Clock generation with glitch detection and processing

Abstract

The invention relates to clock generation with glitch detection and processing. In a system on chip (SoC), clock selection circuitry provides a selected one of a first or second clock signal as an output clock based on at least one of a first flag and a second flag. This output clock is provided as a reference clock to one or more phase-locked loops (PLLs) of the SoC. The SoC includes a first clock path that receives a first oscillation signal from a first clock source external to the SoC to generate the first clock signal; and a second clock path that receives a second oscillation signal from a second clock source external to the SoC to generate the second clock signal. A first glitch monitor asserts the first mark when a glitch is detected in the first oscillating signal, and a second glitch monitor asserts the second mark when a glitch is detected in the second oscillating signal.

Description

Technical Field

[0001] The present disclosure relates generally to clock generation, and more particularly, to clock generation with glitch detection and handling. Background Art

[0002] Typically, the clock within a system on a chip (SoC) is generated by an external crystal (XTAL). The external XTAL is typically located on a printed circuit board (PCB) to which the SoC is attached and is therefore easily accessible. Tampering with the clock signal from the external XTAL is a common method of disrupting the SoC boot process in an attempt to put this part into an unsafe operating mode, which can expose sensitive information to the risk of unauthorized access. For example, the introduction of clock glitches through pin tampering or electromagnetic exposure can be used to tamper with the clock signal, for example, by manipulating the clock frequency of the clock signal. In addition, faults in the external XTAL or in the board connection of the external XTAL to the SoC can cause dangerous security issues. Therefore, there is a need for an improved clock generation circuit that protects the SoC in the event of a clock tampering attack or a security failure. Summary of the invention

[0003] The following are various embodiments of the present invention. It should be noted that any of the following aspects can be used in any combination with each other and in combination with any disclosed embodiment.

[0004] In an embodiment, a packaged system on chip (SoC) has an SoC mounted on a packaging substrate, and the SoC includes: a clock selection circuit configured to receive a first clock signal and a second clock signal and provide a selected one of the first or second clock signals as an output clock based on at least one of a first flag and a second flag, wherein the output clock is configured to be provided as a reference clock to one or more phase-locked loops (PLLs) for internal circuit systems of the SoC; a first clock path configured to receive a first oscillating signal from a first clock source external to the SoC and generate the first clock signal from the first oscillating signal, the first clock path including a first glitch monitor, the first glitch monitor being configured to assert the first flag when a glitch is detected in the first oscillating signal; and a second clock path configured to receive a second oscillating signal from a second clock source external to the SoC and different from the first clock source and generate the second clock signal from the second clock source, the second clock path including a second glitch monitor, the second glitch monitor being configured to assert the second flag when a glitch is detected in the second oscillating signal. In one aspect, the first oscillating signal is received from outside the packaged SoC. In another aspect, the second clock source is within the packaging substrate of the packaged SoC. In yet another aspect, the first clock source is characterized as a first crystal, and the second clock source is characterized as a second crystal. In another aspect, the second clock source is mounted on a surface of the package substrate. In yet another aspect, the package substrate includes a molding compound surrounding the first clock source and the SoC. In another aspect, the second oscillation signal is received from outside the package SoC. In another aspect of the above embodiment, the first clock path includes: a first clock control circuit configured to receive and amplify the first oscillation signal; and a first delay circuit configured to delay the amplified first oscillation signal and provide the delayed amplified first oscillation signal as the first clock signal. In another aspect, the second clock path includes: a second clock control circuit configured to receive and amplify the second oscillation signal; a second delay circuit configured to delay the amplified second oscillation signal and provide the delayed amplified second oscillation signal as the second clock signal; and a delay locked loop (DLL) configured to align the rising and falling edges of the second clock signal with the corresponding rising and falling edges of the first clock signal before providing the second clock signal to the clock selection circuit, so that the second clock signal matches the first clock signal.In another aspect, the first glitch monitor includes: a third clock control circuit separate from the first clock control circuit, the third clock control circuit configured to receive and amplify the first oscillation signal; and a first bandpass filter configured to assert the first flag when the frequency of the first oscillation signal is outside the passband of the first bandpass filter, wherein the passband corresponds to a frequency range around the expected frequency of the first clock source, and the second glitch monitor includes: a fourth clock control circuit separate from the second clock control circuit, the fourth clock control circuit configured to receive and amplify the second oscillation signal, and a second bandpass filter configured to assert the second flag when the frequency of the second oscillation signal is outside the passband of the second bandpass filter, wherein the passband of the second bandpass filter is the same passband as the passband of the first bandpass filter. In another aspect of the above embodiment, the SoC further includes a control circuit system configured to receive the first and second flags and to provide a control signal to the clock selection circuit to select one of the first clock signal or the second clock signal as the output clock. In another aspect, the first clock signal is characterized as a default clock and the second clock signal is characterized as an alternative clock, wherein after each boot of the SoC, the control circuit system is configured to provide the control signal so that the clock selection circuit initially provides the default clock as the output clock; and when at least one of the first flag or the second flag is asserted, the control circuit system is configured to: adjust the control signal so that the clock selection circuit instead provides the alternative clock as the output clock, and update a boot attempt counter that tracks the number of boot attempts. In another aspect, when at least one of the first flag or the second flag is asserted and the boot attempt counter indicates fewer boot attempts than the maximum number of allowed boot attempts, the control circuit system is configured to restart the SoC. In yet another aspect, when at least one of the first flag or the second flag is asserted and the boot attempt counter indicates that the maximum number of allowed boot attempts has occurred, the control circuit system is configured to perform one or more actions based on which of the first flag or the second flag is asserted.

