FPGA: How is the design stored?

Question

I am attempting to learn about the inner workings of FPGAs and how the high level VHDL/Verilog becomes the working FPGA. I understand the gist but I still feel like I am missing some details. I am familiar only with Xilinx but would like to get a general understanding, if there is much difference between tools.

What I understand thus far is that Xilinx compiles my vhdl into a netlist in an NGC file which is then converted into a bitstream. The bitstream is then placed into the flash PROM of my FPGA. Every time I fire up the board the netlist is loaded from the PROM into the gate-array.

Is it possible to reverse engineer what's on the FPGA or even just read the design off of the PROM?

Answer 1

Let's talk about only SRAM-based FPGAs here, which is what Xilinx and Altera (primarily) manufacture -- Spartan, Artix, Kintex, Virtex, Cyclone, Arria, Stratix are some of the family brand names.

These type of FPGAs load their configuration bitstream from some external memory source, or are configured in-system by some other processor -- either way, the FPGA itself does not store its configuration internally (ignoring Flash and anti-fuse types here).

So, you may say 'well, obviously I can just copy the information off the external memory device' (usually a SPI memory), and you are of course, correct. For applications requiring security of IP, designers leverage the security features offered by the manufacturer. At the factory (of the product, not the FPGA), an encryption key is programmed into the FPGA (usually via eFUSE). The bitstream files are then encrypted with this key, and loaded onto the memory device. This way, even if someone were to clone the hardware design by reverse-engineering the PCB, they would not be able to successfully use the IP as their FPGAs would lack the key.

If the bitstream on the external memory device is encrypted, you're SOL without the decryption key. If it isn't, you can read the bitstream off that device and build your own clone products, but reverse-engineering the bitstream is a very complex task. Currently, some folks have reverse-engineered the format of a Lattice Semiconductor device, but to my knowledge, there isn't a full tool suite or documentation that would let you back out a net-list from a Xilinx or Altera bitstream.

I wrote some additional information about this here as well: FPGA: Bitstream vs. SRAM Object File

Answer 2

Here's the fuse map for my FPGAs for just the CLB. The CLB is has 8 inputs and 4 outputs. Depending on the architecture, the fuse map bit series changes.

The "fuse" is SRAM, FLASH or anti-fuse. The FLASH versions have significantly lower quiescent current but have some complexity related to the FLASH implementation. Also, FLASH has "instant on" characteristics after a hard reset, such as a shutdown due to a solar flare. For the bit stream version, I have a key word for a stream cipher that is stored in FLASH or by battery that decodes the bit stream on the way in.