Xilinx Design Language Research Articles

Approaches to Extend FPGA Reverse-Engineering Technology from ISE to Vivado

SRAM-based FPGA(Field Programmable Logic Arrays) requires external memory since its internal memory gets erased when power is cut off. The process of transmitting the circuit netlist in bitstream from external memory during power-up in FPGA is vulnerable to malicious attacks such as bitstream theft and tampering. Previous FPGA reverse-engineering methods focus on FPGAs, supported by ISE (ISE Design Suite). This is because ISE provides XDLRC (Xilinx Design Language Routing Configurable logic) and XDL (Xilinx Design language) files, which are essential for reverse engineering. However, Vivado Design Suite (Vivado) does not offer those files, making it impossible to extend the coverage of reverse engineering to the FPGAs supported by Vivado. In this paper, we propose a method to generate XDLRC and XDL through Vivado. According to experimental results, the XDLRC and XDL generated through Vivado, respectively, match 99% and 75% with those generated in ISE for Artix-7 100T. As a result, this paper has expanded the scope of reverse engineering from being mainly focused on ISE to now also include Vivado. It is important to note that this paper does not encourage bitstream attacks through reverse engineering but rather highlights the risk associated with malicious attacks and emphasizes the importance of security.

Recent Advances in FPGA Reverse Engineering

In this paper, we review recent advances in reverse engineering with an emphasis on FPGA devices and experimentally verified advantages and limitations of reverse engineering tools. The paper first introduces essential components for programming Xilinx FPGAs (Xilinx, San Jose, CA, USA), such as Xilinx Design Language (XDL), XDL Report (XDLRC), and bitstream. Then, reverse engineering tools (Debit, BIL, and Bit2ncd), which extract the bitstream from the external memory to the FPGA and utilize it to recover the netlist, are reviewed, and their limitations are discussed. This paper also covers supplementary tools (Rapidsmith) that can adjust the FPGA design flow to support reverse engineering. Finally, reverse engineering projects for non-Xilinx products, such as Lattice FPGAs (Icestorm) and Altera FPGAs (QUIP), are introduced to compare the reverse engineering capabilities by various commercial FPGA products.

Calibration of RO-based temperature sensors for a toolset for measuring thermal behavior of FPGA devices

In this work, we present calibration effort for Ring Oscillator-based temperature sensors in Field Programmable Gate Array (FPGA) devices and a toolset suitable for the analysis of thermal behavior of FPGAs. The toolset allows for the automatic synthesis of a unified temperature measurement and heat generation infrastructure combined with the necessary control structures and communication interfaces. The tools insert temperature sensors and heaters based on Ring Oscillators (RO) through the low level manipulations on Xilinx Design Language (XDL) descriptions of FPGA resource allocations. The purpose of the kit is to support rapid setup of thermal behavior experiments by providing basic heating and sensing elements with verified properties as well as an area-optimised IP core for control of the experiments. Furthermore to evaluate inter- and intra-device variability we compare results of temperature sensor calibration using our toolset and six devices from two FPGA families: Spartan-3E and Spartan-6.

Customized and automated routing repair toolset towards side-channel analysis resistant dual rail logic

Dual-rail Precharge Logic (DPL) has been widely studied as an effective countermeasure category for mitigating Side Channel Attack (SCA) threats, where unwanted physical leakages from running crypto devices are inspected and analyzed to retrieve confidential data. DPL protocol requires compensated behavior between the corresponding rails, which differs from conventional logic principles. Thus it needs unusual design flows with repetitive and tedious workload. In this article, we present a custom execution tool to automatically realize a dual rail logic. This controllable and automated design flow relies on Xilinx FPGA platforms, to obtain dual rails with highly symmetric networks. The tool is able to automate the logic transformation from a raw single rail on Xilinx Design Language (XDL) to the Precharge Absorbed DPL (PA-DPL) format. Users can fully or partially convert the circuit in arbitrary placement schemes, without concerning the routing conflicts. Another significance is that this proposal is potentially to be used to other circuits that require precise routing control. SCA Security verification to an 8-bit AES coprocessor on SASEBO-GII indicates enhanced security grade due to the rigorous routing networks achieved by the repair process. Timing analysis further demonstrates that the net delay differences between complementary nets are minimized.

Deriving an NCD file from an FPGA bitstream: Methodology, architecture and evaluation

This paper demonstrates a reverse engineering method that takes a bitstream as input and produces an NCD (Native Circuit Description) file for a Xilinx FPGA chip. The work can be divided into two parts: mapping table generation and NCD generation. The mapping tables include the mapping relation among configurable points, configurable options, control bits and control values. An automatic distributed high performance analysis architecture and offset formula theory are developed to quickly generate the test cases, work out the mapping tables and verify their correctness. Based on the tables, we generate an XDL (Xilinx Design Language) file which is equivalent to the NCD file. Our work is the first which can rebuild the NCD file for a bitstream. We also evaluate our method with respect to time consumption and accuracy rate. Benchmarks using real circuits indicate that the accuracy rate on XC5VLX50T is above 88% even in the worst case. Our method is applicable to all series of Xilinx FPGA chips and the accuracy can be guaranteed if the scale of the chip is increased.