User guide

Spartan-6 FPGA Configuration User Guide www.xilinx.com 91
UG380 (v2.7) October 29, 2014
eFUSE
Bitstream Encryption and Internal Configuration Access Port (ICAP)
The Internal Configuration Access Port (ICAP) primitive provides the user logic with
access to the Spartan-6 FPGA configuration interface. The ICAP interface is similar to the
SelectMAP interface, although the restrictions on readback for the SelectMAP interface do
not apply to the ICAP interface after configuration. Users can perform readback through
the ICAP interface even if bitstream encryption is used. Unless the designer wires the ICAP
interface to user I/O, this interface does not offer attackers a method for defeating the
Spartan-6 FPGA AES encryption scheme.
Users concerned about the security of their design should not:
• Wire the ICAP interface to user I/O
-or-
• Instantiate the ICAP primitive.
Like the other configuration interfaces, the ICAP interface does not provide access to the
key register.
V
BATT
The encryption key memory cells are volatile and must receive continuous power to retain
their contents. During normal operation, these memory cells are powered by the auxiliary
voltage input (V
CCAUX
), although a separate V
BATT
power input is provided for retaining
the key when V
CCAUX
is removed. Because V
BATT
draws very little current (on the order of
nanoamperes), a small watch battery is suitable for this supply. (To estimate the battery life,
refer to V
BATT
DC Characteristics in the Spartan-6 FPGA Data Sheet: DC and Switching
Characteristics and the battery specifications.) At less than a 150 nA load, the endurance of
the battery should be limited only by its shelf life.
V
BATT
does not draw any current and can be removed while V
CCAUX
is applied. V
BATT
cannot be used for any purpose other than retaining the encryption keys when V
CCAUX
is
removed.
eFUSE
The fuse link is programmed by flowing a large current for a specific amount of time. Fuse
programming current is provided by a fixed external voltage supply (V
FS
pin). The
maximum level is controlled by an internally generated supply. eFUSEs are one-time
programmable.
The resistance of a programmed fuse link is typically a few orders of magnitude higher
than that of a pristine one. A programmed fuse is assigned a logic value of 1 and a pristine
fuse 0.
Each logical bit of the FUSE_KEY and FUSE_CNTL registers consists of two eFUSE cells
(primary and redundant), a flip-flop, and common logic elements for data multiplexing.