Internal Configuration Access Port Research Articles

On the Malicious Potential of Xilinx’s Internal Configuration Access Port (ICAP)

Field Programmable Gate Arrays (FPGAs) have become increasingly popular in computing platforms. With recent advances in bitstream format reverse engineering, the scientific community has widely explored static FPGA security threats. For example, it is now possible to convert a bitstream to a netlist, revealing design information, and apply modifications to the static bitstream based on this knowledge. However, a systematic study of the influence of the bitstream format understanding in regards to the security aspects of the dynamic configuration process, particularly for Xilinx’s Internal Configuration Access Port (ICAP), is lacking. This article fills this gap by comprehensively analyzing the security implications of ICAP interfaces, which primarily support dynamic partial reconfiguration. We delve into the Xilinx bitstream file format, identify misconceptions in official documentation, and propose novel configuration (attack) primitives based on dynamic reconfiguration, i.e., create/read/update/delete circuits in the FPGA, without requiring pre-definition during the design phase. Our primitives are consolidated in a novel Stealthy Reconfigurable Adaptive Trojan framework to conceal Trojans and evade state-of-the-art netlist reverse engineering methods. As FPGAs become integral to modern cloud computing, this research presents crucial insights on potential security risks, including the possibility of a malicious tenant or provider altering or spying on another tenant’s configuration undetected.

A Methodology for Accelerating FPGA Fault Injection Campaign Using ICAP

The increasing complexity of System-on-Chip (SoC) and the ongoing technology miniaturization on Integrated Circuit (IC) manufacturing processes makes modern SoCs more susceptible to Single-Event Effects (SEE) caused by radiation, even at sea level. To provide realistic estimates at a low cost, efficient analysis techniques capable of replicating SEEs are required. Among these methods, fault injection through emulation using Field-Programmable Gate Array (FPGA) enables campaigns to be run on a Circuit Under Test (CUT). This paper investigates the use of an FPGA architecture to speed up the execution of fault campaigns. As a result, a new methodology for mapping the CUT occupation on the FPGA is proposed, significantly reducing the total number of faults to be injected. In addition, a fault injection technique/flow is proposed to demonstrate the benefits of cutting-edge approaches. The presented technique emulates Single-Event Transient (SET) in all combinatorial elements of the CUT using the Internal Configuration Access Port (ICAP) of Xilinx FPGAs.

Design and Implementation of a Reliable Reconfigurable Imaging System

Because of SRAM sensitivity to radiation, SRAM-based FPGA systems deployed in harsh environments require error mitigation methods to reduce their overall downtime. This paper presents a fault-tolerant reconfigurable imaging system that relies on the DPR feature for correcting errors in the configuration memory and loading camera system IPs. The system reliability is evaluated by injecting faults in the FPGA configuration memory at runtime using the Xilinx SEM IP. The faults are injected internally using the Internal Configuration Access Port (ICAP), which is shared between the fault injection core and system parts. The results showed that 95% of the errors can by corrected automatically. This paper also proposes a fast-Built-in-Self-Test (BIST) mitigation technique to reduce the overall downtime in case of errors. This technique can reduce the recovery time by 80%. Moreover, Triple Modular Redundancy (TMR) is used to increase the overall reliability without significantly increasing the resource overhead.

VR-ZYCAP: A Versatile Resourse-Level ICAP Controller for ZYNQ SOC

Hybrid architectures integrating a processor with an SRAM-based FPGA fabric—for example, Xilinx ZynQ SoC—are increasingly being used as a single-chip solution in several market segments to replace multi-chip designs. These devices not only provide advantages in terms of logic density, cost and integration, but also provide run-time in-field reconfiguration capabilities. However, the current reconfiguration capabilities provided by vendor tools are limited to the module level. Therefore, incremental run-time configuration memory changes require a lengthy compilation time for off-line bitstream generation along with storage and reconfiguration time overheads with traditional vendor methodologies. In this paper, an internal configuration access port (ICAP) controller that provides a versatile fine-grain resource-level incremental reconfiguration of the programmable logic (PL) resources in ZynQ SoC is presented. The proposed controller implemented in PL, called VR-ZyCAP, can reconfigure look-up tables (LUTs) and Flip-Flops (FF). The run-time reconfiguration of FF is achieved through a reset after reconfiguration (RAR)-featured partial bitstream to avoid the unintended state corruption of other memory elements. Along with versatility, our proposed controller improves the reconfiguration time by 30 times for FFs compared to state-of-the-art works while achieving a nearly 400-fold increase in speed for LUTs when compared to vendor-supported software approaches. In addition, it achieves competitive resource utilization when compared to existing approaches.

