DE102013218646B4 - PROCESSING DEVICE - Google Patents

Abstract

A processing apparatus comprising: an arithmetic section (10); a storage section (20) storing data based on which said arithmetic section (10) performs arithmetic processing; and a protection section (30) that protects the storage section (20) by allowing or prohibiting an access of the arithmetic section (10) to the storage section (20) based on an access type, wherein the storage section (20) stores a software program including plural components includes, and the plurality of components includes at least one secure component and one non-secure component, wherein the secure component meets a predetermined security standard and the non-secure component fails to meet the predetermined security standard, wherein the protection section (30) comprises a plurality of registers (31) and a management section (32 ), wherein the plurality of registers (31) store address data, operation data and protection data, the address data indicating an address range of the memory section (20) to be accessed by the arithmetic section (10), the operation data indicating a specific operation to be performed by the arithmetic section (10) on the memory section (20) is to be executed based on the access type, and the protection data indicates whether protection of the memory section (20) is activated or deactivated,wherein when the management section (32) determines based on the protection data that protection of the memory section (20 ) is activated by the arithmetic section (10), the management section (32) specifies the address range of the memory section (20) to be accessed by the arithmetic section (10) based on the address data, and the specific operation to be performed by the arithmetic section (10 ) is to be executed on the memory section (20) based on the operation data, wherein when the management section (32) determines based on the protection data that the protection of the memory section (20) by the arithmetic section (10) is disabled, the management section ( 32) a specification of the address range of the memory section (20) referred to by the arithmetic section tt (10) is to be accessed, and skips a determination of the specific operation to be performed by the arithmetic section (10) on the memory section (20), wherein a size of the protection data is smaller than a sum of a size of the address data and a size of the operation data is,wherein when the arithmetic section (10) switches a current component, which is one of the plurality of components currently being executed by the arithmetic section (10), from the non-secure component to the secure component, the arithmetic section (10) saves the protection data, stored in the plurality of registers (31) to disable protection of the memory section (20), and wherein when the arithmetic section (10) switches the current component from the secure component to the non-secure component, the arithmetic section (10) rewrites the protection data stored in the plurality of registers (31) to protect the memory ab section (20) to activate.

Description

The present disclosure relates to a processing device that includes an arithmetic section, a storage section, and a protection section that protects the storage section by allowing or prohibiting access of the arithmetic section to the storage section.

Usually includes a microcomputer, as in the JP 2007-287103 A discloses a central processing unit (CPU), a protection information storage section, and a memory access controller. The protection information storage section stores storage protection information. The memory protection information indicates permission or prohibition of access to a memory space by a program executed by the CPU. The memory access controller determines whether to allow a memory access request from the CPU based on the memory protection information.

The CPU runs a program that includes several components. Each component uses a specific region of memory that is different from the other. The multiple components include at least one secure component that meets a predetermined security standard and at least one non-secure component that is not constrained by the security standard. The non-secure component can be considered as a component that does not meet the predetermined security standard. In a case where the non-secure component includes a so-called bug and the CPU operates based on the non-secure component, there is a possibility that the CPU accesses data unnecessary for the operation. Thus, a malfunction of the CPU occurs.

For example, the microcomputer included in JP 2007-287103 A discloses a protection setting register group and the memory access controller. The protection setting register group includes several registers that store memory protection information. The memory access controller determines whether to allow the memory access request from the CPU based on the memory protection information. This configuration allows or prohibits the CPU from accessing the data unnecessary for the operation. That is, the malfunction of the CPU can be avoided.

In the microcomputer described above, the memory protection information differs for each component. Thus, when the CPU switches the program from one to another, that is, when the component is switched from one to another, setting information of the registers included in the protection setting register group must be changed. Thus, so-called overhead is increased when the CPU switches the program from one to the other. That is, excess time and load are necessary when the multiple registers are rewritten to change the memory protection information for each component.

It will also refer to the DE 101 05 284 A1 and the U.S. 2002/0 188 852 A1 referenced, which have been identified as prior art.

the DE 101 05 284 A1 FIG. 1 describes a processing apparatus comprising: an arithmetic section; a storage section that stores data based on which the arithmetic section performs arithmetic processing; and a protection section that protects the storage section by allowing or prohibiting access of the arithmetic section to the storage section based on an access type, the storage section storing a software program including a plurality of components, the protection section including a plurality of registers and a management section, the a plurality of registers storing protection data based on address data indicating an address range of the memory section to be accessed by the arithmetic section, the protection data corresponding to a program ID assigned to a memory area, and the protection section corresponding to this ID with an ID assigned to the executed instruction compares to allow or deny access to the memory.

the U.S. 2002/0 188 852 A1 describes a processing device that executes a software program that includes multiple components, including: an arithmetic section that performs arithmetic processing based on each of the multiple components; a storage section that stores data for arithmetic processing performed by the arithmetic section; and a protection section that protects the memory section by allowing or prohibiting an access of the arithmetic section to the memory section based on an access type, the protection section including a plurality of banks and a correlation section, each of the plurality of banks including a plurality of registers in which memory protection information of the memory section are stored, wherein the memory protection information includes address data and operation data, the address data indicating an address range of the memory section to be accessed by the arithmetic section ben and the operation data indicate a specific operation to be performed by the arithmetic section on the memory section based on the access type, the correlation section correlating a target component with a target bank selected from the plurality of banks, the protection section restricting access of the arithmetic section allows or prohibits the storage section based on the storage protection information stored in the target bank to protect the storage section.

In view of the above problems, it is an object of the present disclosure to provide a processing device in which overhead is reduced.

According to an aspect of the present disclosure, a processing device includes an arithmetic section, a storage section, and a protection section. The storage section stores data based on which the arithmetic section performs arithmetic processing. The protection section protects the memory section by allowing or prohibiting access of the arithmetic section to the memory section based on an access type. The storage section stores a software program including multiple components, and the components include at least a secure component and a non-secure component. The secure component meets a predetermined security standard and the non-secure component fails to meet the predetermined security standard. The protection section includes several registers and an administration section. The registers store address data, operational data and protection data. The address data indicates an address range of the memory section accessed by the arithmetic section or to be accessed by the arithmetic section. The operation data indicates a specific operation to be performed by the arithmetic section on the memory section based on the access type. The protection data indicates whether protection of the memory section is enabled or disabled. When the management section determines that the protection of the memory section by the arithmetic section is activated based on the protection data, the management section specifies the address range of the memory section to be accessed by the arithmetic section based on the address data and determines the specific operation, to be executed by the arithmetic section on the memory section based on the operation data. If the management section determines based on the protection data that the protection of the memory section by the arithmetic section is disabled, the management section skips a specification of the address range of the memory section accessed by the arithmetic section and a determination of the specific operation that is executed by the arithmetic section on the memory section. A size of the protection data is smaller than a sum of a size of the address data and a size of the operation data. When the arithmetic section switches a current component, which is one of the plural components currently being executed by the arithmetic section, from the non-secure component to the secure component, the arithmetic section rewrites the protection data stored in the plural registers by the disable protection of the memory section. When the arithmetic section switches the current component from the secure component to the non-secure component, the arithmetic section rewrites the protection data stored in the plurality of registers to activate the protection of the storage section.

