Patent Description:
In a typical microprocessor-based electronic system, executable binary instructions are allocated to specific and dedicated areas of memory. For a given configuration of executable code, the boot code and executable code typically exist in non-volatile memory ("NVM", e.g. FLASH) when the system is without power. When power is applied to the system, the processor reads the non-volatile memory, and typically copies the contents into faster and larger volatile memory ("VMEM", e.g. SRAM, DRAM, SDRAM, DDR, DDR2/<NUM>/<NUM> SDRAM). These instructions stored in volatile memory locations will be identical from power cycle to power cycle. Additionally, memory spaces for data structures (Heap, Stack, I/O buffers, System Variables, etc.) are also allocated to specific and dedicated areas of memory. Although the data held in such data structures tend to be dynamic, some of these values are often the same due to the nature of the system. Over the lifetime of an electronic system, the fixed locations of volatile memory will hold the same data values for thousands to hundreds of thousands of hours. A similar phenomenon occurs in the configuration memory cells of programmable logic devices such as field programmable gate arrays (FPGAs).

Memory imprinting (also known as data remanence) is the result of memory devices holding the same values in the same locations for long periods of time. As discussed above, this is a common occurrence for boot code and executable code which is copied to volatile memory at system power-up. The problem caused by this situation is that memory cell locations can become conditioned to a specific electrical level, either high or low. If power is applied to an electronic system but its processor is prevented from performing its normal boot procedure of copying its executable code from non-volatile memory to volatile memory, the result can be that the volatile memory cells will tend to float to the values they have become conditioned to through continuous experience over the system lifetime.

This becomes a significant problem in embedded systems where security is important as an adversary can extract the imprinted values of the memory cells and reverse engineer the executable code. Even if the executable code is stored at rest in an encrypted state in NVM, the processor must still decrypt the NVM code and store it in VMEM in order to execute the application's instructions. The end effect is that the system becomes an easy target for executable code theft, extraction of cryptographic keying material and reverse engineering. Security critical systems must have protection against a variety of threats (attack vectors). Extraction of executable code and data from such a system can have catastrophic effects - from loss of revenue due to cloning of a product, to loss of technology advantage.

In order to avoid the security risks described above, it is important to prevent memory imprinting (data remanence) in an electronic system's volatile memory. However, previous techniques intended to address memory imprinting have either been only marginally effective (such as erasing all memory at power down, which does not correct the imprinting issue caused by registers holding the same value over long periods of time) or costly and inefficient (such as "ping pong" techniques which have a pair of registers for each memory address, with periodic toggling of the regular and shadow register values, thus resulting in low density and high cost memory).

Prior art can be found in <CIT> which generally relates to a system and method for mitigating imprint effect in ferroelectric random access memories utilizing a complementary data path, in <CIT> which generally relates to a programmable logic device with ferroelectric configuration memories and in <CIT> which generally relates to a technique for memory imprint reliability improvement.

According to a first aspect, we describe a method for mitigating memory imprinting in volatile configuration memory, CM, of a field programmable gate array, FPGA, device, said method comprising: providing an FPGA device with a CM input inversion plane between a CM controller and a layer of CM cells, a CM output inversion plane between the layer of CM cells and a programmable function block layer, and a CM inversion control module in communication with the CM input and output inversion planes; determining, by the CM inversion control module at system power-up, whether to select a normal mode or an inversion mode for a current power cycle, wherein the normal mode is a mode configured to allow data flowing into and out of the layer of CM cells to flow without inversion; inverting, by the CM input and output inversion planes when operating in the inversion mode, data flowing into and out of the layer of CM cells, where inverting includes swapping values of logical ones and zeroes; tracking, by the CM inversion control module, cumulative system times operating in the normal mode and the inversion mode; and writing the cumulative system times to a CM mode non-volatile memory module, at system power-down, for use in determining which mode to select at a next system power-up, wherein determining whether to operate a current power cycle in a normal mode or an inversion mode includes reading the cumulative system times from the CM mode non-volatile memory module and setting the current power cycle to a mode with less cumulative time.

According to a second aspect, we describe a programmable logic device having volatile memory imprint mitigation, said programmable logic device comprising: a configuration memory, CM, controller receiving a bitstream from an external memory device; a layer of CM cells receiving bits from the CM controller; a programmable function block layer including a plurality of function blocks each receiving bits from one or more of the CM cells; a CM input inversion plane in a communication path between the CM controller and the layer of CM cells; a CM output inversion plane in a communication path between the layer of CM cells and the programmable function block layer; and a CM inversion control module in communication with the CM input and output inversion planes, where the CM inversion control module is configured to determine at device power-up whether to operate a current power cycle in a normal mode or an inversion mode, wherein the CM inversion control module is further configured to record cumulative device times operating in the normal mode and the inversion mode, periodically and at device power-down, for use in determining which mode to select at a next device power-up, and wherein the normal mode is a mode configured to allow data flowing into and out of the layer of CM cells to flow without inversion, and where the CM input inversion plane inverts, when operating in the inversion mode, the bits received by the CM cells from the CM controller, where inverting includes swapping values of logical ones and zeroes, and the CM output inversion plane inverts, when operating in the inversion mode, the bits received by the programmable function block layer from the CM cells, wherein the CM inversion control module determines whether to operate the current power cycle in the normal mode or the inversion mode by evaluating the cumulative device times which were previously recorded and setting the current power cycle to a mode with less cumulative time.

