Item — HN Reader

Is there any way that the breaking of the Xlinix bitstream encryption opens the door to documenting and reverse engineering that bitstream in the same way that was done with Project IceStorm[0] for the Lattice iCE40 FPGAs?

[0] Project IceStorm - http://www.clifford.at/icestorm/

4 comments

No. This is pretty much useless for that.

Project X-Ray [1] has been working on reverse engineering the Series 7 bitstream format for a while now, and Dave Shah has an experimental fork [2] of nextpnr that targets some devices using the X-Ray database.

[1] - https://github.com/SymbiFlow/prjxray

[2] - https://github.com/daveshah1/nextpnr-xilinx

It's such a sad situation. Why can't companies just provide all the necessary hardware info in the datasheet?

Their competitors would treat it as an illustrated guide for patent infringement suits, for one thing. Security through obscurity still works for that purpose to a great extent.

Vendor lock-in is the primary way in which these companies make money

But wouldn't an open specification be a much better value proposition for engineers?

Not directly. Much of the value in a modern FPGA lies in the specialized proprietary hardware provided by the manufacturer -- transceivers, memory controllers, clock management, dozens of other things -- and in the IP cores that can either be inferred or generated through wizards.

So knowing the bitstream format by itself is only a small step forward, if your goal is to take full advantage of the hardware and IP available. You'd need to reverse-engineer all of the specialized hardware and IP support as well. Opening the bitstream format would still be very worthwhile, but it's not the game-changer that many believe it would be.

Tens of thousands of engineers successfully use these chips already without this data.

Divulging this data ends a revenue stream (which funds tooling development) and prevents competitors from potentially extracting useful information.

There's zero reason to open the chips up at that level.

zero reason for the company selling them, plenty of reason for the users.

The company spent a billion dollars over 4 years developing their new chips which, again, no professional has problems with.

So if you spent a billion dollars and had the livelihood of a few thousand people on your mind, would you protect that investment?

Let their "wisdom of the crowd" come up with a competitive chip that took a thousand highly trained engineers 4 years of 100% time and a billion dollars come up with their own version.

In addition to the other reasons already mentioned, this would likely reveal a lot of small details about the underlying microarchitecture of the FPGA fabric which is a (highly valuable) trade secret.

It'll help with encrypted bitstreams, not much else.

Besides, the lack of public RE efforts is AFAIK a political issue more than anything; the FPGA companies have been known to send lawyers at anyone who tries. The bitstream format itself is, following the layout of the FPGA itself, naturally going to be extremely regular and definitely not hard to figure out. They're really like a "worst kept secret" in the industry --- there are probably a lot of people who have already figured it out, but just don't want to attract legal attention.

It's an optional feature, so I don't think so.