FPGA-Based Reliable Fault Secure Design for Protection against Single and Multiple Soft Errors

Field programmable gate arrays (FPGAs) are increasingly used in industry (e.g., biomedical, space, and automotive industries). FPGAs are subjected to single, as well as multiple event upsets (SEUs and MEUs), due to the continuous shrinking of transistor dimensions. These upsets inevitably decrease system lifetime. Fault-tolerant techniques are often used to mitigate these problems. In this research, penta and hexa modular redundancy, as well as dynamic partial reconfiguration (DPR), are used to increase system reliability. We show, depending on the relative rates of the SEUs and MEUs, that penta modular redundancy has a higher reliability than hexa modular redundancy, which is a counter-intuitive result in some cases since increasing redundancy is expected to increase reliability. Focusing on penta modular redundancy, an error detection and recovery mechanism (voter) is designed. This mechanism uses the internal configuration access port (ICAP) and its associated controller, as well as DPR to mitigate SEUs and MEUs. Then, it is implemented on Xilinx Vivado tools targeting the Kintex7 7k410tfbg676 device. Finally, we show how to render this design fault secure in the event that SEUs or MEUs affect the voter itself. This fault secure voter either produces the correct output or gives an indication that the output is incorrect.

FPGA implementation of dynamically reconfigurable IoT security module using algorithm hopping

Internet of Things (IoT) is a promising technology that is continuously spreading around the world leading to many challenges facing cryptographic designers who are trying to fulfill the security standards of IoT constrained devices. In this work, a new design is proposed that adds a new dimension of security by using the concept of frequency hopping to generate a pseudo-random pattern for switching between 5 lightweight cryptographic ciphers: AEGIS, ASCON, COLM, Deoxys and OCB that are participating in the Competition for Authenticated Encryption, Security, Applicability, and Robustness (CAESAR). The proposed design exploits the advantages of Dynamic Partial Reconfiguration (DPR) technology in Field Programmable Gate Arrays (FPGAs) to switch between the 5 ciphers using Internal Configuration Access Port controller (AXI-HWICAP) providing a decrease of 58% and 80% in area utilization and power consumption respectively. The design is synthesized using Xilinx Vivado 2015.2 and mounted on Zynq evaluation board (XC7Z020LG484-1).

An Autonomous, Self-Authenticating, and Self-Contained Secure Boot Process for Field-Programmable Gate Arrays

Secure booting within a field-programmable gate array (FPGA) environment is traditionally implemented using hardwired embedded cryptographic primitives and non-volatile memory (NVM)-based keys, whereby an encrypted bitstream is decrypted as it is loaded from an external storage medium, e.g., Flash memory. A novel technique is proposed in this paper that self-authenticates an unencrypted FPGA configuration bitstream loaded into the FPGA during the start-up. The internal configuration access port (ICAP) interface is accessed to read out configuration information of the unencrypted bitstream, which is then used as input to a secure hash function SHA-3 to generate a digest. In contrast to conventional authentication, where the digest is computed and compared with a second pre-computed value, we use the digest as a challenge to a hardware-embedded delay physical unclonable function (PUF) called HELP. The delays of the paths sensitized by the challenges are used to generate a decryption key using the HELP algorithm. The decryption key is used in the second stage of the boot process to decrypt the operating system (OS) and applications. It follows that any type of malicious tampering with the unencrypted bitstream changes the challenges and the corresponding decryption key, resulting in key regeneration failure. A ring oscillator is used as a clock to make the process autonomous (and unstoppable), and a novel on-chip time-to-digital-converter is used to measure path delays, making the proposed boot process completely self-contained, i.e., implemented entirely within the re-configurable fabric and without utilizing any vendor-specific FPGA features.