The following discussion of the embodiments of the disclosure directed to a system and method for mitigating configuration memory imprinting in a programmable logic device is merely exemplary in nature, and is in no way intended to limit the disclosed techniques or their applications or uses. The scope of protection of the present invention is defined by appended claims <NUM> to <NUM>.

<FIG> is a diagram <NUM> illustrating memory allocation in a typical embedded microprocessor-based electronic system. Non-volatile memory (NVM) <NUM> contains information which persists even when the system is without power. Volatile memory (VMEM) <NUM> is typically larger and faster than the NVM <NUM>, but is only operational when the system is powered up. The NVM <NUM> includes, among other things, boot code <NUM>, application code <NUM> and an interrupt service routine (ISR) handler <NUM> - each of which is copied to the VMEM <NUM> at boot time.

Because the boot code <NUM> and the application code <NUM> are always copied to the low memory addresses at the bottom of the stack in the VMEM <NUM>, the individual bits of this code data will end up in the same VMEM registers for every power cycle. The same is true of the ISR handler <NUM>, which is always copied to the high memory addresses at the top of the heap. Over the lifetime of an electronic system, the fixed locations of these items in volatile memory will hold the same data values for thousands to hundreds of thousands of hours. Thus, the locations of boot code <NUM>, application code <NUM> and ISR handler <NUM> in the VMEM <NUM> become areas of concern for memory imprinting.

The process of storing and holding a data value (<NUM> or <NUM>) to a given volatile memory cell stresses the physical properties of the cell. These stresses act to change the cell's switching threshold voltage and access time due to electrical stressing on internal ionic contaminants, hot carrier (thermal) effects, and electromigration effects. These cell changes are also affected by supply voltage and environmental temperature experienced by the memory device and tend to be cumulative over time. The long term data retention effects are the focus of this disclosure as such effects occur when the same data value is experienced by a given memory cell.

The architecture and methods of the present disclosure allow an embedded electronic system's volatile memory (RAM, DRAM, SDRAM, etc.), over the lifetime of the system, to experience half of its duration with normal data values stored, and the other half of its duration with inverted data values stored. This allows each memory cell to experience an electrical low voltage/charge and an electrical high voltage/charge for nearly equal durations of time. The control of this data inversion occurs at each power cycle. The efficacy of this approach is optimized when a given section of memory holds values which are relatively static over time, such as executable code, as illustrated in the above discussion of <FIG>. A condition for the use of the disclosed technique is that the system must be one where it is acceptable or required for the system to experience periodic power down and power up cycles. A non-comprehensive list of examples of such systems: embedded systems in vehicles (such as automobiles, helicopters, air vehicles, railroad, and metro/trolly), industrial machinery, and amusement park rides.

Following is a brief discussion of the concepts which are employed in embodiments of the disclosed architecture. The system operation involves alternating the electrical values associated with logic levels written to memory between system power cycles. Over the lifetime of the system, a given memory location will hold "high" and "low" electrical values for approximately equal durations of time, thus achieving a balance of electrical high and low levels over time and therefore imparting electrical stresses equally on the memory cell location. A non-volatile bus mode control register is used to control logical and electrical inversion of the data bus to and from memory. Memory inversion is embodied as a plurality of bits of a number equal to that of the data bus width of the memory. The bus mode control register input is a single bit wide and enables control of the inversion behavior of the entire data bus. A binary "<NUM>" allows all data bits to pass thru non-inverted whereas a binary "<NUM>" forces all data bit to be inverted in both directions.

The system monitors the proportion of time accumulated in normal mode vs inversion mode and decides which of the two modes is warranted for the next system restart or boot in order to keep time in either mode in balance (within a certain threshold window of overall difference). This decision processing compensates for scenarios where a system is powered on for short periods of time on some occasions and long periods of time on other occasions. Counter timers, accumulators and difference threshold values are used to measure system time to assist in inversion control.

The system uses normal processor architectures with a logic inversion control hardware module. One embodiment is that of a Field Programmable Gate Array (FPGA) with an integral embedded soft or hard processor core as shown in drawings attached. Other embodiments are discrete component based or those implemented in an Application Specific Integrated Circuits (ASICs). Additional embodiments can be implemented in software running inside the processor with the various functions captured in this disclosure implemented as software data structures.

<FIG> is a block diagram of a system architecture <NUM> designed to mitigate memory imprinting, according to an embodiment of the present disclosure. Blocks <NUM>, <NUM> and <NUM> - discussed below - are added to a conventional architecture to provide the features of the disclosed embodiment. The features and functions of the conventional architecture will be discussed first.

A processor <NUM> provides the fundamental calculation and processing capability of the architecture <NUM>. The processor <NUM> is a general purpose processor with standard Address, Control and Data bus input/output (I/O), as would be understood by one skilled in the art. A system clock generator <NUM> provides the clock function of the circuit, also in a conventional manner. The clock generator <NUM> communicates with the processor <NUM> on line <NUM>. General Purpose Volatile Memory (VMEM) <NUM> and General Purpose Non-Volatile Memory (NVM) <NUM> serve the memory needs of the architecture <NUM> in the manner discussed above with respect to <FIG>. The VMEM <NUM> of <FIG> equates to the volatile memory <NUM> of <FIG>, and the NVM <NUM> of <FIG> equates to the volatile memory <NUM> of <FIG>.

