temp: float

Returns:

Temperature in celcius (float).

property status

Read XADC alarm status bits :Getter: Returns status string.

Setter:

Clear the status error bits (they are sticky).

property temp

Returns the current FPGA temperature.

property temp_reset

FPGA user temperature reset. When the FPGA temperature returns below this value, the error condition triggered by temp_trigger is cleared.

property temp_trigger

FPGA user temperature trigger. If the FPGA temperature exceeds this value, an error is flagged, and all clock-generating modules are shut down until the temperature returns below temp_reset (since they are very power hungry).

property vccaux

Returns the current VCCaux value.

property vccbram

Returns the current VCCbram value.

property vccint

Returns the current VCCint value.

ChipWhisperer Nano Scope

Supported scopes:

class CWNano

CWNano scope object.

This class contains the public API for the CWNano hardware. It includes specific settings for each of these devices.

To connect to one of these devices, the easiest method is:

import chipwhisperer as cw
scope = cw.scope(type=scopes.CWNano)

Some sane default settings can be set using:

scope.default_setup()

For more help about scope settings, try help() on each of the ChipWhisperer scope submodules (scope.adc, scope.io, scope.glitch):

Inherits from chipwhisperer.capture.api.cwcommon.ChipWhispererCommonInterface

arm()

Arm the ADC, the trigger will be GPIO4 rising edge (fixed trigger).

capture(poll_done=False)

Raises IOError if unknown failure, returns ‘True’ if timeout, ‘False’ if no timeout

con(sn=None, **kwargs)

Connects to attached chipwhisperer hardware (Nano)

Parameters:

sn (str) – The serial number of the attached device. Does not need to be specified unless there are multiple devices attached.

Returns:

True if connection is successful, False otherwise.

default_setup()

Sets up sane capture defaults for this scope

  • 7.5MHz ADC clock

  • 7.5MHz output clock

  • 5000 capture samples

  • tio1 = serial rx

  • tio2 = serial tx

  • glitch module off

New in version 5.1: Added default setup for CWNano

dis()

Disconnects the current scope object.

Returns:

True if the disconnection was successful, False otherwise.

get_last_trace(as_int=False)

Return the last trace captured with this scope.

Can return traces as floating point values (as_int=False) or as integers.

Floating point values are scaled and shifted to be between -0.5 and 0.5.

Integer values are raw readings from the ChipWhisperer ADC. The ChipWhisperer-Lite has a 10-bit ADC, the Nano has an 8-bit ADC, and the Husky can read either 8-bits or 12-bits of ADC data.

Parameters:

as_int (bool) – If False, return trace as a float. Otherwise, return as an int.

Returns:

Numpy array of the last capture trace.

Changed in version 5.6.1: Added as_int parameter

reset_clock_phase()

Resets the target and adc clocks, resetting their phase

Warning

causes an interruption in the target clock. You may need to reset the target.

vglitch_setup(glitcht=None, default_setup=True)

Sets up sane defaults for voltage glitch

repeat = 1 ext_offset = 0

adc

class ADCSettings(usb)
property clk_freq

Set the frequency for CLKOUT. Will be rounded to nearest possible values, check results to see programmed value. Set to ‘None’ for disabling (High-Z) output.

Getter:

Returns the actual frequency for CLKOUT

Setter:

Sets CLKOUT to the nearest possible value.

property clk_src

ADC Clock source.

Getter:

Returns ‘int’ or ‘ext’ based on the clock source.

Setter:

(str) Set the ADC clock source to either internal or external: (‘int’ or ‘ext’)

property samples

Number of samples to store.

io

class GPIOSettings(usb)
property cdc_settings

Check or set whether USART settings can be changed via the USB CDC connection

i.e. whether you can change USART settings (baud rate, 8n1) via a serial client like PuTTY

Getter:

An array of length two for two possible CDC serial ports (though only one is used)

Setter:

Can set either via an integer (which sets both ports) or an array of length 2 (which sets each port)

Returns None if using firmware before the CDC port was added

property clkout

“Set the frequency for CLKOUT. Will be rounded to nearest possible values, check results to see programmed value. Set to ‘None’ for disabling (High-Z) output.

property nrst

The state of the NRST pin.