Reconfiguration Control Networks for FPGA-based TMR systems with modular error recovery

Field-Programmable Gate Arrays (FPGAs) provide ideal platforms for meeting the computational requirements of future space-based processing systems. However, FPGAs are susceptible to radiation-induced Single Event Upsets (SEUs). Techniques for dynamically reconfiguring corrupted modules of Triple Modular Redundant(TMR) components are well known. However, most of these techniques utilize resources that are themselves susceptible to SEUs to transfer reconfiguration requests from the TMR voters to a central reconfiguration controller. This paper evaluates the impact of these Reconfiguration Control Networks (RCNs) on the system’s reliability and performance. We provide an overview of RCNs reported in the literature and compare them in terms of dependability, scalability and performance. Most importantly, we compare the performance of soft networks with that of a hard network that utilizes the Internal Configuration Access Port(ICAP) available in advanced Xilinx devices to periodically read the TMR voter states. We have implemented our designs on a Xilinx Artix-7 FPGA to assess the resulting resource utilization and performance as well as to evaluate their soft error vulnerability using analytical and fault injection techniques. Results show that, of the RCN topologies studied, the ICAP-based approach is the most reliable despite having the highest network latency. We also conclude that a module-based recovery approach is less reliable than scrubbing unless the RCN is implemented with redundancy and repaired when it suffers from configuration memory errors.

MiCAP-Pro: a high speed custom reconfiguration controller for Dynamic Circuit Specialization

Dynamic Circuit Specialization (DCS) is used to optimize parts of an application and switch between the specialized parts utilizing Partial Reconfiguration at the run-time. The time needed to reconfigure the FPGA is a limiting factor for DCS. The reconfiguration controller, such as Xilinx Hardware Internal Configuration Access Port (HWICAP), enables an embedded processor to read or write the configuration data into the FPGAs configuration memory through the Internal Configuration Access Port (ICAP). However, it introduces a consequential delay and uses a significant amount of FPGA resources such as LookUp Tables. It is thus the most power hungry part within the DCS system. In our previous contribution, we proposed the Micro-reconfigurable Configuration Access Port (MiCAP), a custom lightweight reconfiguration controller specifically designed to implement DCS on the Zynq-SoC FPGA platform, resulting in increased reconfiguration speed and reduced FPGA resources. Even though, both HWICAP and MiCAP suffer from a data-transfer bottleneck during reconfiguration resulting in a reduced throughput by a factor 20$$\times $$× compared to the throughput the ICAP can handle. To further reduce the reconfiguration time, while keeping the DCS capabilities, we propose the MiCAP-Pro that has an AXI-DMA engine. The DMA increases the reconfiguration speed by a factor of 3 over the MiCAP and the HWICAP. However, this improvement costs about four times more FPGA resources than the HWICAP for the AXI-DMA engine. We also perform a power and energy analysis of the AXI-HWICAP, MiCAP and MiCAP-Pro. Our results show that the MiCAP and MiCAP-Pro consume nine and four times less energy than the AXI-HWICAP respectively.

Analyzing the Effectiveness of a Frame-Level Redundancy Scrubbing Technique for SRAM-based FPGAs

Radiation effects such as soft errors are the major threat to the reliability of SRAM-based FPGAs. This work analyzes the effectiveness in correcting soft errors of a novel scrubbing technique using internal frame redundancy called Frame-level Redundancy Scrubbing (FLR-scrubbing). This correction technique can be implemented in a coarse grain TMR design. The FLR-scrubbing technique was implemented on a mid-size Xilinx Virtex-5 FPGA device used as a case study. The FLR-scrubbing technique was tested under neutron radiation and fault injection. Implementation results demonstrated minimum area and energy consumption overhead when compared to other techniques. The time to repair the fault is also improved by using the Internal Configuration Access Port (ICAP). Neutron radiation test results demonstrated that the proposed technique is suitable for correcting accumulated SEUs and MBUs.

Block RAM-based architecture for real-time reconfiguration using Xilinx® FPGAs

Despite the advantages dynamic reconfiguration adds to a system, it only improves system performance if the execution time exceeds the configuration time. As a result, dynamic reconfiguration is only capable of improving the performance of quasi-static applications. In order to improve the performance of dynamic applications, researchers focus on improving the reconfiguration throughput. These approaches are mostly limited by the bus commonly used to connect the configuration controller to the memory, which contributes to the configuration time. A method proposed to ameliorate this overhead is an architecture utilizing localised block RAM (BRAM) connected to the configuration controller to store the configuration bitstream. The aim of this paper is to illustrate the advantages of the proposed architecture, especially for reconfiguring real-time applications. This is done by validating the throughput of the architecture and comparing this to the maximum theoretical throughput of the internal configuration access port (ICAP). It was found that the proposed architecture is capable of reconfiguring an application within a time-frame suitable for real-time reconfiguration. The drawback of this method is that the BRAM is extremely limited and only a discrete set of configurations can be stored. This paper also proposes a method on how this can be mitigated without affecting the throughput.