The processor <NUM> accesses the VMEM <NUM> via address bus <NUM>, control bus <NUM> and a data bus. In <FIG>, the data bus has two parts - a memory data bus <NUM> and a processor data bus <NUM>. In a conventional architecture, there would be a single continuous data bus running from the processor <NUM> to the VMEM <NUM>. Upon system boot-up, the contents of the NVM <NUM> are loaded to the VMEM <NUM>, in the manner discussed above regarding <FIG>. Lines <NUM> provide communication between the NVM <NUM> and the VMEM <NUM> via the three busses <NUM>/<NUM>/<NUM>.

The preceding two paragraphs describe the basic operation of a traditional circuit without the disclosed techniques for mitigating memory imprinting. Following is a discussion of the architecture <NUM> using the additional elements for mitigating memory imprinting.

A bus mode register control <NUM> performs the calculations to determine whether normal or inverted memory control is used on each boot-up. This block takes in system status information at boot-up and makes the decision for which data mode to use for this duration of power application: Normal (data pass thru) or Inverted. A clock input line <NUM> provides system clock time from the clock generator <NUM> to the bus mode register control <NUM> for cumulative time calculations. Lines <NUM> provide communication between the bus mode register control <NUM> and the three busses <NUM>/<NUM>/<NUM>. The bus mode register control <NUM> is shown in <FIG> and discussed below.

A bi-directional data bus inverter <NUM> receives instructions from the bus mode register control <NUM> (whether to operate in Normal or Inverted mode) on lines <NUM> and <NUM>, and handles data flow on the memory data bus <NUM> and the processor data bus <NUM>. Here it is important to remember that the processor <NUM> is a standard processor which is not reprogrammed to support memory imprint mitigation. The processor expects to receive application code and other data from the VMEM <NUM> in a conventional manner. However, because certain data in the VMEM <NUM> may be inverted, the data bus inverter <NUM> must handle the inversion of that data, both ways, in communications between the memory data bus <NUM> and the processor data bus <NUM>. The data bus inverter <NUM> is shown in <FIG> and discussed below.

Bus Mode Control Non-volatile Memory <NUM> stores bus mode control status information when the system is powered off, so that this information can be used by the bus mode register control <NUM> at the next power-up event. The Bus Mode Control Non-volatile Memory <NUM> is shown in <FIG> and discussed below.

<FIG> is a block diagram of the bus mode register control <NUM> first shown in <FIG>. As discussed above, the bus mode register control <NUM> determines, upon system start-up, whether the current power cycle should operate in normal mode or inversion mode. The bus mode register control <NUM> also manages all parameters and counters associated with this computation. As seen in <FIG>, the bus mode register control <NUM> receives clock input on line <NUM>, I/O from the address bus, control bus and data bus on the lines <NUM>, and reads/writes a group of counters and thresholds <NUM>/<NUM>/<NUM>/<NUM>/<NUM>/<NUM> to/from the bus mode control non-volatile memory <NUM>.

An inversion control logic module <NUM> processes the counters and thresholds, along with a current event timer/counter <NUM>, to determine which memory mode to use. A concise explanation of the logic is as follows: bus mode register control <NUM> first reads the contents of bus mode control non-volatile memory <NUM> and stores these values in registers <NUM>, <NUM>, <NUM>, <NUM>, <NUM>. The normal vs. inversion mode difference counter <NUM> (at the most recent system power down) is first validated by comparing its value to that of the normal mode duration counter <NUM> minus the inversion mode duration counter <NUM>. If these values match, the normal vs. inversion mode difference counter <NUM> is valid. Next, if the difference counter shows that the system has accumulated more time in normal mode than in inversion mode, then the next start-up will be set to inversion mode; and vice versa. The thresholds <NUM> (normal mode high threshold limit value) and <NUM> (inversion mode low threshold limit value) can be used to tailor the toggle behavior of the system - to trigger mode reversal at non-zero difference values such as +<NUM> and -<NUM>, for example.

Based on the calculations in the inversion control logic module <NUM>, a bus mode configuration register <NUM> (a single bit) is set to either normal mode (<NUM>) or inversion mode (<NUM>). The value of the bus mode configuration register <NUM> is provided to the data bus inverter <NUM> on the line <NUM>. The inversion control logic module <NUM> also monitors the activity on the address bus, control bus and data bus, and sends a processor read enable flag on the line <NUM> when the processor <NUM> is reading data from the VMEM <NUM>.

<FIG> is a block diagram of the bi-directional data bus inverter <NUM> first shown in <FIG>. The data bus inverter <NUM> controls communication between the memory data bus <NUM> (data in/out of the VMEM <NUM>) and the processor data bus <NUM> (data in/out of the processor <NUM>). The data bus inverter <NUM> receives the present memory mode control bit (the bus mode configuration register <NUM>) on the line <NUM>, and the processor read enable flag on the line <NUM>. Based on these inputs, an enable logic module <NUM> controls gates <NUM>/<NUM>/<NUM>/<NUM> to properly handle data flow.

The gates <NUM> and <NUM> are pass-through gates which do not invert data bits. The gates <NUM> and <NUM> are inversion gates which do invert data bits. Each of the gates <NUM>/<NUM>/<NUM>/<NUM> is enabled, if appropriate, based on a signal from the enable logic module <NUM> as follows.

If the processor read enable flag is not set (meaning the processor is writing) and the present memory mode control bit is <NUM> (normal mode), then the pass-through gate <NUM> is enabled - allowing bits on the processor data bus <NUM> (from the processor <NUM>) to pass to the memory data bus <NUM> (to the VMEM <NUM>) without inversion.

