External PROGRAM_B Intercept (Prevention and Detection) - External PROGRAM_B Intercept (Prevention and Detection) - XAPP1098

Not all memory elements in the FPGA are cleared upon configuration. For example, there might be GTH and GTY transceivers with FIFOs in use that retain state even after the external PROGRAM_B pin is asserted (assertion of PROGRAM_B causes the FPGA to reset and become reconfigured via the bitstream). An attacker could potentially assert the PROGRAM_B pin and replace the user bitstream with their own bitstream, one that is designed to dump out the contents of the uncleared memory elements after the FPGA is configured. By using the PROGRAM_B intercept feature such as the PROGRAM_B request/acknowledge pair on the STARTUP block PREQ/PACK, you can indefinitely delay the reconfiguration of the FPGA so that these memory elements can first be cleared by your design or any other housekeeping tasks can be completed before allowing a PROGRAM_B to happen.

Another use case for PROGRAM_B intercept could be a system (when fielded) that should never see PROGRAM_B assertion while active—its mere presence signifies a tamper event. One of the first things an attacker might do is to assert the PROGRAM_B to observe the start-up behavior of the FPGA. If PREQ goes active in your design, it could invoke a penalty and then allow the PROGRAM_B to occur by asserting PACK.

Whenever an encrypted bitstream with the PROGRAM_B intercept security feature enabled has been loaded and the PROGRAM_B pin is asserted externally (or an internal IPROG command is sent to the ICAPE3), the PREQ output is asserted High on the STARTUPE3 block. Configuration is held off indefinitely until you drive the PACK input High (rising-edge sensitive) or until the device is power cycled.

The following is an example VHDL instantiation of the STARTUPE3 block with the correct security generic set and the PREQ/PACK signal connections:

STARTUP_U0 : STARTUPE3
  generic map (
    PROG_USR => TRUE ) -- turn on PROGRAM_B intercept security feature
  port map (
    CFGCLK    => open,
    CFGMCLK   => cfgmclk_signal,
    DI        => open,
    EOS       => open,
    PREQ      => preq_signal, -- PROGRAM request to FPGA logic output
    DO        => (others => '0'),
    DTS       => (others => '0'),
    FCSBO     => '0',
    FCSBTS    => '0',
    GSR       => gsr_signal,
    GTS       => gts_signal,
    KEYCLEARB => keyclearb_signal,
    PACK      => pack_signal, -- PROGRAM acknowledge input (rising edge)
    USRCCLKO  => '0',
    USRCCLKTS => '0',
    USRDONEO  => '0',
    USRDONETS => '0'
);