AC_ICAP: A Flexible High Speed ICAP Controller

The Internal Configuration Access Port (ICAP) is the core component of any dynamic partial reconfigurable system implemented in Xilinx SRAM-based Field Programmable Gate Arrays (FPGAs). We developed a new high speed ICAP controller, named AC_ICAP, completely implemented in hardware. In addition to similar solutions to accelerate the management of partial bitstreams and frames, AC_ICAP also supports run-time reconfiguration of LUTs without requiring precomputed partial bitstreams. This last characteristic was possible by performing reverse engineering on the bitstream. Besides, we adapted this hardware-based solution to provide IP cores accessible from the MicroBlaze processor. To this end, the controller was extended and three versions were implemented to evaluate its performance when connected to Peripheral Local Bus (PLB), Fast Simplex Link (FSL), and AXI interfaces of the processor. In consequence, the controller can exploit the flexibility that the processor offers but taking advantage of the hardware speed-up. It was implemented in both Virtex-5 and Kintex7 FPGAs. Results of reconfiguration time showed that run-time reconfiguration of single LUTs in Virtex-5 devices was performed in less than 5 μs which implies a speed-up of more than 380x compared to the Xilinx XPS_HWICAP controller.

Achieving energy efficiency through runtime partial reconfiguration on reconfigurable systems

One major advantage of reconfigurable computing systems is their ability to reconfigure hardware at runtime. In this paper, we study the feasibility of achieving energy efficiency in reconfigurable computing systems (e.g., FPGAs) through runtime partial reconfiguration (PR) techniques. In the ideal scenario, we use a hardware accelerator to accelerate certain parts of the program execution; when the accelerator is not active, we use partial reconfiguration to unload it to reduce power consumption. Since the reconfiguration process may introduce a high energy overhead, it is unclear whether this approach is efficient. To approach this problem, we first analytically identify the conditions under which partial reconfiguration can reduce energy consumption. Our results indicate that the key to reduce partial reconfiguration energy overhead is to minimize the time overhead of the reconfiguration process. Based on this analysis, we design and implement a fast reconfiguration engine that achieves close-to-ideal throughput on Xilinx Virtex-4 FPGAs. Our fast reconfiguration engine utilizes a master-slave DMA pair to stream data between the SRAM and the Internal Configuration Access Port (ICAP). We experimentally verify our proposed solutions and compare our design to existing energy reduction techniques, such as clock gating. The results of our study show that by using partial reconfiguration to eliminate the power consumption of the accelerator when it is inactive, we can accelerate program execution and at the same time reduce the overall energy consumption by half.

On line self recovery of embedded multi-processor SOC on FPGA using dynamic partial reconfiguration

This paper proposes anerror recovery method for FPGA Systems On Chip (SOC) with multiple processors. This method is effective against soft errors in the configuration memory (i.e., the errors caused by high energy radiation also known as Single Event Upsets). The system tests itself without a visible downtime to the end user. The recovery algorithm checks the configuration memory of the SRAM based FPGA through the internal configuration access port and repairs the faulty configuration bits through partial reconfiguration.DOI: http://dx.doi.org/10.5755/j01.itc.41.2.896

Self-reconfigurable approach for computation-intensive motion estimation algorithm in H.264/AVC

The authors propose a self-reconfigurable approach to perform H.264/AVC variable block size motion estimation computation on field-programmable gate arrays. We use dynamic partial reconfiguration to change the hardware architecture of motion estimation during run-time. Hardware adaptation to meet the real-time computing requirements for the given video resolutions and frame rates is performed through self-reconfiguration. An embedded processor is used to control the reconfiguration of partial bitstreams of motion estimation adaptively. The partial bitstreams for different motion estimation computation arrays are compressed using LZSS algorithm. On-chip BlockRAM is used as a cache to pre-store the partial bitstreams so that run-time reconfiguration can be fully utilized. We designed a hardware module to fetch the pre-stored partial bitstream from BlockRAM to an internal configuration access port. Comparison results show that our motion estimation architecture improves toward data reuse, and the memory bandwidth overhead is reduced. Using our self-reconfigurable platform, the reconfiguration overhead can be removed and 367 MB/sec reconfiguration rate can be achieved. The experimental results show that the external memory accesses are reduced by 62.4% and it can operate at a frequency of 91.7 MHz.