See pdic for more information.

property pdic

The state of the PDIC pin output pin.

This is a GPIO pin. The following values are allowed:

  • “high” / True: logic 1

  • “low” / False: logic 0

  • “disabled” / “default” / “high_z” / None: undriven

Getter:

Return one of “high”, “low”, or “high_z”

Setter:

Set the pin’s state Raises: ValueError if new state not listed above

property pdid

The state of the PDID pin.

See pdic for more information.

property tio1

The function of the Target IO1 pin.

TIO1 can be used for the following functions:

  • “serial_rx”: UART input

Default value is “serial_rx”.

Getter:

Return None

Setter:

Set the Target IO1 mode. Raises: ValueError if new value is not one of the above modes

property tio2

The function of the Target IO2 pin.

TIO2 can be used for the following functions:

  • “serial_tx”: UART output

Default value is “serial_tx”.

Getter:

Return None

Setter:

Set the Target IO2 mode. Raises: ValueError if new value is not one of the above modes

property tio3

The function of the Target IO3 pin.

TIO3 can be used for the following functions:

  • “high_z” / None: High impedance input

  • “gpio_low” / False: Driven output: logic 0

  • “gpio_high” / True: Driven output: logic 1

  • “gpio_disabled”: Driven output: no effect

Default value is “high_z”.

Getter:

Return one of the above strings

Setter:

Set the Target IO3 mode. Raises: ValueError if new value is not one of the above modes

property tio4

The function of the Target IO4 pin.

TIO4 can be used for the following functions:

  • “high_z” / None: High impedance input

Default value is “high_z”. Typically, this pin is used as a trigger input.

Getter:

Return None

Setter:

Set the Target IO4 mode Raises: ValueError if new value is not one of the above modes

glitch

class GlitchSettings(usb)
property ext_offset

Offset from rising edge of trigger & when glitch gets inserted, approx = 8.3 ns * ext_offset

manualTrigger()

Manually trigger the glitch

property repeat

Width of glitch in cycles (approx = 8.3 ns * width)

Common Scope Attributes

The following methods and attributes are common to all scopes, as well as the CW305/CW310:

class ChipWhispererCommonInterface
enable_MPSSE(enable=True)

Enable or disable MPSSE mode

check_feature(name, raise_exception=False)

Check if a feature is available on this ChipWhisperer

feature_list()

Returns a list of supported features that depend on device/firmware version

Return type:

List[str]

_getNAEUSB()
Return type:

NAEUSB

get_serial_ports()

Get serial ports associated with a ChipWhisperer

New in version 5.5: Add get_serial_ports()

Return type:

Optional[List[Dict[str, int]]]

upgrade_firmware(fw_path=None)

Attempt a firmware upgrade. See https://chipwhisperer.readthedocs.io/en/latest/firmware.html for more information.

New in version 5.6.1: Improved programming interface

reset_sam3u()

Reset the ChipWhisperer’s microcontroller

New in version 5.6.1: Add common cw interface

latest_fw

Get the newest firmware as a dict with elements major, minor and debug

Return type:

Dict[str, int]

latest_fw_str
Return type:

str

fw_version

Get current firmware version as a dict with elements major, minor and debug

Return type:

Dict[str, int]

fw_version_str

A string of the firmware version:

'x.y.z'
Return type:

str

sam_build_date

The date the SAM3U firmware was built on

New in version 5.6.1: Added sam build date to chipwhisperer

Return type:

str

sn

The USB serial number of this scope.

Can be passed to cw.scope() to specify which ChipWhisperer to connect to

Return type:

str

Firmware Update

A simplified method of updating firmware has been added as of ChipWhisperer 5.6.0. This new method is documented at Updating Firmware.