If the processor read enable flag is set (meaning the processor is reading) and the present memory mode control bit is <NUM> (normal mode), then the pass-through gate <NUM> is enabled - allowing bits on the memory data bus <NUM> (from the VMEM <NUM>) to pass to the processor data bus <NUM> (to the processor <NUM>) without inversion.

If the processor read enable flag is not set (meaning the processor is writing) and the present memory mode control bit is <NUM> (inversion mode), then the inversion gate <NUM> is enabled - causing bits on the processor data bus <NUM> (from the processor <NUM>) to be inverted as they pass to the memory data bus <NUM> (to the VMEM <NUM>).

If the processor read enable flag is set (meaning the processor is reading) and the present memory mode control bit is <NUM> (inversion mode), then the inversion gate <NUM> is enabled - causing bits on the memory data bus <NUM> (from the VMEM <NUM>) to be inverted as they pass to the processor data bus <NUM> (to the processor <NUM>).

<FIG> is a diagram illustrating memory allocation in the bus mode control non-volatile memory <NUM>, seen previously in <FIG> and <FIG>. The schema of <FIG> simply shows one technique for allocating the threshold values <NUM> and <NUM>, and the counter values <NUM>, <NUM> and <NUM>, to memory addresses in the NVM <NUM>. The important point is that these values are stored during system power off and used by the bus mode register control <NUM> at the next power-up. The current event timer/counter <NUM> may also be contained in the bus mode control non-volatile memory <NUM>, as shown in <FIG>.

The above discussion of <FIG> (System architecture <NUM> for memory imprint mitigation), and <FIG> (details of modules <NUM>, <NUM> and <NUM>), provides a complete explanation of the physical implementation of an embodiment of the disclosed memory imprint mitigation. <FIG> is a flowchart diagram <NUM> of a method for memory imprint mitigation using the architecture <NUM> of <FIG> and the details shown in the diagrams of <FIG>.

At box <NUM>, the system is powered up to begin operation. At box <NUM>, normal and inversion mode counters and thresholds are read from the bus control mode NVM <NUM> by the bus mode register control <NUM>. The counters were updated and rewritten to the bus control mode NVM <NUM> at a previous system shutdown. At box <NUM>, the bus mode register control <NUM> determines the memory data bus mode for the current power-up session. If the normal vs. inversion time difference counter <NUM> is greater than a first threshold, the current bus mode will be set to inversion mode. If the normal vs. inversion time difference counter <NUM> is less than a second threshold, the current bus mode will be set to normal mode. The thresholds may both be set to zero, or they may be positive and negative non-zero values, as best suited for a particular application.

At decision diamond <NUM>, the process branches based on the current bus mode. If the memory data bus mode for the present session is normal mode, then at box <NUM> the system NVM <NUM> is loaded to the VMEM <NUM> in a standard fashion - without inversion. At box <NUM>, the bi-directional data bus inverter <NUM> is configured to pass through data between the processor <NUM> and the VMEM <NUM> without inversion.

If, at the decision diamond <NUM>, the memory data bus mode for the present session is inversion mode, then at box <NUM> certain portions of the system NVM <NUM> are loaded to the VMEM <NUM> in an inverted fashion by the processor <NUM>. The inverted addresses include the boot code, the application code and the ISR. At box <NUM>, the bi-directional data bus inverter <NUM> is configured to invert data bits as they pass between the processor <NUM> and the VMEM <NUM>.

At this point it is worthwhile to emphasize the effect of the architecture <NUM> and the process in the flowchart <NUM>. In normal mode (boxes <NUM> and <NUM>), data bits from the NVM <NUM> having a logic value of <NUM> are stored by the processor <NUM> as an electrical low voltage in their addresses in the VMEM <NUM>, and data bits having a logic value of <NUM> are stored by the processor <NUM> as an electrical high voltage in their addresses. In inversion mode (boxes <NUM> and <NUM>), the same data bits from the NVM <NUM> having a logic value of <NUM> are stored as an electrical high voltage in their addresses in the VMEM <NUM>, and the data bits having a logic value of <NUM> are stored as an electrical low voltage in their addresses. Because normal and inversion modes are controlled by the disclosed method to be roughly equal in time over the system lifecycle, the inversion of electrical voltage levels mitigates memory imprinting (data remanence) effects in the VMEM <NUM>.

At box <NUM>, the application software is executed by the processor <NUM> communicating with the VMEM <NUM>. The application software does not know or care that the data bus may be inverted on its way to/from the VMEM <NUM>, as the processor <NUM> sees the same normal data values regardless of whether normal or inversion mode is in effect. The data bus inverter <NUM> handles the inversion in both directions, if applicable, and the VMEM <NUM> benefits from the memory imprinting mitigation.

At box <NUM>, when the application execution is complete (or the vehicle or machine is turned off), a system shutdown signal is provided. At box <NUM>, the counters (normal mode counter <NUM>, inversion mode counter <NUM> and difference counter <NUM>) are updated and their values are written to the bus mode control NVM <NUM> for use at the next power-up. For example, if the current session was running in inversion mode, then the inversion mode duration counter will be updated by adding the current session time count from block <NUM> to the previous value of the inversion mode counter. After the counters <NUM>-<NUM> are updated and written to the bus mode control NVM <NUM> at the box <NUM>, the system is actually powered down at box <NUM>.

