3.6 Digests
(Ask a Question)Digests are used for protecting data integrity. In PolarFire®, digests are used to protect the integrity of the user design programmed into the device as well as the programming files used for device programming. Digests are the result of the SHA-256 hash executed over the programmed device content. The resulting digest value is highly dependent on the device programming information and can be used with high confidence to determine a change in the content programmed into the device.
To assure the integrity of the user design programmed into the device, the device system controller generates digests, known as Component Digests, for each component in the device. These component digests are calculated and stored within the device during device programing. Multiple digests are calculated including factory and security segment digests, FPGA fabric component digest, sNVM and eNVM (for PolarFire SoC FPGA only) digests for pages marked as ROM. These digests can be verified on-demand by the user, either internally using a system service, or externally using a programming instruction. In addition, the user can automatically run digest checks on each power-up. These checks assure no device configuration changes occurred, either maliciously or naturally, since the component was last programmed. Any mismatch in the digests checks is an indication that the programmed content, currently residing in the device, does not match the content previously programmed into the device during device programming. The device must be reprogrammed to correct this mismatch.
| Digest Name | Description |
|---|---|
| Fabric digest (CHECK FABRIC digest) | Digest of fabric configuration |
| Fabric configuration data digest (CC Digest) | Digest of fabric configuration parameters such as cycle count, design version, and back level protection value |
| sNVM ROM pages digest | Digest of sNVM pages marked as ROM |
| User security segment digest (UL Digest) | Digest of user security settings |
| UKDIGEST0 | Digest of user key segment containing SRAM-PUF data |
| UKDIGEST1 | Digest of user key segment containing KUP (User EC key) |
| UKDIGEST2 | Digest of user key segment containing UPK1 |
| UKDIGEST3 | Digest of user key segment containing UEK1 |
| UKDIGEST4 | Digest of user key segment containing DPK |
| UKDIGEST5 | Digest of user key segment containing UPK2 |
| UKDIGEST6 | Digest of user key segment containing UEK2 |
| UPDIGEST (UPERM Digest) | Digest of permanent lock security segments |
| FDIGEST (SYS Digest) | Digest of factory lock segment, factory key segment in pNVM and System Controller ROM |
| UKDIGEST7 | Digest of One-Way Passcode HWM (For PolarFire® SoC FPGA only) |
| ENVMDIGEST | Digest of eNVM (For PolarFire SoC FPGA only) |
| UKDIGEST8 | Digest of MSS Boot mode Information (For PolarFire SoC FPGA only) |
| UKDIGEST9 | Digest of SNVM_RW_ACCESS_MAP (For PolarFire SoC FPGA only) |
| UKDIGEST10 | Digest of Secure Boot Image Certificate (SBIC) (For PolarFire SoC FPGA only) |
The integrity of device programming bitstream files is also protected by digests. When the Libero® SoC design tool generates a programing bitstream file, a set of Bitstream Payload Digests are generated. These digests differ from the Component Digests. While the Bitstream Payload Digests are calculated over the component programing data and the meta data required to program the device, Component Digests include only the programmed data. When the programming bitstream file is generated by the Libero SoC design tool, the data for each component is hashed (SHA-256) and the resulting digest value is retained in an accompanying file along with the programming bitstream file.
During device programming the FPGA, flash cells are loaded with the programming file data and a Bitstream Payload Digest is calculated on the fly. This digest is compared to the Bitstream Payload Digest stored in the bitstream programming file to assure the device correctly received the bitstream programming file during the programming operation.
| Digest Name | Description |
|---|---|
| Security component bitstream digest | Digest of all configured device security settings |
| Fabric component bitstream digest | Digest of the FPGA fabric configuration |
| eNVM component bitstream digest | Digest of all ROM content of eNVM (PolarFire® SoC only) |
| sNVM component bitstream digest | Digest of all ROM content of sNVM |
| Entire bitstream digest | Combined digest of all components |
The following sections describe various options available to check digest. For more information about Digest Check System Services, see PolarFire FPGA and PolarFire SoC FPGA System Services User Guide.