With the above processing device, only the protection data smaller than the sum of the size of the address data and the operation data is rewritten by the arithmetic section. Thus, overhead in the processing device is reduced.

According to another aspect of the present disclosure, a processing device that executes a software program including multiple components includes an arithmetic section, a storage section, and a protection section. The arithmetic section performs arithmetic processing based on each of the components. The storage section stores data for arithmetic processing performed by the arithmetic section. The protection section protects the memory section by allowing or prohibiting access of the arithmetic section to the memory section based on an access type. The protection section includes multiple banks, a bank number register, a specifying section, a correlating section, and a switching section. Each of the banks includes a plurality of registers in which memory protection information of the memory section is stored. The memory protection information includes address data and operation data. The address data indicates an address range of the memory section accessed by the arithmetic section, and the operation data indicates a specific operation performed by the arithmetic section on the memory section based on the access type. The bank number register stores a number that is one of the to activating multiple banks. The specifying section specifies a target component to be executed by the arithmetic section from among the components. The correlation section correlates the target component with a target bank selected from the banks. When the arithmetic section switches a current component, which is one of the plurality of components currently being executed by the arithmetic section, to the target component, the switching section rewrites a number indicative of the target bank correlated with the target component in the bank number register activate the target bank. The protection section permits or prohibits the arithmetic section from accessing the memory section based on the memory protection information stored in the plurality of registers of the target bank activated by the switching section to protect the memory section.

With the above processing device, when the processing device switches the current component to the target component, a current bank is switched to the target bank by writing the number of the target bank to the bank number register. Thus, the processing device can allow or prohibit access of the arithmetic section to the memory section based on the memory protection information stored in the plurality of registers of the target bank. Thus, overhead in the processing device is reduced.

The above and other objects, features, and advantages of the present disclosure will become more apparent from the following detailed description when read in conjunction with the drawings.

• 1 ein Blockschaltbild, das eine Konfiguration einer Verarbeitungsvorrichtung gemäß einer ersten Ausführungsform der vorliegenden Offenbarung darstellt;
• 2 ein Diagramm, das ein Vergleichsbeispiel einer Schutzverarbeitung zum Schützen eines Speicherabschnitts darstellt, wenn ein Speicherschutz immer wirksam ist;
• 3 ein Diagramm, das eine Schutzverarbeitung zum Schützen eines Speicherabschnitts, wenn ein Speicherschutz immer wirksam ist, gemäß der ersten Ausführungsform darstellt;
• 4 ein Blockschaltbild, das eine Konfiguration einer Verarbeitungsvorrichtung gemäß einer zweiten Ausführungsform der vorliegenden Offenbarung darstellt;
• 5 ein Blockschaltbild, das eine Konfiguration eines Speicherabschnitts gemäß der zweiten Ausführungsform darstellt;
• 6 ein Ablaufdiagramm, das eine Verarbeitung darstellt, die durch einen Bankumschaltabschnitt ausgeführt wird;
• 7 ein Diagramm, das eine Schutzverarbeitung zum Schützen eines Speicherabschnitts gemäß der zweiten Ausführungsform darstellt; und
• 8 ein Diagramm, das ein Vergleichsbeispiel einer Schutzverarbeitung zum Schützen eines Speicherabschnitts darstellt.

Show it:

• 1 12 is a block diagram showing a configuration of a processing device according to a first embodiment of the present disclosure;
• 2 Fig. 14 is a diagram showing a comparative example of protection processing for protecting a memory portion when memory protection is always in effect;
• 3 14 is a diagram showing protection processing for protecting a memory portion when memory protection is always effective according to the first embodiment;
• 4 12 is a block diagram showing a configuration of a processing device according to a second embodiment of the present disclosure;
• 5 12 is a block diagram showing a configuration of a memory section according to the second embodiment;
• 6 14 is a flowchart showing processing executed by a bank switching section;
• 7 12 is a diagram showing protection processing for protecting a memory portion according to the second embodiment; and
• 8th Fig. 14 is a diagram showing a comparative example of protection processing for protecting a memory section.

Hereinafter, embodiments of the present disclosure will be explained with reference to the drawings.

(First embodiment)

A processing device according to the first embodiment of the present disclosure will be referred to below with reference to FIG 1 and 3 explained. In the present embodiment, the processing device is applied to a microcomputer 100 . As in 1 As shown, the microcomputer 100 mainly includes an arithmetic section provided by a central processing unit (CPU) 10, a storage section (STORE) 20 and a protection section (PROTECT) 30. The CPU 10 performs arithmetic processing based on data stored in the memory section 20. The storage section 20 stores the data based on which the CPU 10 operates and performs arithmetic processing. The protection section 30 permits or prohibits the CPU 10 from accessing the data stored in the storage section 20 in order to protect the storage section 20. FIG. Specifically, the protection section 30 allows or prohibits the CPU 10 from accessing the memory section 20 based on an access type. In the present embodiment, the access of the CPU 10 to the memory section 20 has three access types including read access to read the data stored in the memory section 20, write access to write data to the memory section 20, and execute access to execute instruction data , which are stored in the memory section 20.

The CPU 10 accesses the memory section 20 and performs arithmetic processing based on the data stored in an address of the memory section 20 to be accessed. The CPU 10 processes multiple bits of data at once.

The memory section 20 includes random access memory (RAM), read-only memory (ROM), and registers. The storage section 20 stores a software program for an operation of the CPU 10. The software program includes at least one secure component and at least one non-secure component. The secure component meets a predetermined security standard and the non-secure component fails to meet the security standard. The safety standard can refer to a safety requirement level for safety-related systems in motor vehicles, the so-called Automotive Safety Integrity Level (ASIL), which is defined by the International Organization for Standardization (ISO) 26262.

The protection section 30 includes a plurality of registers 31 and a management section (MANAGE) 32. The protection section 30 may be provided by a memory management unit. The registers 31 store address data indicating an address range of the memory section 20 to be accessed by the CPU 10, operation data indicating a specific operation to be performed by the CPU 10 with respect to the memory section 20, and protection data indicating whether protection of the memory section 20 is enabled or disabled. The CPU 10 can rewrite the data stored in the registers 31 including the address data, the operation data and the protection data. When the CPU 10 executes the software program based on the secure component, the CPU 10 rewrites the protection data stored in the registers 31 to disable the protection of the memory section 20. FIG. When the CPU 10 executes the software program based on the non-secure component, the CPU 10 rewrites the protection data stored in the registers 31 to activate the protection of the memory section 20. However, the CPU 10 does not rewrite the address data and the operation data stored in the registers 31. FIG.

Furthermore, a size of the protection data indicating whether or not the protection of the memory section 20 is activated is smaller than a sum of a size of the address data and a size of the operation data. Hereinafter, the size of the protection data is also referred to as a protection data size, and the sum of the size of the address data and the size of the operation data is referred to as an operation data size. Since the protection data size is smaller than the operation data size, the CPU 10 can process the protection data once and can process the operation data and the address data multiple times.