For versions 5.5.2 and below, you must follow the directions below:

See also

You can also use the BOSSA BOSSA utiltiy to reflash the SAM3U firmware. If you need to build it from source, NewAE keeps a slightly modified version of the source at https://github.com/newaetech/BOSSA. This utility does NOT support the CWNano.

class SAMFWLoader(scope=None, logfunc=<built-in function print>)

Object for easy reprogramming of ChipWhisperers

See https://chipwhisperer.readthedocs.io/en/latest/firmware.html for information on how to update.

Can autoprogram if the ChipWhisperer’s firmware has not already been erased.

Autoprogram Example:

  1. Attach the scope part of the hardware to your computer.

  2. Connect to the scope using:

    import chipwhisperer as cw

# Connect to scope
scope = cw.scope()

# If using CW305, connect to target as well
# Can ignore msg about no bitstream
target = cw.target(None, cw.targets.CW305)

  1. Call the auto_program() method:

    programmer = cw.SAMFWLoader(scope=scope)
# if CW305
# programmer = cw.SAMFWLoader(scope=target)

programmer.auto_program()

Example

  1. Attach the scope part of the hardware to your computer.

  2. Connect to the scope using:

    import chipwhisperer as cw

# Connect to scope
scope = cw.scope()

# If using CW305, connect to target as well
# Can ignore msg about no bitstream
target = cw.target(None, cw.targets.CW305)

  3. Place the hardware in bootloader mode using:

    # use created scope object from previous step
programmer = cw.SAMFWLoader(scope=scope)

# or CW305 target object
programmer = cw.SAMFWLoader(scope=target)

# WARNING: this will erase the firmware on the device
# and make it unusable until reprogrammed.
programmer.enter_bootloader(really_enter=True)

  4. Unplug then plug in the hardware into your computer again. The device should be shown as BOSSA in the device manager on Windows. Make not of the port number the BOSSA device is attached to (for example: COM1, or COM2, and so on)

  5. Program the SAM3U with:

    import chipwhisperer as cw
programmer = cw.SAMFWLoader(scope=None)

    Two methods:

    1. Using the firmware_path:

      # the firmware file is included with chipwhisperer
# and is the .bin file from the FW build
# (ChipWhisperer Lite) chipwhisperer\hardware\capture\chipwhisperer-lite\sam3u_fw\SAM3U_VendorExample\Debug
# directory.
programmer.program(<port>, <path to firmware file>)

    2. Using the hardware_type (recommended):

      programmer.program(<port>, hardware_type='cwlite')
programmer.program(<port>, hardware_type='cwnano')
programmer.program(<port>, hardware_type='cw305')
programmer.program(<port>, hardware_type='cw1200')

    On Linux instead of ‘COM#’ use the Linux equivalent (usually /dev/ttyACM# or /dev/ttyUSB#)

  6. Once the programming is done. Unplug then plug in the hardware into your computer again. The device should show up as a ChipWhisperer again.

enter_bootloader(really_enter=False)

Enters the bootloader of the ChipWhisperer by erasing the flash

Only use this if you want to erase the scope’s firmware (i.e. the ChipWhisperer Lite). This does NOT erase the firmware of a target ( i.e. an STM32 target). Will raise a Warning the first time an erase is attempted and really_enter=False.

Parameters:

really_enter (bool, optional) – If True, enter the bootloader without ever raising a warning. If False, raise a warning if this is the user’s first time calling it.

Raises:

Warning – really_enter=False and user hasn’t seen this warning before

program(port, fw_path=None, hardware_type=None, bypass_warning=False)

Program the ChipWhisperer with new firmware.

Parameters:

  • port (str) – Serial port that the ChipWhisperer bootloader is on

  • fw_path (str) – Path to firmware, if specified leave out hardware type.

  • hardware_type (str) – The type of hardware that you want to program. If specified leave out fw_path. Valid types: (cwlite, cwnano, cw305, cw1200)

Returns:

True if programming succeeded, False if it didn’t

auto_program(fw_path=None)

Erase and program firmware of ChipWhisperer

Autodetects comport and hardware type.