Abstract:
In an embodiment, an integrated circuit such may require that a full reset of the integrated circuit occur before the integrated circuit enters either a test mode or a functional mode. The integrated circuit may include a reset detector to detect that the reset has occurred, and the integrated circuit may not progress to the test mode or the functional mode unless the reset detector detects that the reset has occurred. Accordingly, if test mode is being entered, any user data that may have been stored in the integrated circuit during a preceding functional mode may have been cleared via the reset. Similarly, if normal mode is being entered, any test data that may have been stored in the integrated circuit in a preceding test mode may have been cleared via the reset.

Description:
BACKGROUND 
       [0001]    1. Field of the Invention 
         [0002]    This invention is related to the field of integrated circuits and, more particularly, to detection of power on reset in an integrated circuit. 
         [0003]    2. Description of the Related Art 
         [0004]    Integrated circuits continue to increase in complexity and the number of high level component functions that are included in the integrated circuit also continues to increase. The system on a chip (SOC) is an example of the high level of integration, including one or more processors and various peripheral components, memory controllers, peripheral interface controllers, etc. on a single integrated circuit “chip.” To ensure that the integrated circuits have been manufactured correctly, and to support debugging of hardware and software (which is complicated by the high level of integration), the integrated circuits typically support test modes in addition to the normal functional operation mode. The test modes may permit state to be scanned into and out of the integrated circuit. 
         [0005]    The highly integrated circuits, such as SOCs, may be used in various devices that carry a user&#39;s personal data. For example, the integrated circuits may be used in smart phones, personal digital assistants, and other computing devices that a user may incorporate into his/her daily life and thus may carry significant amounts of personal data such as account numbers, passwords, and other personally-identifiable information. Similarly, such devices are increasingly being expected to maintain the digital rights of intellectual property owners (e.g. owners of audio and video data that a user is permitted to enjoy but is not permitted to copy or redistribute). Accordingly, the integrated circuits need to be secure for such data. Integrated circuits that can switch between test mode and normal functional mode may have potential insecurity (or may have a so-called “security hole”) if data from the functional mode is accessible in test mode or vice-versa. 
       SUMMARY 
       [0006]    In an embodiment, an integrated circuit such may require that a full reset of the integrated circuit occur before the integrated circuit enters either a test mode or a functional mode. The integrated circuit may include a reset detector to detect that the reset has occurred, and the integrated circuit may not transition to the test mode or the functional mode unless the reset detector detects that the reset has occurred. Accordingly, if test mode is being entered, any user data or other private data that may have been stored in the integrated circuit during a preceding functional mode may have been cleared via the reset. Similarly, if functional mode is being entered, any test data that may have been stored in the integrated circuit in a preceding test mode may have been cleared via the reset. The reset may be referred to as a “power on reset,” or POR, because the reset may ensure a clean, empty state of the integrated circuit similar to a state that might be generated by resetting the integrated circuit at the time of power on. 
         [0007]    In one embodiment, the reset detector may include a set of flops that are reset to a known state. If the reset has not occurred, the flops may have a random state that they acquired at power up. The random state may have a low probability of matching the known state. For example, if there are N flops (N is an integer), the probability that the random state matches the known state may be 1 in at least 2 N . 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0008]    The following detailed description makes reference to the accompanying drawings, which are now briefly described. 
           [0009]      FIG. 1  is a block diagram of one embodiment of an integrated circuit. 
           [0010]      FIG. 2  is a block diagram of one embodiment of a reset detector. 
           [0011]      FIG. 3  is a block diagram of another embodiment of a reset detector. 
           [0012]      FIG. 4  is a block diagram of one embodiment of a state machine for an initialization control unit shown in  FIG. 1 . 
           [0013]      FIG. 5  is a block diagram of one embodiment of a system including the integrated circuit of  FIG. 1 . 