[0005] In another embodiment, in a packaged SoC having a system on chip (SoC) mounted on a packaging substrate, a method includes: after each boot of the SoC, initially providing a default clock generated from a first oscillating signal to one or more phase-locked loops (PLLs) to generate one or more clocks for an internal circuit system of the SoC; when at least one of the first flag or the second flag is asserted during boot, instead of providing the default clock, providing an alternative clock generated from a second oscillating signal to the one or more PLLs to generate the one or more clocks for the internal circuit system of the SoC, and updating a boot attempt counter to track the number of boot attempts, wherein the SoC is configured to receive the first oscillating signal from a first crystal external to the packaged SoC and receive the second oscillating signal from a second crystal embedded in the packaging substrate. In one aspect, the method further includes restarting the SoC when at least one of the first flag or the second flag is asserted during boot and the boot attempt counter indicates fewer boot attempts than the maximum number of boot attempts allowed, wherein after restarting, the default clock is again provided to the one or more phase-locked loops (PLLs) to generate the one or more clocks for the internal circuit system of the SoC. In another aspect, the method further includes, when at least one of the first flag or the second flag is asserted during boot and the boot counter indicates that the maximum number of allowed boot attempts has occurred, implementing a selected protocol to protect the SoC, wherein the protocol is selected based on which of the first flag or the second flag is asserted. In yet another aspect, the method further includes: after completing the boot without asserting the first flag and without asserting the second flag, entering normal operation; and when at least one of the first flag or the second flag is asserted during normal operation, providing the alternative clock instead of the default clock and updating the boot attempt counter to track additional boot attempts.

[0006] In yet another embodiment, a packaged system on chip (SoC) has an SoC mounted on a package substrate, and the SoC includes: a clock selection circuit configured to receive a first clock signal and a second clock signal, and provide a selected one of the first or second clock signals as an output clock based on at least one of a first tag and a second tag, wherein the output clock is configured to be provided as a reference clock to one or more phase-locked loops (PLLs) for an internal circuit system of the SoC; a first clock control circuit configured to receive and amplify a first oscillation signal from a first crystal located outside the packaged SoC; a first delay circuit configured to delay the amplified first oscillation signal and provide the delayed amplified first oscillation signal as the first clock signal; a second clock control circuit configured to receive and amplify a first oscillation signal from a first crystal located outside the packaged SoC; a first delay circuit configured to delay the amplified first oscillation signal and provide the delayed amplified first oscillation signal as the first clock signal; and a second clock control circuit configured to receive and amplify a first oscillation signal from a first crystal located outside the packaged SoC. A control circuit configured to receive and amplify a second oscillation signal from a second crystal embedded in the package substrate; a second delay circuit configured to delay the amplified second oscillation signal and provide the delayed amplified second oscillation signal as the second clock signal; a delay locked loop (DLL) configured to align the rising edge and falling edge of the second clock signal with the corresponding rising edge and falling edge of the first clock signal before providing the second clock signal to the clock selection circuit, so that the second clock signal matches the first clock signal; a first glitch detector configured to assert the first flag when a glitch is detected in the first oscillation signal; and a second glitch detector configured to assert the second flag when a glitch is detected in the second oscillation signal. In one aspect, after the clock selection circuit changes the output clock from one of the first and second clock signals to the other of the first and second clock signals, the output clock does not undergo any phase change. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] The present invention is illustrated by way of example and not limitation in the accompanying drawings, in which like reference numerals indicate like elements. The elements in the drawings are illustrated for simplicity and clarity and are not necessarily drawn to scale.

[0008] Figure 1 A system with a packaged SoC and an external crystal both attached to a printed circuit board (PCB) is shown in diagrammatic form, wherein the packaged device includes the SoC and the hidden crystal, according to one embodiment of the present invention.

[0009] Figure 2 A block diagram is shown in the form of a block diagram according to an embodiment of the present invention. Figure 1 The clock generation circuitry within the SoC is coupled to an external crystal and hides the crystal.