The management section 32 protects the storage section 20 based on the data stored in the registers 31 . When the protection of the memory section 20 is activated, the management section 32 specifies the address range of the memory section 20 to be accessed by the CPU 10 based on the address data and determines the specific operation to be performed by the CPU 10 on the memory section 20. based on the operation data. When the protection of the memory section 20 is disabled, the management section 32 does not specify the address range of the memory section 20 to be accessed by the CPU 10 or does not determine the specific operation to be performed by the CPU 10 on the memory section 20. As described above, the CPU 10 deactivates the protection of the memory section 20 when the CPU 10 executes the software program based on the secure component. On the other hand, the CPU 10 activates the protection of the memory section 20 when the CPU 10 executes the software program based on the non-secure component. That is, when the CPU 10 executes the software program based on the secure component, the storage section 20 is not protected by the management section 32 . On the other hand, when the CPU 10 executes the software program based on the non-secure component, the storage section 20 is protected by the management section 32 .

Next, the protection of the memory section 20 will be explained with reference to FIG 2 and 3 explained. 2 Fig. 12 shows a comparative example of protection of the memory section 20 when memory protection of the memory section is always effective. In this case, the protection of the storage section 20 is always effective regardless of whether the component based on which the CPU 10 performs the arithmetic processing is the secure component (SECURE COMPONENT) or the non-secure component (UNSECURE COMPONENT). 3 12 shows the protection of the memory section 20 by the microcomputer 100 according to the present embodiment. in the in 3 In the configuration shown, the CPU 10 reads the component and enables or disables the protection of the memory section 20 according to the component. The registers 31 include an access region, an operation region, and a protection region. The access region stores the address data of the memory section 20 which is allowed to be accessed by the CPU 10. The operation region stores the operation data of the specific operation to be performed by the CPU 10 on the storage section 20. FIG. The protection region stores the protection data indicating whether the protection of the storage section 20 is enabled or disabled. In 2 and 3 the symbol O indicates that the specific operation (operation mode) of the CPU 10 with respect to the memory section 20 is permitted, and the symbol X indicates that the specific operation of the CPU 10 with respect to the memory section 20 is prohibited. In the present embodiment, the operation mode of the CPU 10 with respect to the memory section 20 includes reading, writing, and executing.

As in 2 As illustrated, when the CPU 10 operates based on the secure component or the non-secure component, the protection of the memory section 20 is always effective. Thus, the protection region of the registers 31 is not rewritten by the CPU 10. However, the access region and the operation region of the registers 31 are rewritten by the CPU 10.

In the following, the rewriting of the access region and the operation region of the registers 31 will be explained in detail with reference to FIG 2 explained. In the present embodiment, the memory portion 20 includes a first memory region beginning with address A and ending with address B, a second memory region beginning with address C and ending with address D, a third memory region beginning with address B beginning and ending with address C, and a fourth memory region beginning with address D and ending with address E. As in 2 1, when the CPU 10 operates based on the secure component, the address area of the first memory region and the address area of the second memory region are stored in the access region of the registers 31 as the address data. Further, the registers 31 in the operation region store operation data corresponding to the first storage region and operation data corresponding to the second storage region. The operation data corresponding to the first memory region indicates that when the CPU 10 accesses the first memory region, the CPU 10 is allowed to read and execute data stored in the first memory region, but is not allowed to write data in the first memory region. Further, the operation data corresponding to the second memory region indicates that when the CPU 10 accesses the second memory region, the CPU 10 is allowed to read data stored in the second memory region and write data in the second memory region, but the data in the data stored in the second memory region must not execute.

in the in 2 In the example shown, the management section 32 allows the CPU 10 to access the first memory region and the second memory region of the memory section 20. When the CPU 10 accesses the first memory region, the management section 32 allows the CPU 10 to read and execute the data stored in the first memory region, but prohibits the CPU 10 from writing the data in the first memory region. When the CPU 10 accesses the second memory region, the management section 32 allows the CPU 10 to write the data in the second memory region and read the data stored in the second memory region, but prohibits the CPU 10 from reading the data stored in the second memory region to execute. When the CPU 10 accesses the memory region other than the first memory region and the second memory region, the management section 32 prohibits the CPU 10 from reading and executing data stored in the accessed memory region, and also prohibits the CPU 10 to write data to the accessed memory region.

A case where the component on which the CPU 10 operates is switched from the secure component to the non-secure component will be described below. In this case, the CPU 10 rewrites the data stored in the registers 31. Specifically, the CPU 10 rewrites the address data stored in the access region and the operation data stored in the operation region. As in 2 1, the CPU 10 rewrites the address data stored in the access region of the registers 31 into the address area of the third memory region and the address area of the fourth memory region. Further, the operational data corresponding to the first storage region is rewritten into the operational data corresponding to the third storage region, and the operational data corresponding to the second storage region is rewritten into the operational data corresponding to the fourth storage region. The operation data corresponding to the third memory region indicates that when the CPU 10 accesses the third memory region, the CPU 10 is allowed to read and execute data stored in the third memory region, but is not allowed to write data in the third memory region. Further, the operation data corresponding to the fourth memory region indicates that when the CPU 10 accesses the fourth memory region, the CPU 10 is allowed to read data stored in the fourth memory region and write data in the fourth memory region, but the data in the data stored in the fourth memory region may not execute.

in the in 2 In the example shown, the management section 32 allows the CPU 10 to access the third memory region and the fourth memory region of the memory section 20. When the CPU 10 accesses the third memory region, the management section 32 allows the CPU 10 to read and execute the data stored in the third memory region, but prohibits the CPU 10 from writing the data in the third memory region. When the CPU 10 accesses the fourth memory region, the management section 32 allows the CPU 10 to read the data stored in the fourth memory region and write the data to the fourth memory region, but prohibits the CPU 10 from reading the data stored in the fourth memory region to execute. When the CPU 10 accesses the memory region other than the third memory region and the fourth memory region, the management section 32 prohibits the CPU 10 from reading and executing the data stored in the accessed memory region, and prohibits the CPU 10 also to write data into the memory region being accessed.

A case where the component based on which the CPU 10 operates changes from the non-secure component to the secure component will be described below. In this case, the CPU 10 rewrites the data stored in the registers 31. Specifically, the CPU 10 rewrites the address data stored in the access region and the operation data stored in the operation region. Specifically, the CPU 10 rewrites the address data stored in the access region of the registers 31 into the address area of the first memory region and the address area of the second memory region of the memory section 20 . Further, the operational data corresponding to the third storage region is rewritten into the operational data corresponding to the first storage region, and the operational data corresponding to the fourth storage region is rewritten into the operational data corresponding to the second storage region. The operation data corresponding to the first memory region indicates that when the CPU 10 accesses the first memory region, the CPU 10 is allowed to read and execute the data stored in the first memory region, but is not allowed to write the data in the first memory region. Furthermore, the operation data corresponding to the second memory region indicates that when the CPU 10 accesses the second memory region, the CPU 10 is allowed to read the data stored in the second memory region and write the data in the second memory region, but the data in the second memory region stored data may not execute.

in the in 2 In the example shown, the management section 32 allows the CPU 10 to access the first memory region and the second memory region of the memory section 20. When the CPU 10 accesses the first memory region, the management section 32 allows the CPU 10 to read and execute the data stored in the first memory region, but prohibits the CPU 10 from writing the data in the first memory region. When the CPU 10 accesses the second memory region, the management section 32 allows the CPU 10 to read the data stored in the second memory region and write the data in the second memory region, but prohibits the CPU 10 from reading the data stored in the second memory region to execute. When the CPU 10 accesses the memory region other than the first memory region and the second memory region, the management section 32 prohibits the CPU 10 from reading and executing the data stored in the accessed memory region, and prohibits the CPU 10 also to write the data into the memory region being accessed.