       
    
    
       [0014]    While the invention is susceptible to various modifications and alternative forms, specific embodiments thereof are shown by way of example in the drawings and will herein be described in detail. It should be understood, however, that the drawings and detailed description thereto are not intended to limit the invention to the particular form disclosed, but on the contrary, the intention is to cover all modifications, equivalents and alternatives falling within the spirit and scope of the present invention as defined by the appended claims. The headings used herein are for organizational purposes only and are not meant to be used to limit the scope of the description. As used throughout this application, the word “may” is used in a permissive sense (i.e., meaning having the potential to), rather than the mandatory sense (i.e., meaning must). Similarly, the words “include”, “including”, and “includes” mean including, but not limited to. 
         [0015]    Various units, circuits, or other components may be described as “configured to” perform a task or tasks. In such contexts, “configured to” is a broad recitation of structure generally meaning “having circuitry that” performs the task or tasks during operation. As such, the unit/circuit/component can be configured to perform the task even when the unit/circuit/component is not currently on. In general, the circuitry that forms the structure corresponding to “configured to” may include hardware circuits that implement the operation. Similarly, various units/circuits/components may be described as performing a task or tasks, for convenience in the description. Such descriptions should be interpreted as including the phrase “configured to.” Reciting a unit/circuit/component that is configured to perform one or more tasks is expressly intended not to invoke 35 U.S.C. §112, paragraph six interpretation for that unit/circuit/component. 
       DETAILED DESCRIPTION OF EMBODIMENTS 
       [0016]    Turning now to  FIG. 1 , a block diagram of one embodiment of an integrated circuit (IC)  10  is shown. In the illustrated embodiment, the IC  10  includes one or more component blocks  12 A- 12 B, an initialization control circuit  14 , and a set of fuses  18 . The component blocks  12 A- 12 B may include various clocked storage devices  16 A- 16 B (e.g. registers, flops, latches, etc.), some of which may store user state corresponding to a user of a system that includes the IC  10  (or other private state, such as unencrypted video, keys for video, keys for other encryption, etc.). The clocked storage devices  16 A- 16 B may be coupled to receive a reset input to the IC  10 . The initialization control circuit  14  may include a POR detect circuit  20  that is coupled to receive the reset input as well. The initialization control circuit  14  is coupled to the fuses  18  and a test port input to the IC  10 . 
         [0017]    As mentioned above, various storage devices  16 A- 16 B may store user state or other private state during normal functional operation. To prevent such state from being available in test mode, which may permit the user/private state to be scanned out of the IC  10  or to otherwise be accessed from the IC  10 , potentially for nefarious purposes, the initialization control circuit  14  may prevent entry into test mode unless a reset has been detected by the POR detector  20 . Similarly, in an embodiment, the initialization control circuit  14  may prevent entry into normal functional mode (i.e. non-test) mode unless a reset has been detected by the POR detector  20 . Generally, a test mode may be a mode in which the state of the IC  10  is accessible to a test controller (e.g. via the test port on the IC  10 ). The state may be scanned out for analysis, or scanned in to test the circuitry in the IC  10 . The test port may be any type of test connection (e.g. the test port may be compatible with the joint test access group (JTAG) specification, Institute of Electrical and Electronic Engineers (IEEE) 1149.1 and follow-ons, or any other test port specification). The normal functional mode (or simply functional mode) may be a mode in which the IC  10  operates within the system to perform the operations that the system is designed for (e.g. computing, communication, etc.). 