<FIG> is a data table <NUM> containing operational statistics for <NUM> power cycles of an example system using the architecture <NUM> of <FIG> and the flowchart diagram <NUM> of <FIG>. Column <NUM> simply contains the sequential number of the power cycle of the system. Column <NUM> contains the duration of each power cycle. It can be seen in column <NUM> that power cycle durations vary dramatically, from a low of two hours to a high of <NUM> hours. It is for this reason that a normal/inversion duration counter is used, rather than simply toggling between normal and inversion mode at each power-up. Column <NUM> contains cumulative service hours for the system <NUM>, which is simply a running total of column <NUM>.

Columns <NUM> and <NUM> indicate the operating mode (normal or inversion) that is used for each power cycle, where column <NUM> contains the actual mode bit from the register <NUM>, and column <NUM> contains the descriptive word. Column <NUM> contains the cumulative time counter in normal mode. It can be seen that when column <NUM> reads normal, column <NUM> increments by the amount in column <NUM>. Column <NUM> contains the cumulative time counter in inversion mode. It can be seen that when column <NUM> reads inversion, column <NUM> increments by the amount in column <NUM>. Column <NUM> contains the difference between normal and inversion mode time counters, thus indicating whether the system has spent more hours in normal mode (positive) or inversion mode (negative). Column <NUM> expresses the balance column <NUM> as a percentage of the cumulative service hours column <NUM>.

The normal mode cumulative hours total in column <NUM> represents the value in the block <NUM> of <FIG> and <FIG>. The inversion mode cumulative hours total in column <NUM> represents the value in the block <NUM> of <FIG> and <FIG>. The normal minus inversion difference hours total in column <NUM> represents the value in the block <NUM> of <FIG> and <FIG>. The thresholds <NUM> and <NUM> are also shown at the top of the table <NUM>.

It can be seen in columns <NUM> and <NUM> that the normal minus inversion difference remains centered on zero - generally oscillating between values of about +/- <NUM> hours and tending toward a small percentage value. In contrast, the cumulative service hours total has climbed into the hundreds in just this small sample of power cycles, and can be understood to climb to many thousands of hours over the system lifecycle. Instead of subjecting each address in the VMEM <NUM> to the many thousands of hours of the same voltage level, the disclosed method and system cause a near equal balance of high and low voltage time at each address. This balance imparts electrical stresses equally on the memory cell location, thus making detection of memory imprinting significantly more difficult.

The preceding discussion of <FIG> describes SRAM in embedded systems devices connected to a microprocessor. An embodiment of the architecture <NUM> would be discrete SRAM devices soldered to a circuit card assembly (CCA). However, additional use cases for memory imprint mitigation have been identified and are discussed below. The memory imprinting mitigation scheme described in this disclosure also applies to portions of virtually all SRAM-based programmable logic, microprocessors (L1, L2 and L3 Cache), microcontrollers, and digital signal processors (Instruction Cache). The following discussion describes these use cases.

Memory imprinting mitigation of cache memory elements internal to a digital processor can be realized through modification to a discrete integrated circuit-based processor (microprocessor, digital signal processor (DSP), graphics processor unit (GPU) or similar devices). In such devices the processor often includes internal volatile memory-based data structures such as cache memory (Level <NUM> cache - typically split into separate Instruction and Data caches, Level <NUM> and Level <NUM> cache and Translation Lookaside Buffers). These internal memory structures enable faster processor instruction execution by reducing the number of external memory reads (fetches). Processor reads and writes of external memory adds significant time overhead compared to processor access of internal registers, internal cache memory and other memory structures.

Cache memory structures speed up processing throughput by copying more memory than needed when the processor reads contents from external memory. The larger amount of memory read is stored (written) into cache memory residing internally to the processor. Should the processor need to access memory whose address is close to that just previously used to fill the cache, the cache itself can provide its local copy of the contents, greatly increasing the processing by removing the need for an external memory access. Such internal volatile memory data structures use transistor structures found in other portions of the processor (ALU, memory management unit, etc.) and are also susceptible to memory imprinting. The benefit of mitigating memory imprinting for such structures is a function of the duration of specific portions of memory contents existing in the same locations in the cache. For instance, memory contents in the form of processor instructions may be a more useful target for an attacker than that of data values in the cache since processor instructions tend to stay the same, while the data being operated upon by the processor and its instructions tends to vary.

It is noted that there are many topologies for cache memory structures, such as; direct mapped (one-way), two-way, four-way to N-way set associative caches, victim cache, trace cache, write coalescing cache, and micro-operation cache. The intent of the architectures disclosed below is to mitigate memory imprinting in any such cache memory topology integral to a processor.

<FIG> is a block diagram of a generalized microprocessor <NUM> with integral cache memory, where the disclosed memory imprinting mitigation techniques can be implemented in the cache memory. The microprocessor <NUM> includes an external memory bus interface <NUM>, an Arithmetic Logic Unit (ALU) <NUM>, an instruction decoder <NUM> and an internal memory structure known as a cache <NUM>. The cache <NUM> is a block of SRAM memory which is used to copy a corresponding block of external memory such that instructions and data can be accessed faster if the processor integrated circuit (IC) does not have to access external memory. When a processor IC has to access memory outside the IC package boundary, the process takes several memory cycle time periods to go out to external memory, read the contents, move the contents back into the processor, and execute the instructions. Access to the cache memory <NUM> is much faster and speeds processing throughput.