Next, the protection of the memory section 20 by the microcomputer 100 according to the present embodiment will be explained with reference to FIG 3 explained. When the CPU 10 executes the software program based on the secure component, the CPU 10 deactivates the protection of the memory section 20 by rewriting the protection data stored in the protection region of the registers 31. On the other hand, when the CPU 10 executes the software program based on the non-secure component, the CPU 10 activates the protection of the memory section 20 by rewriting the protection data stored in the protection region of the registers 31. Thus, when the component on the basis of which the CPU 10 operates changes from the secure component to the non-secure component or changes from the non-secure component to the secure component, the CPU 10 only writes the protection data stored in the protection region of the registers 31. around. That is, when the component changes between the secure component and the non-secure component, the CPU 10 does not rewrite the address data stored in the access region of the registers 31 and the operation data stored in the protect region of the registers 31.

As in 3 As illustrated, when the CPU 10 operates based on the secure component or the non-secure component, the address data indicative of the address space of the third memory region and the address data indicative of the address space of the fourth memory region are stored in the access region without rewriting. Further, the operational data corresponding to the third storage region and the operational data corresponding to the fourth storage region are stored in the operational region of the registers 31 . The operation data corresponding to the third memory region indicates that when the CPU 10 accesses the third memory region, the CPU 10 is allowed to read and execute the data stored in the third memory region, but is not allowed to write the data in the third memory region. The operation data corresponding to the fourth memory region indicates that when the CPU 10 accesses the fourth memory cher region, the CPU 10 is allowed to read the data stored in the fourth memory region and write the data in the fourth memory region, but is not allowed to execute the data stored in the fourth memory region.

When the CPU 10 operates based on the secure component, the CPU 10 deactivates the protection of the storage section 20 by rewriting the protection data, and the storage section 20 is not protected by the management section 32 . As described above, the secure component is different from the non-secure component and satisfies the security standard. Accordingly, when the CPU 10 operates based on the secure component, even if the address range of the memory section 20 to be accessed by the CPU 10 and the specific operation to be performed by the CPU 10 are not managed by the management section 32 are specified, the CPU 10 is less likely to cause a malfunction.

When the CPU 10 operates based on the non-secure component, the CPU 10 activates the protection of the storage section 20 by rewriting the protection data, and the storage section 20 is protected by the management section 32 . In this case, the management section 32 allows the CPU 10 to access only the third memory region and the fourth memory region of the memory section 20. When the CPU 10 accesses the third memory region, the management section 32 allows the CPU 10 to read and execute the data stored in the third memory region, but prohibits the CPU 10 from writing the data in the third memory region. When the CPU 10 accesses the fourth memory region, the management section 32 allows the CPU 10 to read the data stored in the fourth memory region and write the data to the fourth memory region, but prohibits the CPU 10 from reading the data stored in the fourth memory region to execute. When the CPU 10 accesses the memory region other than the third memory region and the fourth memory region, the management section 32 prohibits the CPU 10 from reading and executing the data stored in the accessed memory region, and prohibits the CPU 10 also to write the data into the memory region being accessed.

The following explains advantages provided by the microcomputer 100 according to the present embodiment. In the present embodiment, the protection of the memory section 20 is enabled or disabled by rewriting the protection data when the component on which the CPU 10 operates changes between the secure component and the non-secure component. In particular, as in 3 shown, when the CPU 10 changes a current component, which is one of the components currently being executed by the CPU 10, from the non-secure component to the secure component, the CPU 10 writes the protection data stored in the registers 31, to deactivate the protection of the memory section 20. When the CPU 10 changes the current component from the secure component to the non-secure component, the CPU 10 rewrites the protection data stored in the registers 31 to activate the protection of the memory section 20. FIG. However, the size of the protection data that enables or disables the protection of the memory section 20 is smaller than the sum of the size of the address data and the operation data. The address data indicates the address range of the memory section 20 that is permitted to be accessed by the CPU 10, and the operation data indicates the specific operation performed by the CPU 10 on the memory section. With this configuration, when the CPU 10 changes the current component between secure component and non-secure component, overhead in the microcomputer 100 is reduced compared with a case where the address data and the operation data are as in the comparative example shown in FIG 2 is shown, rewritten, reduced.

In the present embodiment, the number of the secure components is not limited to a predetermined number. The number of safe components can be an odd number or an even number. A configuration is explained below in which the software program includes a plurality of secure components and the secure components have different security standards from one another. When the CPU 10 operates the software program based on the secure component (also referred to as a second secure component) whose security level is equal to or higher than a predetermined security level, the protection of the storage portion 20 may be disabled. When the CPU 10 operates the software program based on the secure component (also referred to as a first secure component) whose security level is lower than the predetermined security level, the protection of the storage portion 20 can be enabled. That is, when the CPU 10 switches the current component from the first secure component to the second secure component, the CPU 10 rewrites the protection data stored in the registers 31 to disable the protection of the memory section 20. FIG. When the CPU 10 changes the current component from the second secure component to the first secure component switches, the CPU 10 rewrites the protection data stored in the registers to activate the protection of the memory section 20. With this configuration, when the CPU 10 operates based on the secure component having the lower security level than the predetermined level, the malfunction of the CPU 10 can be suppressed.

In the present embodiment, the protection section 30 allows or prohibits the CPU 10 from accessing the memory section 20 based on the access type. In a conventional configuration, the protection section is usually divided into an instruction protection section that protects instructions stored in the storage section and a data protection section that protects data stored in the storage section. In the present embodiment, since the protection section 30 allows or prohibits the CPU 10 to access the memory section 20 based on the access type, the protection section 30 need not be divided into the instruction protection section and the data protection section. Further, in a case where read access must be permitted and write access must be prohibited, the protection section 30 according to the present embodiment can permit read access and prohibit write access by determining the access type of each access. Thus, flexibility in protecting the memory section 20 is enhanced.

(Second embodiment)

A second embodiment of the present disclosure is described below with reference to FIG 4 until 7 explained. In the present embodiment, a processing device is applied to a microcomputer 200. FIG. The microcomputer 200 executes a software program including several different components. Further, the multiple components include at least one secure component and at least one non-secure component.

As described above, the secure component meets the predetermined security standard. That is, the safe component is designed based on certified processing. Thus, the secure component can also be referred to as a component designed based on the certified processing. The safety standard may refer to the ASIL defined by ISO 26262. The non-secure component need not meet the predetermined security standard. In the present embodiment, the non-secure component refers to a component that does not meet the predetermined security standard.