[0010] Figure 3 A diagram showing a method for Figure 1The state machine of the SoC boot process.

[0011] Figure 4 and 5 A system with a packaged SoC, PCB, hidden crystal, and external crystal is shown in diagram form in accordance with an embodiment of the present invention. DETAILED DESCRIPTION

[0012] In one aspect, a packaged SoC includes a clock generation circuit and an additional hidden crystal, wherein the hidden crystal is used by the clock generation circuit together with an external crystal located outside the packaged SoC. The hidden crystal and the external crystal may be referred to as a hidden XTAL and an external XTAL, respectively, and each crystal is capable of providing a clock source for the internal clock of the SoC generated by the clock generation circuit. In one embodiment, the hidden XTAL is hidden so that the hidden XTAL cannot be visually inspected in the packaged SoC without damaging the package. For example, the hidden XTAL may be buried in the package substrate of the packaged SoC. This provides a safe and protected backup clock source in the event of tampering with the external XTAL. In one embodiment, the clock generation circuit performs dynamic selection of an appropriate clock source (hidden XTAL or external XTAL) based on whether a tampering attack or a clock failure is detected. For example, this selection may be performed based on the output of a corresponding glitch monitor circuit coupled to each of the hidden XTAL and the external XTAL. The ability to select a hidden XTAL as a clock source when there is a security event or a security failure in the external XTAL allows for smooth recovery from clock interference or instability.

[0013] Figure 1A system 40 having a packaged SoC 10 and an external XTAL 28 attached to a PCB 22 according to one embodiment of the present invention is shown. It should be noted that the SoC 10 may also be referred to as a system in chip (SIP). The packaged SoC 10 includes a SoC 12 mounted on a package substrate 18 and a hidden XTAL 26 buried in the package substrate 18. The hidden XTAL 26 is buried in the package substrate 18 so that the hidden XTAL 26 cannot be seen by visual inspection from any surface of the package substrate 18. It should be noted that the SoC 12 may also be referred to as a die or an integrated circuit. The packaged SoC 10 may be implemented as any type of package. For example, in the illustrated embodiment, the SoC 12 is attached to the package substrate 18 via an electrical connection 16, which may correspond to, for example, a solder bump of a ball grid array (BGA). In one embodiment, the SoC 12 may be attached in a flip chip configuration. In an alternative embodiment, the electrical connection 16 between the SoC 12 and the package substrate 18 may be implemented with wire bonding instead of solder bumps. Signals between the ends of hidden XTAL 26 and circuitry within SoC 12 may be routed via metal lines within package substrate 18 and electrical connections 33 and 36. Note that the ends of hidden XTAL 26 may be routed via any two electrical connections (e.g., solder bumps) of electrical connections 16, as desired.

[0014] The packaged SoC 10 and the external XTAL 28 are mounted to the PCB 22. The electrical connections from the SoC 12 are routed through the package substrate 18 to the electrical interconnects 20 using any number of routing layers (also referred to as interconnect layers). In the illustrated embodiment, the electrical interconnects 20 are implemented as solder balls. The PCB 22 routes signals from the packaged SoC 10 as desired. For example, the XTAL 28 is mounted on the PCB 22, next to (e.g., laterally adjacent to) the package substrate 10. Signals between each end of the XTAL 28 and the circuitry within the SoC 12 can be routed via metal lines in the PCB 22, solder balls 20 and 24, metal lines within the package substrate 18, and electrical connections 34 and 32, respectively. It should be noted that each end of the XTAL 28 can be routed via any two electrical connections (e.g., solder balls) in the electrical connection 20 and any two electrical connections (e.g., solder bumps) in the electrical connection 16 as desired.

[0015] In the examples herein, XTAL 26 and 28 correspond to clock sources implemented as crystals. However, in alternative embodiments, other clock sources (e.g., different types of oscillators or oscillator circuits) may be used in place of external XTAL 28 or hidden XTAL 26, or in place of both XTAL 28 and 26. In one embodiment, XTAL 26 may be implemented with a different type of clock source than XTAL 28. Regardless of the clock source used for hidden XTAL 26, the hidden clock source should be located in a location where the hidden clock source is not easily accessible, for example, buried or embedded somewhere within the package substrate 18. If buried within the package substrate 18, the packaged SoC will be destroyed in the process of accessing the hidden clock source, even if it is known that the hidden clock source is buried in the substrate, thereby preventing any further access to the SoC.