The internal cache memory <NUM> tends to hold the same values for periods of time, thus making this structure vulnerable to memory imprinting. There can be as many as three cache blocks in present day processors with a "Level <NUM>" cache being the smallest in size but faster in processor execution, "Level <NUM>" being intermediate in size and speed, and "Level <NUM>" being largest in size but slower than Level <NUM> and level <NUM> cache structures. Memory imprint mitigation can be implemented in the cache <NUM> by adding inverters between the cache <NUM> and the bus interface <NUM>, and between the cache <NUM> and other elements of the processor IC. This is described further below in discussion of <FIG>.

<FIG> is a block diagram of a digital signal processor <NUM> with instruction cache, where the disclosed memory imprinting mitigation techniques can be implemented in the instruction cache. Digital signal processor (DSP) ICs are specialized versions of a microprocessor in that the DSP architecture is optimized to perform the mathematical operations required of signal processing applications. DSP ICs have a reduced instruction set compared to general purpose microprocessors, but gain in efficiency due to hardware-centric processing blocks (for instance, multiply and accumulate blocks). Like the microprocessor <NUM> of <FIG>, the DSP <NUM> also uses internal SRAM cache for the same reasons as a general purpose processor. The DSP <NUM> includes instruction cache <NUM> which may hold the same values for extended periods of time and be vulnerable to memory imprinting. The instruction cache <NUM> can also benefit from the disclosed memory imprint mitigation techniques, as discussed below.

<FIG> is a block diagram of a system architecture <NUM> designed to mitigate memory imprinting in cache memory onboard a microprocessor, such as the microprocessor <NUM> or the DSP <NUM> of <FIG>, according to an embodiment of the present disclosure. The architecture <NUM> is similar to the architecture <NUM> of <FIG>, where the architecture <NUM> includes a Bus Mode Register Control <NUM>, a Bi-Directional Data Bus Inverter <NUM> and a Bus Mode Control NVM <NUM>, corresponding to the elements <NUM>, <NUM> and <NUM>, respectively, of <FIG>.

In the case of the architecture <NUM>, the memory imprint mitigation is targeted to the processor's cache memory which is onboard the integrated circuit (IC) itself, rather than the full volatile memory module which may be external. As discussed in the preceding paragraphs relative to <FIG> and <FIG>, the cache memory may contain the same data in some registers for an extended amount of time, thus becoming susceptible to memory imprinting.

An IC die carrier Printed Circuit Board (PCB) <NUM> includes an IC die <NUM>, where it is to be understood that other elements (not shown) besides the IC die <NUM> may exist on the PCB <NUM>. IC package input output solder bumps <NUM> allow connection of the IC die <NUM> to other elements on the PCB <NUM> or other circuit boards. A processor core Arithmetic Logic Unit (ALU) <NUM> is the element which performs the actual mathematical and/or logic calculations which are the purpose of the device - whether a digital signal processor, a graphics processing unit, a generalized microprocessor, or otherwise.

Internal Cache Memory <NUM> is the cache module which has been discussed extensively above - that is, the high-speed onboard RAM element which may be susceptible to memory imprinting, and which the architecture <NUM> is designed to protect from imprinting.

An internal cache memory controller <NUM> controls data flowing into and out of the cache <NUM>, including data and signals on a cache address bus <NUM>, a cache control bus <NUM> and a cache data bus <NUM>. An external memory interface <NUM> controls communication between the ALU <NUM>, the cache <NUM>, and external volatile and non-volatile memory. That is, the interface <NUM> enables data reads/writes between the ALU <NUM> and external memory when necessary, also allows data fetches from external memory to the cache <NUM>, and direct provision of data from the cache <NUM> to the ALU <NUM> whenever possible. These data flow paths are shown by the arrows in the box of the interface <NUM>.

The communication with the external memory is via an external address bus <NUM>, an external control bus <NUM> and an external data bus <NUM>, which are equivalent to the address/control/data buses <NUM>/<NUM>/<NUM> of <FIG>. A processor address bus <NUM>, a processor control bus <NUM> and a processor data bus <NUM> provide communication between the ALU <NUM> and the external memory interface <NUM>.

A dashed-outline area <NUM> contains the elements which are added to a standard processor for the memory imprint mitigation architecture <NUM>. The operation of the architecture <NUM> of <FIG> is very similar to the operation of the architecture <NUM> of <FIG> discussed previously. When the bus mode register control <NUM> determines that the cache <NUM> should be operated in inversion mode, the data bus inverter <NUM> inverts data bits flowing in an out of the cache <NUM>. This inversion affects all data flowing in and out of the cache <NUM>, regardless of the source or destination of the data (ALU <NUM> or external memory). Because of the location of the data bus inverter <NUM>, nothing else needs to be changed in the architecture <NUM> compared to a standard processor architecture. That is, the ALU <NUM>, the interface <NUM> and the external memory always see the non-inverted data bits that they expect. Only the cache <NUM> sees inverted data bits (when the system is running in inversion mode), thus providing memory imprint mitigation in the cache <NUM>.

As discussed previously relative to the architecture <NUM> of <FIG>, the bus mode register control <NUM> determines whether to run in normal mode or inversion mode at system start-up based on normal mode and inversion mode counter data stored in the bus mode control NVM <NUM>. The goal of the system is to balance normal mode and inversion mode operation over the lifetime of the system. The NVM <NUM> can be implemented on the IC die <NUM> (as shown by reference numeral <NUM>), or it may reside on the PCB <NUM> (1060A), or it may reside entirely external to the PCB <NUM> (1060B).