The microcomputer 200 can be applied to an electronic control device that electronically controls vehicle-mounted devices. The electronic control device may include control targets such as power train devices including a motor transmission and a brake, vehicle body devices including an air conditioner, a seat and a door lock, information devices including a navigation device and an electronic toll collection (electronic toll collection, ETC) device, and safety devices including an airbag .

As in 4 As shown, the microcomputer 200 mainly includes an arithmetic section (ARITHMETIC) 210, a storage section (STORE) 220, and a protection section (PROTECT) 230.

The arithmetic section 210 corresponds to a central processing unit (CPU) and performs arithmetic processing based on the components of the software program. The arithmetic section 210 performs arithmetic processing based on the data stored in the storage section 220 . Specifically, the arithmetic section 210 accesses the memory section 220 and performs arithmetic processing based on the data stored in the address of the memory section 220 being accessed. Further, the arithmetic section 210 includes a program counter (PROGRAM COUNTER) 211. The arithmetic section 210 reads instructions from a predetermined address of the memory section 220 based on a value stored in the program counter 211 and performs arithmetic processing. That is, the arithmetic section 210 performs arithmetic processing based on the value of the program counter 211 .

As in 5 As illustrated, memory section 220 includes read-only memory (ROM), random access memory (RAM), and a register. The storage section 220 collectively manages the ROM, RAM, and register as one storage space by assigning different addresses to the RAM, ROM, and register. An address of the memory section 220 increases in a direction of an arrow AD. The storage section 220 stores data based on which the arithmetic section 210 performs arithmetic processing and temporary data generated by the arithmetic processing. Specifically, the storage section 220 stores the software program to be executed by the arithmetic section 210 . In particular, a An execution program corresponding to each component is stored in a predetermined address area of the storage section 220.

The protection section 230 corresponds to a memory management unit (MMU). The protection section 230 protects the storage section 220 by allowing or prohibiting access of the arithmetic section 210 to the data stored in the storage section 220 . Specifically, the protection section 230 allows or prohibits the arithmetic section 210 from accessing the memory section 220 based on an access type. In the present embodiment, the access of the arithmetic section 210 to the memory section 220 has three access types including a read access for reading the data stored in the memory section 220, a write access for writing data into the memory section 220, and an execution access for executing instruction data. stored in the storage section 200. The protection section 230 includes a bank switching section (SWITCH BANK) 231, an address table (ADDRESS TABLE) 232 and a register bank section (REGISTER BANK) 233. The register bank section 233 includes a bank number register (BANK NUMBER REGISTER) 233a and a first (FIRST BANK) 2331 to Nth bank ( NTH BANK) 233n.

The bank switching section 231 switches each bank 2331 to 233n between a disabled state and an enabled state. Specifically, the bank switching section 231 writes in the bank number register 233a a number assigned to a target bank to be activated from the deactivated state to the activated state. With this configuration, the bank switching section 231 switches each bank 2331 to 233n between the disabled state and the enabled state. That is, the bank switching section 231 writes the number of the target bank in the bank number register 233a to switch the target bank from the disabled state to the enabled state. As described above, the bank switching section 231 writes the number of the target bank in the bank number register 233a, and the bank number register 233a stores (holds) the number of the target bank to be activated and activated by the bank switching section 231.

The address table 232 stores the plurality of banks 2331 to 233n associated with corresponding address ranges of the memory section 220. For example, as in 4 As shown, the first bank 2331 associated with the address range between address A and address B of the memory section 220 is stored. The second bank 2332 is stored associated with the address range between address B and address C of the memory section 220 . The Nth bank 233n is stored associated with the address range between a Y address and a Z address of the memory section 220 .

Further, the address table 232 is used to designate a bank corresponding to the component to be executed by the arithmetic section 210. FIG. Also, a component table may be used in place of the address table 232. The component table can store address ranges of banks 2331 to 233n associated with corresponding components. For example, the component table, as in 7 shown store the secure component associated with the first bank 2331 and the non-secure component associated with the second bank 2332 . Hereinafter, the address table and the component table are referred to as a correlation table.

Each bank 2331 to 333n includes a plurality of registers, not shown, and stores address data and protection data. The address data indicates the address range of the memory section 220 to be accessed by the arithmetic section 210. FIG. The protection data includes memory protection information indicating whether a specific operation is allowed to be performed by the arithmetic section 210 on the memory section. That is, each bank 2331 to 233n including a plurality of registers corresponds to one component. The memory protection information of each component is stored in the plural registers of a bank 2331 to 233n. Furthermore, the banks 2331 to 233n are stored corresponding to the components of the software program. For example, when the first bank 2331 is arranged corresponding to the first component, the memory protection information of the first component is stored in the first bank 2331 . Similarly, when the second bank 2332 is arranged corresponding to the second component, the memory protection information of the second component is stored in the second bank 2332. FIG. That is, the protection section 230 performs the address setting (ADDRESS SETTING) and the protection setting (PROTECTION SETTING) for each component based on the data stored in the registers of a corresponding bank 2331 to 233n.

The protection section 230 protects the memory section 220 based on the memory protection information stored in the registers of each bank 2331 to 233n. In particular, the protection section 230 allows the arithmetic section 210 to access the data stored in the storage section 220 based on the memory protection information stored in the registers of the activated bank to protect the memory section 220. That is, the protection section 230 prohibits an unnecessary access of the arithmetic section 210 to the data stored in the memory section 220 based on the memory protection information stored in the registers of the activated banks to protect the memory section 200. FIG.

Next, an operation of the microcomputer 200 will be explained with reference to FIG 6 and 7 explained. The bank switching section 231 performs processing shown in FIG 6 shown, in synchronization with a clock signal of the arithmetic section 210.

At S10, the bank switching section 231 confirms the program counter (PROGRAM COUNTER) 211. That is, the bank switching section 231 reads the value stored in the program counter 211. FIG. The bank switching section 231 specifies a target component to be executed by the arithmetic section 210 by confirming the value stored in the program counter 211 . Thus, the processing executed at S10 by the bank switching section 231 functions as a specifying section. Specifically, the bank switching section 231 specifies (determines) an address range of the memory section 220 in which the target component (execution program) is stored by confirming the program counter 211. That is, the bank switching section 231 specifies the address range of the memory section 220 to be used for executing the target component by confirming the program counter 211. Therefore, the bank switching section 231 indirectly specifies the target component by recognizing the address area of the memory section in which the execution program of the target component is stored. Hereinafter, an address area of the memory section in which the execution program corresponding to the target component is stored is also referred to as an execution address area.

The execution program corresponding to the target component is a program to be executed by the arithmetic section 210 .

In general, the program counter 211 is a necessary piece of hardware for an operation of a CPU of a microcomputer. In the present embodiment, the arithmetic section 210 corresponds to the CPU of the microcomputer. With the processing executed at S10, the execution address range can be specified without adding any hardware part. That is, the target component to be executed by the arithmetic section 210 is specified without adding any hardware part.