         [0018]    The POR detector  20  may include circuitry to detect that the reset has been performed. For example, in one embodiment, the POR detector  20  may include multiple storage devices that are coupled to the reset input. Each storage device may have a predefined reset state that the storage device acquires in response to assertion of the reset. Some of the storage devices may reset to a binary one, and others may reset to a binary zero. If IC  10  is powered up and the reset is not asserted, the storage devices may acquire a random state of either one or zero. Accordingly, by examining the state of the storage devices, the POR detector  20  may determine (which reasonable accuracy) whether or not a reset has been performed. For example, if there are N storage devices (where N is a positive integer) and if the storage devices are equally likely to have a one or a zero state in response to no reset, the odds of each storage device having the predefined state (and thus detecting a reset when no reset has occurred) is 1 in 2 N . The probability may be further improved by altering the design of the storage devices so that the “non-reset” state is more likely to occur than the predefined reset state if the reset is not asserted. For example, if cross coupled inverters are used to form the storage device, the N-type metal-oxide-semiconductor (NMOS) transistor in one inverter and the P-type MOS (PMOS) transistor in the other inverter may be made larger than the remaining two transistors to make it likely that a binary one will appear on the output of the inverter having the larger PMOS transistor. The predefined reset state may include having a binary zero on the output of that inverter. In such a case, the probability of N storage devices having states that indicate a reset when no reset has occurred may be less probable than 1 in 2 N . 
         [0019]    The initialization control circuit  14  may be coupled to the fuses  18 . The fuses  18  may be selectively blown at manufacture of the IC  10 , to provide some instance-specific values (e.g. a private key or keys for the instance, a serial number or other instance identifier, permissible voltage and/or frequency combinations based on characterization testing, etc.). A fuse may also be used to indicate whether or not entry into test mode is permitted. That is, the fuse may have a first state (e.g. corresponding to a binary one) indicating that entry into the test mode is permitted and a second state different from the first state (e.g. corresponding to a binary zero) indicating that entry into the test mode is not permitted. The initialization control circuit  14  may be configured to read the fuses in response to detection of a reset by the POR detector  20 , and may initialize various state within the IC  10  based on the fuses. 
         [0020]    The component blocks  12 A- 12 B may implement the operations for which the IC  10  is designed. For example, if the IC  10  includes processors, one or more of the component blocks  12 A- 12 B may be processors. In an SOC implementation, one or more component blocks  12 A- 12 B may include one or more memory controllers to communicate with a memory system (e.g. one or more dynamic random access memories). An SOC implementation may further include peripheral components such as audio and/or video processing components, graphics processing components, image processing components, networking components, peripheral interface controllers such as universal serial bus (USB), peripheral component interconnect (PCI), PCI express (PCIe), parallel or serial ports, universal asynchronous receiver/transceiver (UARTs), etc. 
         [0021]    The test port and the reset input may be external inputs to the IC  10 . That is, the test port may be connected to one or more pins on the package of the IC  10 , which may be electrically connected to pads on the IC  10  itself. Similarly, the reset input may be received on an input pin of the package. In some cases, an internal reset may be supported (e.g. via a register written by software to cause a reset). The internal reset and the external reset may be logically combined to form the reset input to the POR detector  20  and the storage devices  16 A- 16 B. Alternatively, the internal reset may be treated differently than the external reset (e.g. it may be a “soft” reset that resets selected storage devices). 
         [0022]      FIG. 2  is a block diagram of one embodiment of the POR detect unit  20  is shown. In the illustrated embodiment, the POR detect unit  20  includes a set of flops including flops  30 A- 30 D coupled to a decoder circuit  32 . The decoder circuit  32  is configured to output a reset detected signal, and the flops  30 A- 30 D are coupled to receive the reset signal on reset ports of the flops  30 A- 30 D. 
         [0023]    The flops  30 A- 30 D may be representative of a set of flops that may be included in the POR detect circuit  20 . There may be more flops than the flops  30 A- 30 D. For example, a set of 32, 64, or 128 flops may be used. Some of the flops are reset to zero (e.g. the flops  30 A- 30 B) and others are reset to one (e.g. the flops  30 C- 30 D). In an embodiment, half of the flops may be reset to zero and the remaining half may be reset to one. 
         [0024]    The decoder circuit  32  may be coupled to receive the state of each flop, and may be configured to decode the state based on the predefined reset state. For example, the decoder circuit  32  may logically NOR the states of the flops  30 A- 30 B that are reset to zero, logically AND the states of the flops  30 C- 30 D that are reset to one, and logically AND the result to generate the reset detected signal. Any Boolean equivalent of the above logic may be implemented in various embodiments of the decoder circuit  32 . 