The architecture <NUM> is designed to mitigate memory imprinting in a processor's onboard cache, while the architecture <NUM> is designed to mitigate imprinting in main system RAM external to a processor.

Another application for the memory imprint mitigation techniques of the present disclosure is in Field Programmable Gate Array (FPGA) configuration memory. In a typical FPGA device, the configuration memory cells (inaccessible from outside the chip and typically not accessible to the user's design from inside the chip) are used to store binary values unique for a given user's design and will stay at the same value for the duration of the use of the part in the system while power is applied. This makes FPGA configuration memory cells vulnerable to memory imprinting. This FPGA application is discussed in detail below.

<FIG> is an illustration of a physical top view of a SRAM-based Field Programmable Gate Array (FPGA) device <NUM>. The FPGA <NUM> includes configurable logic blocks <NUM>, I/O blocks <NUM> and Block RAMs <NUM>. A convenient way to understand an FPGA is to use a three dimensional sandwich model of transistor layers, surrounded around the outside by hundreds to thousands of the I/O cells <NUM> connecting to the external portions of the integrated circuit package. FPGA devices are high density integrated circuits leveraging the latest IC fabrication techniques as small as <NUM> nanometers (nm) and implementing as many as <NUM>-<NUM> billion transistors.

<FIG> is a cross-sectional view of a three dimensional model of a traditional implementation of an FPGA architecture <NUM> including an FPGA <NUM>. In the three dimensional model, a top layer <NUM> (layer <NUM>) can be thought of as the "programmable logic" and "programmable I/O" layer, a middle layer <NUM> (layer <NUM>) as the "configuration memory" layer, and a bottom layer <NUM> (layer <NUM>) as the "Configuration memory controller" layer. Layer <NUM> (<NUM>) is partitioned into a matrix of identical logic blocks <NUM>. Layer <NUM> (<NUM>) may consist of thousands to nearly a million of the logic blocks <NUM>, with the outside ring of the matrix consisting of programmable I/O blocks <NUM>.

Each layer <NUM> logic block <NUM> or I/O block <NUM> is individually configured to perform a specific logic or I/O function by layer <NUM>'s configuration memory cells <NUM>. There is a many-to-one mapping of layer <NUM> memory cells <NUM> to layer <NUM> logic blocks <NUM>. In the model of <FIG>, assume that <NUM> layer <NUM> memory cell outputs are connected to each layer <NUM> logic or I/O block <NUM>. If there are <NUM> layer <NUM> logic blocks <NUM>, and <NUM> layer <NUM> I/O blocks <NUM>, there will be a corresponding <NUM> × <NUM> = <NUM> layer <NUM> memory cells <NUM> for the logic blocks <NUM>, and <NUM> × <NUM> = <NUM> layer <NUM> memory cells <NUM> for the I/O blocks <NUM>. Each layer <NUM> memory cell <NUM> is initially loaded by a layer <NUM> configuration memory controller <NUM> during power up. Layer <NUM> (<NUM>) consists of an external memory interface (JTAG) <NUM>, a small amount of battery-backed SRAM memory <NUM> and/or eFuses <NUM> used to provide a user-programmable decryption key via a selection multiplexer <NUM>, a bitstream authenticator <NUM> and a bitstream decryptor <NUM>, and finally, the configuration memory controller <NUM>.

A configuration memory access port <NUM> provides communication between the configuration memory cells <NUM> of layer <NUM> (<NUM>) and the I/O blocks <NUM> of layer <NUM> (<NUM>), for some specific functions. Furthermore, the I/O blocks <NUM> of layer <NUM> (<NUM>) are configured with solder bumps <NUM> for connection of the FPGA <NUM> to a circuit board, as would be understood by one skilled in the art.

In most FPGA devices, the internal contents of SRAM configuration memory are loaded at device power up from an external memory device <NUM>. The FPGA's configuration memory file, also known as the FPGA Image or FPGA Bitstream, is often stored in an encrypted state on the external memory device <NUM> (e.g., non-volatile FLASH memory). At power up, the FPGA <NUM> sequentially reads the external encrypted file from the device <NUM> via an I/O block <NUM>. The FPGA <NUM> then internally decrypts the file using one of two multiplexer-selected decryption keys which is resident in the FPGA and has been stored in the FPGA prior to the power up cycle. The decryption key selected at the multiplexer <NUM> is either a result of the battery-backed SRAM <NUM>, or is a function of the electrically alterable internal fuses (eFuses <NUM>).

As the incoming file is decrypted, the decrypted contents are written to the FPGA's internal configuration memory cells <NUM>. Present FPGA devices utilize hundreds of thousands to millions of configuration bits. Unless the design is changed and a different bitstream and decryption key is used, the FPGA image stored in the external memory device is written into the identical configuration memory cells <NUM> at each power up. These configuration memory cells <NUM>, not accessible from outside the chip and typically not accessible to the user's design from inside the chip, are intentionally static so as to enable the FPGA to implement the user's design for the duration of the use of the part in the system while power is applied. It is precisely this FPGA configuration memory <NUM> which is affected by the memory imprinting phenomena. Utilizing the scheme described in this disclosure, FPGA vendors can drastically reduce the effects of configuration memory imprinting.