[0016] Figure 2 A clock generation circuit 70 is shown within the SoC 12 coupled to each of the hidden XTAL 26 and the external XTAL 28 (both of which are external to the SoC 12). The clock generation circuit 70 includes clock control circuits 46 and 52, clock delays 48 and 54, a delay locked loop (DLL) 50, a multiplexer (MUX) 56, a phase locked loop (PLL) control circuit 58, a PLL 60 (which includes one or more PLLs), glitch monitors 42 and 62, and clock integrity logic 64. The output of the hidden XTAL 26 is coupled to the clock control circuit 66 of the glitch monitor 42 and each of the clock control circuit 46. The output of the clock control 66 is coupled to the input of a band pass filter 68, a first output of the band pass filter 68 is provided to the clock integrity logic 64, and a second output of the band pass filter 68 provides a first error flag (SEC flag) that, when asserted, indicates that an error has occurred. The output of the external XTAL 28 is coupled to each of the clock control circuit 72 of the glitch monitor 62 and the clock control circuit 52. The output of the clock control circuit 72 is coupled to the input of a bandpass filter 74, a first output of which is provided to the clock integrity logic 64, and a second output of the bandpass filter 64 provides a second error flag (SAF flag) that indicates that an error has occurred when asserted. The SAF and SEC flags may also be provided to the clock integrity logic 64, and the output of the clock integrity logic 64 is coupled to the control input of the MUX 56 and may also be provided to the safety circuit system within the SoC 12.

[0017] In one embodiment, the SEC flag corresponds to an error caused by a hidden XTAL, while the SAF flag corresponds to an error caused by an external XTAL. In one embodiment, assertion of the SEC flag may indicate a security-related error due to a security event such as tampering with an external XTAL, and assertion of the SAF flag corresponds to a security-related error due to a security event or security issue such as damage to the clock source, a fault in the PCB routing, etc.

[0018] Still refer to Figure 2 , the output of the external XTAL 28 provides a first oscillating signal as a clock signal to a clock control circuit 52, which amplifies the clock signal and provides the amplified clock signal to a clock delay 54, which adds a predetermined delay to the amplified clock signal. The amplified and delayed clock signal from the clock delay circuit 54 is provided to the DLL 50 as a first clock signal. The output of the hidden XTAL 26 provides a second oscillating signal that is processed similarly to the first oscillating signal. For example, the second oscillating signal is provided as a clock signal to the control circuit 46, which amplifies the clock signal and provides the amplified clock signal to the clock delay 48, which adds a predetermined delay to the amplified clock signal (wherein this delay may match, i.e., be the same as, the delay applied by the clock delay circuit 54). The amplified and delayed clock signal from the clock delay circuit 48 is provided to the DLL 50 as a second clock signal. The DLL 50 may be implemented using any known DLL circuit and is configured to lock the second clock signal in time to the first clock signal so that the first and second clock signals are phase aligned, with aligned rising edges and aligned falling edges. That is, each rising edge of the locked second clock signal occurs simultaneously (or at most within an acceptable tolerance) with the corresponding matching rising edge of the first clock signal, and each falling edge of the locked second clock signal occurs simultaneously (or at most within an acceptable tolerance) with the corresponding matching falling edge of the first clock signal. In this way, the first and second clock signals are matched, wherein the first clock signal generated from the external XTAL 28 is provided as the first data input to the MUX 56, and the second clock signal generated from the hidden XTAL 26 is provided as the second data input to the MUX 56.

[0019] Based on a control input received from clock integrity logic 64, MUX 56 provides one of the first and second clock signals received at its data input as an output clock signal to PLL control 58. PLL control 58 provides a respective clock signal based on the output clock signal to each of any number of PLLs 60, wherein each of PLLs 60 may generate a clock to a corresponding clock domain of the internal circuitry of SoC 12. It should be noted that any known circuitry may be used to implement PLL control 58 and PLLs 60.

[0020] It should be noted that in the illustrated embodiment, clock generation circuit 70 implements two separate clock paths that feed into MUX 56. A first clock path 78 is driven by XTAL 28 (e.g., receives an input oscillating signal from XTAL 28) and provides a first clock signal to MUX 56, while a second clock path 76 is driven by XTAL 26 (e.g., receives an input oscillating signal from XTAL 26) and provides a second clock signal to MUX 56 via DLL 50. Clock path 78 is thus coupled to XTAL 28 and includes glitch detector 62, clock control 52, and clock delay 54, while clock path 76 is coupled to XTAL 26 and includes glitch detector 42, clock control 66, clock delay 48, and DLL 50. The clock integrity logic receives outputs from both clock paths to control MUX 56. It should also be noted that each of XTAL 28 and XTAL 26 drives a corresponding clock path that is capable of outputting an output clock signal used by PLL control 58 and PLL 60. In this manner, clock sources XTAL 28 and XTAL 26 may be used interchangeably to drive PLL control 58 and, therefore, PLL 60. That is, clock path 78 does not use XTAL 26 to generate only a reference clock for clock path 78, and clock path 76 does not use XTAL 28 to generate only a reference clock for clock path 76. Furthermore, although not shown, each clock path may also receive a reference clock in addition to the input from the XTAL as needed to implement the clock path.