Reconfiguration time overhead on field programmable gate arrays: reduction and cost model

Partial reconfiguration suffers from low performance and thus its use is limited when the reconfiguration overhead is too high compared to the task execution time. To overcome this issue, the authors present a fast internal configuration access port (ICAP) controller, FaRM, providing high-speed configuration and easy-to-use readback capabilities, reducing configuration overhead as much as possible. In order to enhance performance, FaRM uses techniques such as master accesses, ICAP overclocking, bitstream pre-load into a controller and bitstream compression technique, Offset-run length encoding (RLE), which is an improvement of the RLE algorithm. Combining these approaches allows us to achieve an ICAP theoretical throughput of 800 MB/S at 200 MHz. In order to complete our approach, we provide a cost model for the reconfiguration overhead for the system level that can be used during the early stages of development. The authors tested their approach on an Advanced Encryption Standard AES encryption/decryption architecture.

A Fault Injection Analysis of Linux Operating on an FPGA-Embedded Platform

An FPGA-based Linux test-bed was constructed for the purpose of measuring its sensitivity to single-event upsets. The test-bed consists of two ML410 Xilinx development boards connected using a 124-pin custom connector board. The Design Under Test (DUT) consists of the “hard core” PowerPC, running the Linux OS and several peripherals implemented in “soft” (programmable) logic. Faults were injected via the Internal Configuration Access Port (ICAP). The experiments performed here demonstrate that the Linux-based system was sensitive to 199,584 or about 1.4 percent of all tested bits. Each sensitive bit in the bit-stream is mapped to the resource and user-module to which it configures. A density metric for comparing the reliability of modules within the system is presented. Using this density metric, we found that the most sensitive user module in the design was the PowerPC's direct connections to the DDR2 memory controller.

Minimizing the runtime partial reconfiguration overheads in reconfigurable systems

Configuration overhead is a major performance bottleneck of the partial reconfiguration process. In this paper, we propose a combination of two techniques to minimize the partial reconfiguration performance overhead. First, we design and implement fully streaming DMA engines to achieve a near perfect configuration throughput. Second, we exploit the configuration data redundancy through Run-Length Encoding to compress the configuration bitstreams, and we implement an intelligent ICAP (Internal Configuration Access Port) controller to perform decompression at runtime. The results show that our design achieve an effective configuration data transfer throughput that well surpasses the upper bound of data transfer throughput, 400 Mbytes/s. Specifically, our fully stream DMA engines reduce the configuration time from the range of seconds to the range of milliseconds, a more than 1000-fold improvement. In addition, our simple compression scheme achieves significant reduction of bitstream size and results in a decompression circuit with negligible hardware overhead.

A Bit-Rate Aware Scalable H.264/AVC Deblocking Filter Using Dynamic Partial Reconfiguration

In H.264/AVC, a deblocking filter improves visual quality by reducing the presence of blocking artifacts in decoded video frames. The deblocking filter accounts for one third of the computational complexity of the decoder. This paper exploits the scalability on the hardware and the algorithmic level to synergize the performance and to reduce the computational complexity. First, we propose a modular deblocking filter architecture which can be scaled to adapt to the required computing capability for various bit-rates, resolutions, and frame rate of video sequences. The scalable architecture is based on FPGA using dynamic partial reconfiguration. This desirable feature of FPGAs makes it possible for different hardware configurations to be implemented during run-time. The proposed design can be scaled to filter up to four different edges simultaneously, resulting in significant reduction of total processing time. Secondly, our experiments show that significant reduction in computational complexity can be achieved by the increased presence of skipped macroblocks at lower bit-rates, thus, avoiding redundant filtering operations. The implemented architecture is evaluated using the Xilinx Virtex-4 ML410 FPGA board. The design operates at a maximum frequency of 103 MHz. The reconfiguration is done through Internal Configuration Access Port (ICAP) to achieve maximum performance needed by real time applications.

MetaWire: using FPGA configuration circuitry to emulate a network-on-chip

Although there have been many reported implementations of networks-on-chip (NoCs) on FPGAs, they have not seen the same acceptance as NoCs on ASICs. One reason is that communication on a field programmable gate array (FPGA) is already costly because of the die resources and time delays inherent in the reconfigurable structure. Layering another general-purpose network on top of the reconfigurable network simply incurs too many performance penalties. There is, however, already a largely unused, global network available in FPGAs. As a proof-of-concept, we demonstrate that the Xilinx FPGA configuration circuitry, which is normally idle during system operation, can function as a relatively high-performance NoC. MetaWire performs transfers through an overclocked Virtex-4 internal configuration access port and is shown to provide a bandwidth exceeding 200 MB/s.