The target component can also be specified by the following configuration. The bank switching section 231 may store information indicating predetermined address areas of the storage section 220 in which the execution programs corresponding to the plurality of components are stored. Specifically, the bank switching section 231 may store, as the information, a relational table storing the predetermined address ranges of the execution programs corresponding to the plurality of components linked to the respective components. The bank switching section 231 specifies the execution address range by validating the program counter 211 as described above. Then, the bank switching section 231 determines whether the execution address range is included in one of the address ranges associated with the plurality of components by referring to the relational table explained above. When the bank switching section 231 determines that the execution address range is included in one of the address ranges associated with a corresponding component, the bank switching section 231 specifies the component corresponding to the one of the address ranges as the target component to be executed by the arithmetic section 210. Accordingly, the bank switching section 231 can directly specify the target component by specifying the execution address range based on the relational table.

At S20, the bank switching section 231 confirms the address table (ADDRESS TABLE) 232. The bank switching section 231 correlates the target component (address range) specified at S10 with one of the banks 2331 to 233n by confirming the address table 232. Thus, the processing performed at S20 executed by the bank switching section 231 as a correlation section. Specifically, the bank switching section 231 selects one of the banks 2331 to 233n from the address table 232 when the one of the banks 2331 to 233n includes the address range of the target component specified at S10. That is, the bank switching section 231 determines the target bank corresponding to the target component from the plurality of banks 2331 to 233n based on the address table 232.

As described above, the bank switching section 231 determines the target bank corresponding to the target component to be executed by the arithmetic section 210 by referring to the program counter 211. Then, the bank switching section 231 determines the target component by comparing the execution address range obtained from the program counter with each address range stored in address table 232 in an indirect manner.

When the bank switching section 231 directly determines the target component at S10, the bank switching section 231 can determine the target bank corresponding to the target component based on the component table explained above.

At S30, the bank switching section 231 determines whether switching of the component (COMPONENT) is necessary. The processing executed at S30 by the bank switching section 231 functions as a determination section. The bank switching section 231 determines whether switching of the component is necessary by comparing a current component with the target component specified at S10. If the bank switching section 231 determines that the switching of the component is necessary, the bank switching section 231 proceeds to S40. If the bank switching section 231 determines that the switching of the component is not necessary, the bank switching section 231 ends the in 6 shown processing.

At S40, the bank switching section 231 switches the bank. Specifically, when the bank switching section 231 determines that the current component needs to be switched to the target component specified at S10, the bank switching section 231 activates the target bank. The target bank corresponding to the target component is correlated with the target component at S20. Specifically, the bank switching section switches the target bank from the disabled state to the enabled state by writing the number of the target bank to the bank number register 233a. That is, the bank switching section 231 writes the number of the target bank in the bank number register 233a to activate the target bank. Thus, the processing executed at S30 and S40 by the bank switching section 231 functions as a switching section.

As described above, when the execution address range (the value of the program counter 211) is included in the address ranges stored in the address table 232, the bank switching section 231 refers to the address table 232 and switches the bank. Then, the bank switching section 231 writes the number of the target bank to be activated from the disabled state into the bank number register 233a to switch a current bank corresponding to the current component to the target bank.

Next, the protection of the storage portion 220 is described by comparing a configuration according to a comparative example with the configuration according to the present embodiment with reference to FIG 7 and 8th explained. 7 12 is a diagram showing the protection of the memory section 220 performed by the microcomputer 220 according to the present embodiment. 8th 14 is a diagram showing the protection of the memory section performed by the microcomputer according to the comparative example. In 7 the execution program of the secure component is stored in the address space between address A and address B of the memory section 220 , and then the execution program of the non-secure component is stored in the address space between address B and address C of the memory section 220 .

The microcomputer according to the comparative example does not include the banks 2331 to 233n explained in the present embodiment. Instead, according to the comparative example, the protection section of the microcomputer includes a plurality of registers that store the memory protection information. That is, the multiple registers in the comparative example correspond to one bank of the microcomputer 220 of the present embodiment. As in 8th 1, the execution program of the secure component is stored in the memory section between address A and address B, and the execution program of the non-secure component is stored in the memory section between address B and address C.

Hereinafter, the multiple registers in which the memory protection information is stored are also referred to as protection registers. Furthermore, the protection registers include an access region and an operation region. The access region stores address data indicating an address range of the memory section that is allowed to be accessed by the arithmetic section. The operation region stores operation data indicating operation contents (protection state) to be executed by the arithmetic section. Further, the address data stored in the access region includes a protection start address (PROTECTION START ADDRESS) and a protection end address (PROTECTION ADDRESS). The protection start address and the protection end address are also referred to as address setting data indicating address setting. Further, the operation data stored in the operation region is also referred to as protection setting data indicating protection setting. In 8th the symbol O indicates that the specific operation (operation mode) of the arithmetic section is permitted with respect to the memory section, and the sym bol X indicates that the specific operation of the arithmetic section with respect to the memory section is prohibited. The specific operation (mode of operation) of the arithmetic section with respect to the memory section includes reading, writing and executing.

As in 7 1, microcomputer 200 according to the present embodiment includes banks 2331 to 233n, and each bank 2331 to 233n includes an access region and an operation region. The access region stores address data indicating an address range of the memory section 220 that is allowed to be accessed by the arithmetic section 210 . The operation region stores operation data indicating operation contents (protection state) of the arithmetic section 210 . Further, the address data stored in the access region includes a protection start address and a protection end address. The protection start address and the protection end address are also referred to as address setting data indicating address setting. Further, the operation data stored in the operation region is also referred to as protection setting data indicating protection setting. Similar to 8th gives in 7 the symbol O indicates that the specific operation (operation mode) of the arithmetic section 210 with respect to the storage section 220 is permitted, and the symbol X indicates that the specific operation of the arithmetic section 210 with respect to the storage section 220 is prohibited. The specific operation (operation mode) of the arithmetic section 210 with respect to the memory section 220 includes reading, writing and executing.

The following is with reference to 8th a case where the arithmetic section according to the comparative example executes the software program based on the secure component will be described. The access region stores data indicating address A of the memory section as a first protection start address and data indicating address B of the memory section as a first protection end address. The access region further stores data indicating the address C of the memory section as a second protection start address and data indicating the address D of the memory section as a second protection end address. The memory region of the memory section starting from the first protection start address A and ending with the first protection end address B is also referred to as a first memory region. The memory region of the memory section starting from the second protection start address C and ending with the second protection end address D is also referred to as a second memory region.

Further, the operation region stores the operation data corresponding to the first storage region and the operation data corresponding to the second storage region. The operation data corresponding to the first memory region indicates that when the arithmetic section accesses the first memory region, the arithmetic section is allowed to read out and execute the data stored in the first memory region, but is not allowed to write the data into the first memory region. The operation data corresponding to the second memory region indicates that when the arithmetic section accesses the second memory region, the arithmetic section is allowed to read out the data stored in the second memory region and write the data in the second memory region, but not the data stored in the second memory region may execute.