[0021] In operation, one of the two clock signals at the input of MUX 56 is selected to provide an output clock to PLL control 58. However, if the glitch monitor corresponding to the selected one of the two clock signals (e.g., glitch monitor 62 for the first clock signal or glitch monitor 42 for the second clock signal) detects an error (e.g., a glitch) in its corresponding clock signal and asserts its corresponding error indicator (e.g., a SAF flag or a SEC flag), clock integrity logic 64 causes MUX 56 to select the other of the two clock signals as the input clock to PLL control 58. Because DLL 50 ensures that both the first and second clocks are aligned, this switch from one clock to the other is performed smoothly without affecting the operation of PLL control 58 or any clock generated by PLL 60. That is, when MUX 56 switches clocks, PLL control 58 and PLL 60 do not detect any phase difference on their input clocks. In one embodiment, the delays applied by clock delay cells 48 and 54 correspond to the time taken by clock integrity logic 64 to make its decision and properly set the control inputs of MUX 56. In this way, there is sufficient time to react to the glitch and ensure a safe clock before the glitch reaches MUX 56.

[0022] In one embodiment, the first clock signal generated based on the external XTAL 28 at the output of the clock delay circuit 54 is selected by the MUX 56 as the default clock to be provided as the output clock signal to the PLL control 58. However, if the glitch monitor 62 detects an error in the first clock signal, the SAF flag is asserted and the clock integrity logic 64 causes the MUX 56 to switch to the alternate clock (corresponding to the second clock signal generated based on the hidden XTAL 26). Since the alternate clock is generated based on the hidden clock source, it is ensured that the alternate clock is a clean, uncorrupted clock source.

[0023] It should be noted that MUX 56 may also be referred to as a clock selection circuit because it selects between the first clock signal and the second clock signal to provide as its output. However, alternative embodiments may use different circuitry rather than a MUX to implement the selection circuit.

[0024] In the illustrated embodiment, the frequency of the crystal is known, however, any glitch interference on the output from the crystal will cause a change in the frequency of the corresponding clock signal. Therefore, the glitch detectors 62 and 42 each include a bandpass filter that attenuates out-of-band frequencies above or below a passband (i.e., the frequency band of interest) so as to pass only those frequencies within the passband. During attenuation, the bandpass filter also sets a corresponding flag (e.g., a SAF or SEC flag) accordingly.

[0025] In one embodiment, each of the XTALs 28 and 26 is a 24 MHz crystal, and the bandpass filters 74 and 68 are implemented so as to attenuate crystal frequencies greater than + / -10%. Thus, the passband of each bandpass filter includes a frequency range around the expected frequency of the clock source (e.g., 24 MHz-10% to 14 MHz+10%). If a deviation from the frequency band of interest is detected, the glitch monitors 62 and 42 determine that an error has occurred in their corresponding clock signal. Thus, in each glitch monitor, a bandpass filter is applied to the amplified clock signal received from the clock control circuit of the glitch monitor. When the input clock signal deviates outside the frequency band of interest (e.g., 24 MHz+ / -10%), the corresponding flag is asserted.

[0026] In one embodiment, the coefficient values ​​of the bandpass filter are determined as a result of a characterization performed during production testing of the SoC 12 (which may also be referred to as a training cycle of the filter). For example, during production testing, ideal frequencies are applied to the filter without glitches, and intermediate (coefficient) values ​​are stored in memory circuitry within the SoC 12. Similarly, higher frequency and lower frequency signals (e.g., those at + / - 10%) are applied to calculate expected intermediate values, and these signals are also stored in the memory circuitry of the SoC 12. In this way, during operation of the SoC 12 in the field, when the filter receives a frequency outside the frequency band of interest, the calculated filter coefficient values ​​do not match the expected values ​​(which were determined and stored during the production test characterization), and thus indicate that the input clock signal from the clock source is outside the expected range, and a corresponding flag is set (i.e., asserted).

[0027] In one embodiment, the bandpass filter may be implemented using any number of stages, wherein the higher the number of stages, the higher the resolution of the glitch detection (so that glitches with smaller widths may be detected). That is, the greater the number of stages, the faster the frequency of the glitch that may be detected. In one embodiment, each stage may be implemented using multiple flip-flops. It should be noted that in alternative embodiments, any type of glitch monitor may be used. For example, instead of or in addition to the bandpass filter, any kind of clock anomaly detection may be used by the glitch monitor, which may be implemented by any type of circuitry.

