Secure MPSoC FPGA with embedded hard core processor system and method
A system and method for securing a system-on-chip (SoC) field programmable gate array (FPGA) is provided, wherein the SoC FPGA includes an FPGA fabric, a soft core processor hosted within the FPGA fabric, a hard core processor, and a secure boot environment for the SOC FPGA. Monitoring logic monitors for a change in the FPGA fabric. External watchdog logic is configured to receive a trigger signal from the monitoring logic, and force the hard core processor(s) of the SoC FPGA into a reset state with no ability to recover unless power is cycled when a change has been made to the FPGA fabric, so as to provide a “fail secure” scenario. The monitoring logic may be firmware hosted on the FPGA fabric, software hosted on the soft core, software hosted on the hard core, and/or external hard logic.
1 . A system for securing a system-on-chip (SoC) field programmable gate array (FPGA), the system comprising:
a SoC FPGA having an FPGA fabric, at least one soft core processor hosted within the FPGA fabric, and at least one hard core processor;
a secure boot environment for the SoC FPGA;
monitoring logic configured to monitor for a change in the FPGA fabric; and
external watchdog logic configured to:
receive a trigger signal from the monitoring logic; and
force hard core processors of the SoC FPGA into a reset state with no ability to recover unless power is cycled to the SoC FPGA when a change has been made to the FPGA fabric.
2 . The system of claim 1 , wherein the external watchdog logic comprises one or more watchdog timer circuit that latches and sends a reset signal to force the reset state upon expiration of a timer without receiving a trigger signal from the monitoring logic.
3 . The system of claim 2 , wherein a duration of the timer is configured to be shorter than a time period required to reprogram the SoC FPGA.
4 . The system of claim 2 , wherein the monitoring logic is hosted in the FPGA fabric and provides a timer reset signal as the trigger signal to the one or more watchdog timer circuit prior to expiration of the timer when there is no change to the FPGA fabric.
5 . The system of claim 4 , wherein the monitoring logic is hosted in the at least one soft core processor hosted in the FPGA fabric.
6 . The system of claim 4 , wherein the monitoring logic is hosted in normal logic functions of the FPGA fabric and includes at least one logic block that, if overwritten, will fail to provide the timer reset signal.
7 . The system of claim 2 , wherein the monitoring logic is hosted in software executing on the at least one hard core processor and provides a timer reset signal as the trigger signal to the one or more watchdog timer circuit prior to expiration of the timer when there is no change to the FPGA fabric.
8 . The system of claim 1 , wherein the external watchdog logic sends a reset signal to force the reset upon receiving a trigger signal from the monitoring logic.
9 . The system of claim 8 , wherein the monitoring logic is hosted in external hard logic and provides the trigger signal upon detecting a logic change in the FPGA fabric.
10 . The system of claim 8 , wherein the monitoring logic is hosted in firmware hosted in the FPGA fabric and provides the trigger signal upon detecting a logic change in the FPGA fabric.
11 . The system of claim 8 , wherein the monitoring logic is hosted in software executing on the at least one soft core hosted by the FPGA fabric and provides the trigger signal upon detecting a logic change in the FPGA fabric.
12 . The system of claim 8 , wherein the monitoring logic is hosted in software executing on the at least one hard processor and provides the trigger signal upon detecting a logic change in the FPGA fabric.
13 . The system of claim 1 , wherein the external watchdog logic comprises an instant-on non-volatile FPGA.
14 . The system of claim 1 , further comprising additional monitoring logic configured to monitor for changes in software executing on the at least one hard core processor, wherein the external watchdog logic is further configured to:
receive an additional trigger signal from the additional monitoring logic; and
force hard core processors of the SoC FPGA into a reset state with no ability to recover unless power is cycled to the SoC FPGA when a change in the software is detected.
15 . A secure system-on-chip (SoC) field programmable gate array (FPGA), the secure SoC FPGA comprising:
an FPGA fabric;
at least one soft core processor hosted within the FPGA fabric;
at least one hard core processor;
a secure boot environment;
monitoring logic configured to monitor for a change in the FPGA fabric; and
watchdog logic external to the FPGA fabric and at least one hard core processor, the watchdog logic configured to:
receive a trigger signal from the monitoring logic based upon whether or not a change has been detected; and
force hard core processors of the SoC FPGA into a reset state with no ability to recover unless power is cycled to the SoC FPGA when a change is made to the FPGA fabric.
16 . The secure SoC FPGA of claim 15 , wherein the monitoring logic includes at least one of firmware hosted on the FPGA fabric, software hosted on the at least one soft core, software hosted on the at least one hard core, and hard logic external to the FPGA fabric and at least one hard core processor.
17 . The secure SoC FPGA of claim 15 , wherein the trigger signal is a timer reset signal provided to the watchdog logic when a change has not been detected,
wherein the watchdog logic comprises one or more watchdog timer circuit that that latches and sends a reset signal to force the reset upon expiration of a timer without receiving the timer reset signal, and
wherein a duration of the timer is configured to be shorter than a time period required to reprogram the SoC FPGA.
18 . A method for securing a system-on-chip (SoC) field programmable gate array (FPGA), the method comprising:
operating a SoC FPGA in a secure boot environment, wherein the SoC FPGA includes an FPGA fabric, at least one soft core processor hosted within the FPGA fabric, and at least one hard core processor;
monitoring the FPGA fabric for a change;
providing a trigger signal to external watchdog logic based on whether or not a change has been detected; and
upon a determination that a change to the FPGA fabric has been detected, the external watchdog logic forcing hard core processors of the SoC FPGA into a reset state with no ability to recover unless power is cycled to the SoC FPGA.
19 . The method of claim 18 , wherein monitoring the FPGA fabric for a change is performed by at least one of firmware hosted on the FPGA fabric, software hosted on the at least one soft core, software hosted on the at least one hard core, and external hard logic.
20 . The method of claim 18 , wherein the trigger signal is a timer reset signal provided to the external watchdog logic when a change has not been detected,
wherein the external watchdog logic comprises one or more watchdog timer circuit that that latches and sends a reset signal to force the reset upon expiration of a timer without receiving the timer reset signal, and
wherein a duration of the timer is configured to be shorter than a time period required to reprogram the SoC FPGA.