As in 8th 1, the protection section allows the arithmetic section to access the first memory region and the second memory region of the memory section. When the arithmetic section accesses the first memory region, the protection section allows the arithmetic section to read and execute the data stored in the first memory region, but prohibits the arithmetic section from writing the data in the first memory region. When the arithmetic section accesses the second memory region, the protection section allows the arithmetic section to read the data stored in the second memory region and write the data to the second memory region, but prohibits the arithmetic section from executing the data stored in the second memory region. When the arithmetic section accesses the memory region other than the first memory region and the second memory region, the protection section prohibits the arithmetic section from reading and executing the data stored in the accessed memory region, and also prohibits the arithmetic section from reading the data write to the memory region being accessed.

The following is with reference to 8th a case where the arithmetic section according to the comparative example changes from a state where the arithmetic section executes the software program based on the secure component to a state where the arithmetic section executes the software based on the non-secure component.

When the arithmetic section switches the component from the secure component to the non-secure component, the data stored in the protection registers are rewritten by the arithmetic section. As in 8th is shown, the arithmetic section writes the Rewrites data indicative of address A into data indicative of address B as a third guard start address and rewrites the data indicative of address B into data indicative of address C as a third guard end address. Further, the arithmetic section rewrites the data indicative of address C into data indicative of address D as a fourth protection start address, and rewrites the data indicative of address D into data indicative of address E as a fourth protection end address.

With the above rewriting performed by the arithmetic section, the access region stores the data indicative of address B as the third guard start address and the data indicative of address C as the third guard end address. The access region further stores the data indicative of address D as the fourth guard start address and the data indicative of address E as the fourth guard end address. The memory region of the memory section beginning with the third protection start address B and ending with that of the third protection end address C is also referred to as a third memory region. The memory region of the memory section beginning with the fourth protection start address D and ending with the fourth protection end address E is also referred to as a fourth memory region.

The calculation further rewrites the operational data corresponding to the first memory region into operational data corresponding to the third memory region and rewrites the operational data corresponding to the second memory region into operational data corresponding to the fourth memory region. The operation data corresponding to the third memory region indicates that when the arithmetic section accesses the third memory region, the arithmetic section is allowed to read and execute the data stored in the third memory region and also write data to the third memory region. The operation data corresponding to the fourth memory region indicates that when the arithmetic section accesses the fourth memory region, the display section is allowed to read the data stored in the fourth memory region and write data to the fourth memory region, but does not execute the data stored in the fourth memory region allowed. As described above, when the microcomputer according to the comparative example changes from the secure component to the non-secure component, the arithmetic section rewrites the data stored in the protection registers with a software method. That is, the arithmetic section rewrites the memory protection information stored in the protection registers.

When the data in the protection register is rewritten by the arithmetic section as described above, the protection section allows the arithmetic section to access the third memory region and the fourth memory region of the memory section. When the arithmetic section accesses the third memory region, the protection section allows the arithmetic section to read and execute the data stored in the third memory region, and also allows the arithmetic section to write the data in the third memory region. When the arithmetic section accesses the fourth memory region, the protection section allows the arithmetic section to read the data stored in the fourth memory region and write the data to the fourth memory region, but prohibits the arithmetic section from executing the data stored in the fourth memory region. When the arithmetic section accesses the memory region other than the third memory region and the fourth memory region, the protection section prohibits the arithmetic section from reading and executing the data stored in the accessed memory region, and also prohibits the arithmetic section from reading the data write to the memory region being accessed.

The following is with reference to 8th a case where the arithmetic section according to the comparative example changes from the state in which the arithmetic section executes the software program based on the non-secure component to the state in which the arithmetic section executes the software program based on the secure component.

When the arithmetic section changes the component from the non-safe component to the safe component, the data stored in the protection registers are rewritten by the arithmetic section. In particular, as in 8th 1, the arithmetic section rewrites the address data indicative of the third memory region and the fourth memory region into the address data indicative of the first memory region and the second memory region. The arithmetic section 210 further rewrites the operational data corresponding to the third memory region into operational data corresponding to the first memory region, and rewrites the operational data corresponding to the fourth memory region into the operational data corresponding to the second memory region. The operation data corresponding to the first memory region indicates that when the arithmetic section accesses the first memory region, the arithmetic section is allowed to read and execute the data stored in the first memory region, but is not allowed to write the data in the first memory region. The operation data according to the second Memory region indicate that when the arithmetic section accesses the second memory region, the arithmetic section is allowed to read the data stored in the second memory region and write the data to the second memory region, but is not allowed to execute the data stored in the second memory region. As described above, when the microcomputer according to the comparative example switches the component from the non-safe component to the safe component, the arithmetic section rewrites the data stored in the protection registers with a software method. That is, the arithmetic section rewrites the memory protection information stored in the protection registers.

As in 8th 1, when the memory protection information stored in the protection registers is rewritten by the arithmetic section, the protection section allows the arithmetic section to access the first memory region and the second memory region of the memory section. When the arithmetic section accesses the first memory region, the protection section allows the arithmetic section to read and execute the data stored in the first memory region, but prohibits the arithmetic section from writing the data in the first memory region. When the arithmetic section accesses the second memory region, the protection section allows the arithmetic section to read the data stored in the second memory region and write the data to the second memory region, but prohibits the arithmetic section from executing the data stored in the second memory region. When the arithmetic section accesses the memory region other than the first memory region and the second memory region, the protection section prohibits the arithmetic section from reading and executing the data stored in the accessed memory region, and also prohibits the arithmetic section from reading the data write to the memory region being accessed.

As described above, according to the comparative example, the microcomputer needs to rewrite a plurality of registers when changing the component between the secure component and the non-secure component. That is, the microcomputer according to the comparative example rewrites a plurality of registers when an execution state of the arithmetic section switches to change the protection state. With the above configuration, the microcomputer according to the comparative example achieves memory protection when changing components. In the comparative example, the arithmetic section rewrites six registers when the execution state (components) of the arithmetic section changes.

Next, the protection of the memory section by the microcomputer 200 according to the present embodiment will be explained with reference to FIG 7 explained. First, with reference to 7 explains a case where the arithmetic section 210 executes the software program based on the secure component. In this case, the program counter 211 stores the values indicating the address range from address A to address B. Thus, the bank switching section 231 writes the bank number indicating the first bank 2331 in the bank number register 233a. That is, the first bank 2331 among the plurality of banks 2331 to 233n is activated by the bank switching section 231 . As described above, the first bank 2331 corresponds to the secure component.

The first bank access region 2331 stores data indicating the address A of the memory section 220 as a first protection start address, and data indicating the address B of the memory section 220 as a first protection end address. The first bank access region 2331 further stores data indicating the address C of the memory section 220 as a second guard start address, and data indicating the address D of the memory section 220 as a second guard end address. Similar to the comparative example, the memory region of the memory portion 220 beginning with the first protection start address A and ending with the first protection end address B is also referred to as the first memory region. Similar to the comparative example, the memory region of the memory section 220 starting from the second protection start address C and ending with the second protection end address D is also referred to as the second memory region.