[0028] Figure 3A state machine 80 is shown that may be implemented within the clock integrity logic 64 to control the startup of the SoC 12 using the SEC and SAF flags according to one embodiment of the present invention. The state machine 80 may be implemented as known in the art. The state machine 80 may also be referred to as a control circuit system, which may include any circuit system for implementing the functionality of the state machine. At state 82, startup is initiated, where the MUX 56 provides a default clock signal (e.g., a first clock signal generated from the external XTAL 28) and the count value (CNT) is initiated to zero. During startup, if neither the SEC nor the SAF flags are asserted, it indicates that there is no clock error and at state 84, the state machine 80 enters normal operation. However, if during startup, the SEC or SAF flag is asserted, the state machine 80 enters a state 86 corresponding to a dirty boot (where CNT increments by one and the clock may switch). In the event that the SEC flag is asserted, the control input of the MUX 56 is switched so as to switch the clock and provide an alternative clock signal (e.g., a second clock signal generated from the hidden XTAL 26). With the SAF flag asserted, the state machine 80 maintains the initial clock signal (e.g., the first clock signal generated from the external XTAL 28). Note that during normal operation at state 84, if the SAF or SEC flag is asserted, any key registers are saved, the current state of the SoC 12 is saved (e.g., the stack is saved), and the state machine 80 transitions to the dirty start state 86 for a dirty start, where the CNT value is incremented and the clock may be switched.

[0029] If during the dirty boot state 86, CNT is still less than the maximum number of boot attempts (N), the state machine 80 returns to the boot state 82 for a restart (where the default clock is again provided by the MUX 56). (It should be noted that the number N can be any integer greater than or equal to zero) However, if during the dirty boot state 86, CNT has exceeded N, another restart is not attempted, and instead, a specific boot mode is entered based on which flag is set. If CNT>N and SEC is asserted, the state machine 80 transitions to state 88 to enter a first boot mode (boot_sec), where a first protocol is executed to protect the SoC. For example, the first protocol may include any desired series of actions to be taken after a suspected security violation. This may include clearing any security keys, and logging information about clock errors. If CNT>N and SAF is asserted, the state machine 80 transitions to state 92 to enter a second boot mode (boot_saf), where a second protocol is executed to protect the SoC. The second protocol may include any desired series of actions to be taken after a suspected security violation or a suspected security violation. This may include the same actions taken in the first startup mode, such as clearing any security keys and logging information about clock errors.Alternatively, the first startup mode and the second startup mode may include different actions.

[0030] The startup mode of states 88 and 92 may be used to limit functionality to ensure that secure information is not corrupted or that the SoC 12 properly enters a secure state. Other embodiments may perform different responses in response to receiving a clock error and exceeding a maximum number of restart attempts (e.g., a complete shutdown). After state 88 or 92, the state machine 80 transitions to a field return state 90, where, for example, the part (SoC 12) may be returned for repair or replacement.

[0031] Figure 4 and 5 Other locations where hidden XTALs may be hidden within a system or package SoC are shown according to embodiments of the present invention. For example, Figure 4 A system with a packaged SoC 100 mounted on a PCB 106 is shown, with an external XTAL 108 located on the surface of the PCB 106, similar to Figure 1The packaged SoC 100 includes a die 102 mounted (in any manner) to a package substrate 104. The packaged SoC 100 includes a hidden XTAL 110 mounted to a surface of the package substrate 104, proximate to the die 102 (i.e., laterally adjacent to the die 102). A mold compound 112 formed on the surface of the package substrate 104 surrounds the die 102 and hides the XTAL 112, such that the XTAL 112 is not visible from the exterior of the packaged SoC 100. While not as hidden as the hidden XTAL 26 buried within the package substrate 18, the XTAL 110 still may not be easily accessible (and would likely require destruction of the packaged SoC 100 to achieve this).

[0032] Figure 5 1 shows a system having a packaged SoC 120 mounted on a PCB 126, with a first XTAL 128 and a second XTAL 130 mounted to a surface of the PCB 126. The packaged SoC 120 includes a die 122 mounted (in any manner) on a package substrate 124. In this example, although Figure 5 In an embodiment of the present invention, the XTAL is neither as hidden as XTAL 26 nor XTAL 110, but one of XTAL 130 and 128 can be used in a manner similar to external XTAL 28, and the other of XTAL 130 and 128 can be used in a manner similar to hidden XTAL 26. That is, one of the two XTALs can generate a default clock while the other generates an alternate clock. Although not as hidden as hidden XTAL 26 or XTAL 110, using a second XTAL on PCB 126 will provide redundant operation when an error is detected on the clock currently in use.

[0033] Therefore, it can now be understood how the clock source and the auxiliary clock source can be used to provide a seamless and secure transition when a security event or physical failure occurs in the clock source. In one embodiment, the clock source is external to the packaged SoC (and can be considered the primary or default clock source), while the auxiliary clock source is hidden (e.g., buried in the package substrate of the packaged SoC). In the case where the auxiliary clock source is hidden, if a security threat is detected, such as due to tampering or intentional glitch interference caused by the external clock source, the operation of the SoC can continue to use this hidden clock source. The hidden clock source provides a clean and undamaged clock that is aligned with the external clock source so that the PLL or other clock generator using the clock source within the SoC is not affected by the change of the clock source. In one embodiment, each clock source is monitored by a glitch monitor to determine the presence of any glitches, and after any glitches are detected, the clock source can switch to an auxiliary (e.g., alternative) clock source.