<FIG> is a cross-sectional view of a three dimensional model of an FPGA architecture <NUM> including an FPGA <NUM> with memory imprinting protection, according to an embodiment of the present disclosure. <FIG> shows the same architecture as the generalized FPGA architecture <NUM>, but with the addition of configuration memory inversion planes for memory cell input (<NUM>) and output (<NUM>), a Configuration Memory Inversion Controller <NUM> and Inversion Control Non-Volatile Memory (NVM) <NUM>. The function of the configuration memory inversion controller <NUM> is identical to that of the Bus Mode Register Control <NUM> shown in <FIG> and discussed above.

As part of the FPGA startup process, the layer <NUM> configuration memory controller <NUM> communicates with and initiates the configuration memory inversion controller <NUM> on a line <NUM>. On a line <NUM>, the configuration memory input inversion plane <NUM> receives a signal from the configuration memory inversion controller <NUM> indicating whether the FPGA <NUM> is operating in normal mode or inversion mode. When in inversion mode, the configuration memory input inversion plane <NUM> inverts (swaps values of logical <NUM>'s and <NUM>'s) bits flowing from the configuration memory controller <NUM> into the configuration memory cells <NUM> (of <FIG>). Likewise, when the FPGA <NUM> is operating in inversion mode, the configuration memory output inversion plane <NUM> inverts bits flowing from the layer <NUM> configuration memory cells <NUM> to the programmable function blocks <NUM>. The configuration memory output inversion plane <NUM> also receives, on the line <NUM>, the signal from the configuration memory inversion controller <NUM> indicating whether the FPGA <NUM> is operating in normal mode or inversion mode. In this way, the contents of the configuration memory cells <NUM> are protected from memory imprinting, as each individual configuration memory cell spends about half of its life in a low voltage state and half of its life in a high voltage state.

The configuration memory inversion controller <NUM> communicates with the inversion control NVM <NUM> on a line <NUM>. The inversion control NVM <NUM> may be onboard the FPGA package (as shown with solid outline), or may be separate from the FPGA package (as shown with dashed outline). The configuration memory inversion controller <NUM> has a system clock input and keeps track of time running in normal mode or inversion mode for each power-on session, writing updated values to the inversion control NVM <NUM> during system shutdown. Like the bus mode control NVM <NUM> of <FIG>, <FIG> and <FIG>, the inversion control NVM <NUM> stores values of cumulative normal mode time and inversion mode time, and allows this information to be used by the configuration memory inversion controller <NUM> to determine whether to select normal mode or inversion mode at each system power-up.

<FIG> is a cross-sectional diagram of the FPGA architecture <NUM> with memory imprinting mitigation as shown in <FIG>, with additional detail showing how multiplexed configuration memory inversion elements <NUM> are used in each of the two configuration memory inversion planes <NUM> and <NUM>. The CM inversion planes <NUM>/<NUM> are made up of a layer of these inversion elements <NUM>, with a common select control driven by the configuration memory inversion controller <NUM>.

Each of the configuration memory cells <NUM> has one of the inversion elements <NUM> connected to its input (in the plane <NUM>) and another inversion element <NUM> connected to its output (in the plane <NUM>). Each of the inversion elements <NUM> comprises a data input line <NUM>. The data input line <NUM> branches to a pass-through connector <NUM> and an inversion gate <NUM>, both of which provide input to a multiplexer (MUX) <NUM>. The MUX <NUM> also receives a selection signal from the configuration memory inversion controller <NUM> on line <NUM>, indicating whether the FPGA <NUM> is operating in normal or inversion mode. When the FPGA <NUM> is operating in normal mode, the MUX <NUM> outputs the non-inverted data from the pass-through connector <NUM> to an output line <NUM>. When the FPGA <NUM> is operating in inversion mode, the MUX <NUM> outputs the inverted data from the inversion gate <NUM> to the output line <NUM>.

Although the physical implementations are different, the mode of use of the imprinting protection shown in <FIG> is identical to that of the previously-discussed circuit card with processor architecture (<FIG>): For every power up event, the configuration memory controller <NUM> decides the logic level (operating mode) of the inversion control and communicates the mode to the CM inversion planes <NUM>/<NUM> - where operation in normal mode is balanced over time with operation in inversion mode.

Claim 1:
A method (<NUM>) for mitigating memory imprinting in volatile configuration memory, CM, of a field programmable gate array, FPGA, device, said method (<NUM>) comprising:
providing an FPGA device with a CM input inversion plane between a CM controller and a layer of CM cells, a CM output inversion plane between the layer of CM cells and a programmable function block layer, and a CM inversion control module in communication with the CM input and output inversion planes;
determining (<NUM>), by the CM inversion control module at system power-up, whether to select a normal mode or an inversion mode for a current power cycle, wherein the normal mode is a mode configured to allow data flowing into and out of the layer of CM cells to flow without inversion;
inverting (<NUM>, <NUM>), by the CM input and output inversion planes when operating in the inversion mode, data flowing into and out of the layer of CM cells, where inverting includes swapping values of logical ones and zeroes;
tracking (<NUM>), by the CM inversion control module, cumulative system times operating in the normal mode and the inversion mode; and
writing (<NUM>) the cumulative system times to a CM mode non-volatile memory module, at system power-down, for use in determining which mode to select at a next system power-up, wherein determining (<NUM>) whether to operate a current power cycle in a normal mode or an inversion mode includes reading the cumulative system times from the CM mode non-volatile memory module and setting the current power cycle to a mode with less cumulative time.