         [0025]    Viewed in another way, the expected reset states of the flops  30 A- 30 D may be viewed as a multibit value, and the decoder circuit  32  may decode the multibit value to generate the reset detected signal. In general, the decoder circuit  32  may be a control circuit configured to assert the reset detected signal responsive to the predetermined reset state appearing in the flops  30 A- 30 D. 
         [0026]    In the embodiment of  FIG. 2 , the flops  30 A- 30 D may be D-type flops. D-flops have a data input (D), and capture the data input responsive to a clock input. The data input is output from the flop as well (Q). In the embodiment of  FIG. 2 , some of the D-flops are reset to zero flops (e.g. the flops  30 A- 30 B), which are designed to reset to a binary zero on the Q output responsive to the assertion of the reset. Similarly, other D-flops are reset to one flops (e.g. the flops  30 C- 30 D), which are designed to reset to a binary one on the Q output responsive to the assertion of the reset. The flops  30 A- 30 D have a reset port (R) coupled to the reset input and the flops are configured to reset to zero or one (as appropriate) in response to assertion of the reset on the reset input. 
         [0027]    In the embodiment of  FIG. 2 , the clock input to the flops  30 A- 30 D is tied to a constant value. The constant value may be selected to ensure that the flops  30 A- 30 D do not capture the D input, since the flops  30 A- 30 D are provided to detect the reset. In the illustrated embodiment, the clock input is tied to zero. The D flops  30 A- 30 D may be rising edge-triggered flops, for example, and a clock input of zero prevents a rising edge. 
         [0028]    Additionally in  FIG. 2 , the D inputs of the flops  30 A- 30 D are illustrated as being tied to a constant that is the opposite of the reset state. That is, the reset to zero flops  30 A- 30 B have the D inputs tied to one, and the reset to one flops  30 C- 30 D have their D inputs tied to zero. In this fashion, if the D inputs have some effect on the flops  30 A- 30 D, the effect may be to change the state to the opposite (or logical complement) of the reset state. 
         [0029]      FIG. 3  is a block diagram illustrating another embodiment of the POR detector  20 . The embodiment of  FIG. 3  includes the decoder  32  and a set of set-reset (S-R) flops  40 A- 40 D in place of the flops  30 A- 30 D. The flops  40 A- 40 D may be representative of a set of flops that may be included in the POR detect circuit  20 . There may be more flops than the flops  40 A- 40 D. For example, a set of 32, 64, or 128 flops may be used. Some of the flops have a set port (S) coupled to receive the reset input (e.g. the flops  40 C- 40 D), while others have a reset port (R) coupled to receive the reset input (e.g. the flops  40 A- 40 B). Flops having the set port coupled to receive the reset input are set (binary one) on their Q outputs in response to an assertion of reset. Flops having the reset port coupled to receive the reset input are reset (binary zero) on their Q outputs in response to an assertion of reset. In an embodiment, half of the S-R flops  40 A- 40 D may have the reset input coupled to the set port of the flops, and the other half of the S-R flops  40 A- 40 D may have the reset port coupled to the reset input. 
         [0030]    The embodiments of  FIGS. 2 and 3  are merely examples. Other embodiments may use any type of flop or any type of storage device for the POR detector  20 . 
         [0031]      FIG. 4  is a state machine that may be implemented by one embodiment of the initialization control circuit  14 . Generally, the state machine may remain in a particular state unless the conditions for a state transition from that state to another state (as shown in  FIG. 4 ) are met. In the illustrated embodiment, the state machine includes a reset state  50 , a fuse state  52 , a test mode state  54 , and a normal functional mode state  56 . 