[0034] The terms "assert" or "set" and "negate" (or "de-assert" or "clear") are used herein in reference to causing a signal, status bit, or similar device to assume its logically true or logically false state, respectively. If the logically true state is a logic level one, then the logically false state is a logic level zero. And if the logically true state is a logic level zero, then the logically false state is a logic level one.

[0035] Each signal described herein can be designed as positive or negative logic, where negative logic can be indicated by a bar on the signal name or an asterisk (*) after the name. In the case of a negative logic signal, the signal is active low, where the logically true state corresponds to a logic level zero. In the case of a positive logic signal, the signal is active high, where the logically true state corresponds to a logic level one. It should be noted that any signal described herein can be designed as a negative logic signal or a positive logic signal. Therefore, in alternative embodiments, those signals described as positive logic signals can be implemented as negative logic signals, and those signals described as negative logic signals can be implemented as positive logic signals.

[0036] Since the apparatus implementing the present invention is primarily composed of electronic components and circuits known to those skilled in the art, circuit details will not be explained to any greater extent than deemed necessary as shown above in order to understand and appreciate the basic concepts of the present invention and in order not to confuse or deviate from the teachings of the present invention.

[0037] Furthermore, the terms "front", "rear", "top", "bottom", "upper", "lower", etc., if any, in the specification and claims are used for descriptive purposes and are not necessarily intended to describe permanent relative positions. It is to be understood that the terms so used are interchangeable under appropriate circumstances such that the embodiments of the invention described herein are, for example, capable of operation in other orientations than those shown or described herein.

[0038] Those skilled in the art will recognize that the boundaries between logic blocks are merely illustrative, and that alternative embodiments may merge logic blocks or circuit elements, or impose alternative decompositions of functionality on various logic blocks or circuit elements. Furthermore, those skilled in the art will recognize that the boundaries between the functions of the operations described above are merely illustrative. The functions of multiple operations may be combined into a single operation, and / or the functions of a single operation may be distributed among additional operations. Furthermore, alternative embodiments may include multiple instances of a particular operation, and in various other embodiments, the order of the operations may be altered.

[0039] Although the present invention is described herein with reference to specific embodiments, various modifications and changes may be made without departing from the scope of the present invention as set forth in the appended claims. For example, a "hidden" clock source may be hidden in various different ways than those examples shown herein. Therefore, this specification and figures should be viewed in an illustrative rather than a restrictive sense, and all such modifications are intended to be included within the scope of the present invention. It is not intended that any benefit, advantage, or solution to a problem described herein with respect to a specific embodiment be understood as a key, essential, or indispensable feature or element of any or all claims.

[0040] As used herein, the term "connected" is not intended to be limited to a direct connection or a mechanical connection.

[0041] Furthermore, as used herein, the terms "a" and "an" are defined as one or more than one. In addition, the use of introductory phrases such as "at least one" and "one or more" in the claims should not be interpreted as implying that another claim element introduced by the indefinite article "a" limits any particular claim containing the claim element so introduced to an invention containing only one such element, even when the same claim includes the introductory phrases "one or more" or "at least one" and an indefinite article such as "an". The same applies to the use of definite articles.

[0042] Unless otherwise stated, terms such as "first" and "second" are used to arbitrarily distinguish between the elements such terms describe. Therefore, these terms are not necessarily intended to indicate temporal or other prioritization of such elements.

Claims

1. A packaged system on chip (SoC) having a system on chip (SoC) mounted on a packaging substrate, characterized in that, The SoC comprises: a clock selection circuit configured to receive a first clock signal and a second clock signal and provide a selected one of the first or second clock signals as an output clock based on at least one of a first tag and a second tag, wherein the output clock is configured to be provided as a reference clock to one or more phase locked loops (PLLs) for internal circuitry of the SoC; a first clock path configured to receive a first oscillating signal from a first clock source external to the SoC and to generate the first clock signal from the first oscillating signal, the first clock path comprising a first glitch detector configured to assert the first flag when a glitch is detected in the first oscillating signal; and A second clock path is configured to receive a second oscillating signal from a second clock source external to the SoC and different from the first clock source and to generate the second clock signal from the second clock source, the second clock path comprising a second glitch detector configured to assert the second flag when a glitch is detected in the second oscillating signal.

2. The packaged SoC according to claim 1, characterized in that: The first clock path comprises: a first clock control circuit configured to receive and amplify the first oscillation signal; and A first delay circuit is configured to delay the amplified first oscillation signal and provide the delayed amplified first oscillation signal as the first clock signal.