         [0032]    In response to a reset assertion while in any state (e.g. the test mode state  54 , the normal functional mode state  56 , the fuse state  52 , or any other state), the state machine transitions to the reset state  50 . The state machine may remain in the reset state  50  until the reset is deasserted and the reset detected output from the POR detector  20  is asserted. The state machine may then transition to the fuse state  52 , during which the initialization control circuit  14  may be configured to read the fuses  18 . Reading the fuses may include reading private or secure state, such as instance-specific keys or other values. Accordingly, preventing entry into the fuse state  62  may prevent reading of private or secure data until a POR has been detected. Once the fuse read (and corresponding initialization in the IC  10 ) is complete, the state machine may transition from the fuse state  52  to one of the test mode state  54  or the normal (functional) mode state  56 . In the test mode state  54 , test access to the component blocks  12 A- 12 B may be permitted from the test port. In the normal functional mode state  56 , test access is not permitted and the IC  10  (component blocks  12 A- 12 B) operates in functional mode. The state machine may transition to the test mode state  54  from the fuse state  52  if the fuse read is complete and the test mode is selected. The test mode selection may be controlled by requests from the test port and/or from a fuse that indicates whether test mode entry is permitted. That is, test mode may be selected, e.g., if the fuse is in the first state and communication on the test port has been received requesting test mode. The normal functional mode may be selected, e.g., if the fuse is in the second state or no communication on the test port has been received requesting the test mode. If test mode is not selected and the fuse read is complete, the state machine may transition to the normal mode state  56  from the fuse state  52 . 
         [0033]    As can be seen in  FIG. 4 , once the test mode state  54  has been entered, it is not possible to enter the normal functional mode state  56  without detection of at least one reset by the POR circuit  20  since the integrated circuit  10  has been powered up. Similarly, once the normal functional mode  56  has been entered, it is not possible to enter the test mode state  54  without detection of at least one reset by the POR circuit  20  since the integrated circuit  10  has been powered up. Even though the reset state  50  is entered in response to assertion of reset, exiting the reset state  50  includes detecting that the reset has occurred (i.e. that the reset remained asserted long enough to actually reset the storage devices). 
         [0034]    Turning now to  FIG. 5 , a block diagram of one embodiment of a system  150  is shown. In the illustrated embodiment, the system  150  includes at least one instance of the integrated circuit  10  (from  FIG. 1 ) coupled to one or more peripherals  154  and an external memory  158 . A power supply  156  is also provided which supplies the supply voltages to the integrated circuit  10  as well as one or more supply voltages to the memory  158  and/or the peripherals  154 . In some embodiments, more than one instance of the integrated circuit  10  may be included (and more than one external memory  158  may be included as well). 
         [0035]    The peripherals  154  may include any desired circuitry, depending on the type of system  150 . For example, in one embodiment, the system  150  may be a mobile device (e.g. personal digital assistant (PDA), smart phone, etc.) and the peripherals  154  may include devices for various types of wireless communication, such as wifi, Bluetooth, cellular, global positioning system, etc. The peripherals  154  may also include additional storage, including RAM storage, solid state storage, or disk storage. The peripherals  154  may include user interface devices such as a display screen, including touch display screens or multitouch display screens, keyboard or other input devices, microphones, speakers, etc. In other embodiments, the system  150  may be any type of computing system (e.g. desktop personal computer, laptop, workstation, net top etc.). 
         [0036]    The external memory  158  may include any type of memory. For example, the external memory  158  may be SRAM, dynamic RAM (DRAM) such as synchronous DRAM (SDRAM), double data rate (DDR, DDR2, DDR3, etc.) SDRAM, RAMBUS DRAM, etc. The external memory  158  may include one or more memory modules to which the memory devices are mounted, such as single inline memory modules (SIMMs), dual inline memory modules (DIMMs), etc. Alternatively, the external memory  158  may include one or more memory devices that are mounted on the integrated circuit  10  in a chip-on-chip or package-on-package implementation. 
         [0037]    Numerous variations and modifications will become apparent to those skilled in the art once the above disclosure is fully appreciated. It is intended that the following claims be interpreted to embrace all such variations and modifications.