3. The packaged SoC according to claim 2, characterized in that: The second clock path comprises: a second clock control circuit configured to receive and amplify the second oscillation signal; a second delay circuit configured to delay the amplified second oscillation signal and provide the delayed amplified second oscillation signal as the second clock signal; and A delay locked loop (DLL) is configured to align the rising edge and the falling edge of the second clock signal with the corresponding rising edge and the falling edge of the first clock signal before providing the second clock signal to the clock selection circuit so that the second clock signal matches the first clock signal.

4. The packaged SoC according to claim 3, characterized in that: The first glitch detector comprises: a third clock control circuit separate from the first clock control circuit, the third clock control circuit being configured to receive and amplify the first oscillation signal, and a first bandpass filter configured to assert the first flag when a frequency of the first oscillating signal is outside a passband of the first bandpass filter, wherein the passband corresponds to a frequency range around an expected frequency of the first clock source, and The second glitch detector comprises: a fourth clock control circuit separate from the second clock control circuit, the fourth clock control circuit being configured to receive and amplify the second oscillation signal, and A second bandpass filter is configured to assert the second flag when the frequency of the second oscillating signal is outside a passband of the second bandpass filter, wherein the passband of the second bandpass filter is the same passband as the passband of the first bandpass filter.

5. The packaged SoC according to claim 1, characterized in that: The SoC additionally includes control circuitry configured to receive the first and second flags and to provide a control signal to the clock selection circuit to select one of the first clock signal or the second clock signal as the output clock.

6. The packaged SoC according to claim 5, characterized in that: The first clock signal is characterized as a default clock and the second clock signal is characterized as an alternative clock, wherein: After each startup of the SoC, the control circuit system is configured to provide the control signal to cause the clock selection circuit to initially provide the default clock as the output clock; and When at least one of the first flag or the second flag is asserted, the control circuitry is configured to: adjusting the control signal so that the clock selection circuit changes to provide the substitute clock as the output clock, and Updates the boot attempt counter that tracks the number of boot attempts.

7. A method for use in a packaged system on chip (SoC) having a system on chip mounted on a packaging substrate, characterized in that, The method comprises: After each startup of the SoC, initially providing a default clock generated from a first oscillation signal to one or more phase-locked loops (PLLs) to generate one or more clocks for internal circuitry of the SoC; When at least one of the first flag or the second flag is asserted during booting, instead of providing the default clock, an alternative clock generated from a second oscillating signal is provided to the one or more PLLs to generate the one or more clocks for the internal circuitry of the SoC, and a boot attempt counter is updated to track the number of boot attempts, wherein: The SoC is configured to receive a first oscillating signal from a first crystal external to the packaged SoC and to receive a second oscillating signal from a second crystal embedded within the package substrate.

8. The method according to claim 7, characterized in that Also includes: When at least one of the first flag or the second flag is asserted during startup and the startup attempt counter indicates fewer startup attempts than a maximum number of allowed startup attempts, restarting the SoC, wherein after restarting, the default clock is again provided to the one or more phase-locked loops (PLLs) to generate the one or more clocks for the internal circuit system of the SoC.

9. The method according to claim 8, characterized in that Also includes: When the at least one of the first flag or the second flag is asserted during startup and the startup attempt counter indicates that the maximum number of allowed startup attempts have occurred, a selected protocol is implemented to protect the SOC, wherein the protocol is selected based on which of the first flag or the second flag is asserted.

10. A packaged system on chip (SoC) having a system on chip (SoC) mounted on a packaging substrate, characterized in that, The SoC comprises: a clock selection circuit configured to receive a first clock signal and a second clock signal and provide a selected one of the first or second clock signals as an output clock based on at least one of a first tag and a second tag, wherein the output clock is configured to be provided as a reference clock to one or more phase locked loops (PLLs) for internal circuitry of the SoC; a first clock control circuit configured to receive and amplify a first oscillation signal from a first crystal external to the packaged SoC; a first delay circuit configured to delay the amplified first oscillation signal and provide the delayed amplified first oscillation signal as the first clock signal; a second clock control circuit configured to receive and amplify a second oscillation signal from a second crystal embedded in the package substrate; a second delay circuit configured to delay the amplified second oscillation signal and provide the delayed amplified second oscillation signal as the second clock signal; a delay locked loop (DLL) configured to align rising and falling edges of the second clock signal with corresponding rising and falling edges of the first clock signal before providing the second clock signal to the clock selection circuit so that the second clock signal matches the first clock signal; a first glitch monitor configured to assert the first flag when a glitch is detected in the first oscillating signal; and A second glitch monitor is configured to assert the second flag when a glitch is detected in the second oscillating signal.

Images