Further, the operation region of the first bank 2331 stores the operation data corresponding to the first memory region of the memory section 220 and the operation data corresponding to the second memory region of the memory section 220. The operation data corresponding to the first memory region indicates that when the arithmetic section 210 accesses the first memory region, the Arithmetic section 210 is allowed to read and execute the data stored in the first memory region, but is not allowed to write data to the first memory region. The operation data corresponding to the second memory region indicates that when the arithmetic section 210 accesses the second memory region, the arithmetic section 210 is allowed to read the data stored in the second memory region and the data into the second memory cherregion may write, but may not execute the data stored in the second memory region.

As in 7 As shown, the protection section 230 allows the arithmetic section 210 to access the first memory region and the second memory region of the memory section 220. FIG. When the arithmetic section 210 accesses the first memory region, the protection section 230 allows the arithmetic section 210 to read and execute the data stored in the first memory region, but prohibits the arithmetic section 210 from writing the data in the first memory region. When the arithmetic section 210 accesses the second memory region, the protection section 230 allows the arithmetic section 210 to read the data stored in the second memory region and write the data to the second memory region, but prohibits the arithmetic section 210 from reading the data stored in the second memory region to execute. When the arithmetic section 210 accesses the memory region other than the first memory region and the second memory region, the protection section 230 prohibits the arithmetic section 210 from reading and executing the data stored in the accessed memory region, and prohibits the arithmetic section 210 also to write the data into the memory region being accessed. With this configuration, the protection section 230 permits or prohibits the arithmetic section 210 from accessing the memory section 220 based on the memory protection information stored in the registers of the activated first bank 2331 to protect the protection section.

The following is with reference to 7 a case where the arithmetic section 210 according to the present embodiment changes from a state where the arithmetic section 210 executes the software program based on the secure component to a state where the arithmetic section 210 executes the software program based on the non-secure component. That is, a case where the component executed by the arithmetic section 210 is switched from the secure component to the non-secure component. When the component executed by the arithmetic section 210 is switched from the secure component to the non-secure component, the program counter 211 rewrites the address range between address A and address B into an address range between address B and address C.

When the arithmetic section 210 switches the component from the secure component to the non-secure component, the bank switching section 231 disables the first bank 2331 and enables the second bank 2332. That is, the bank switching section 231 switches an effective bank from the first bank 2331 to the second bank 2332 around. Specifically, the bank switching section 231 writes the number indicating the second bank 2332 in the bank number register 233a to switch the effective bank from the first bank 2331 to the second bank 2332. That is, the bank switching section 231 switches the bank, which is a hardware part, from the first bank 2331 to the second bank 2332 .

As in 7 As shown, the second bank access region 2332 stores the data specifying the address B as a third protection start address of the memory section 220 and the data specifying the address C as a third protection end address of the memory section 220. The second bank access region 2332 further stores the data indicating the address D as a fourth protection start address of the memory section 220 and the data indicating the address E as a fourth protection end address of the memory section 220. Similar to the comparative example, the memory region of the memory section 220 starting from the third protection start address B and ends with the third protection end address C, also referred to as the third memory region. Similarly to the comparative example, the memory region of the memory section 220 starting from the fourth protection start address D and ending with the fourth protection end address E is also referred to as the fourth memory region.

As described above, since the first bank 2331 is switched to the second bank 2332, the access region of the first bank 2331 is switched to the second bank 2332 access region. Thus, the access region is changed to the same state as in a case where the data indicative of the address A is rewritten into the data indicative of the address B, the data indicative of the address B is rewritten into the data , which indicate the address C, the data indicating the address C is rewritten into the data indicating the address D, and the data indicating the address D is rewritten into the data indicating the address E.

As in 7 1, the operation region of the second bank 2332 stores the operation data corresponding to the third storage region of the storage section 220 and the operation data corresponding to the fourth storage region of the storage section. The operation data corresponding to the third memory region indicates that when the arithmetic section 210 accesses the third memory region, the arithmetic section 210 uses the data stored in the third memory region read and execute and also write the data in the third memory region. The operation data corresponding to the fourth memory region indicates that when the arithmetic section 210 accesses the fourth memory region, the arithmetic section 210 is allowed to read the data stored in the fourth memory region and write data to the fourth memory region, but is allowed to write the data stored in the fourth memory region not allowed to execute.

As described above, since the first bank 2331 is switched to the second bank 2332, the operation region of the first bank 2331 is switched to the operation region of the second bank 2332. Thus, the operation region is changed to the same state as in a case where the operation data corresponding to the first storage region is rewritten to the operation data corresponding to the third storage region and the operation data corresponding to the second storage region is rewritten to the operation data corresponding to the fourth storage region. As described above, the operation data corresponding to the third memory region indicates that when the arithmetic section 210 accesses the third memory region, the arithmetic section 210 is allowed to read and execute the data stored in the third memory region and also write the data in the third memory region . The operation data corresponding to the fourth memory region indicates that when the arithmetic section 210 accesses the fourth memory region, the arithmetic section is allowed to read the data stored in the fourth memory region and write the data in the fourth memory region, but the data stored in the fourth memory region not allowed to execute. As described above, when the microcomputer 200 switches the component from the secure component to the non-secure component, the bank switching section 231 switches the bank from the bank corresponding to the secure component to the bank corresponding to the non-secure component. Thus, the memory protection information is switched by a hardware method by switching the bank.

As in 7 As illustrated, when the bank switching section 231 switches the bank corresponding to the secure component to the bank corresponding to the non-secure component, the protection section 230 allows the arithmetic section 210 to access the third memory region and the fourth memory region of the memory section 220. When the arithmetic section 210 accesses the third memory region, the protection section 230 allows the arithmetic section 210 to read and execute the data stored in the third memory region, and also allows the arithmetic section 210 to write the data in the third memory region. When the arithmetic section 210 accesses the fourth memory region, the protection section 230 allows the arithmetic section to read the data stored in the fourth memory region and write the data to the fourth memory region, but prohibits the arithmetic section 210 from executing the data stored in the fourth memory region . When the arithmetic section 210 accesses the memory region except for the third memory region and the fourth memory region, the protection section 230 prohibits the arithmetic section 210 from reading and executing the data stored in the accessed memory region, and prohibits the arithmetic section 210 likewise to write the data into the memory region being accessed. With this configuration, the protection section 230 allows or prohibits the arithmetic section 210 from accessing the memory section 220 based on the memory protection information stored in the registers of the activated second bank 2332 to protect the protection section 220.

The following is with reference to 7 a case where the arithmetic section according to the present embodiment switches from the state where the arithmetic section executes the software program based on the non-secure component to the state where the arithmetic section executes the software program based on the secure component. That is, in a case where the component executed by the arithmetic section 210 is switched from the non-secure component to the secure component. When the component executed by the arithmetic section 210 is switched from the non-secure component to the secure component, the program counter 211 rewrites the address range between address B and address C into the address range between address A and address B.

When the arithmetic section 210 switches the component from the non-secure component to the secure component, the bank switching section 231 disables the second bank 2332 and enables the first bank 2331. That is, the bank switching section 231 switches the effective bank from the second bank 2332 to the first bank 2331 at. Specifically, the bank switching section 231 writes the number indicating the first bank 2331 in the bank number register 233a to switch the effective bank from the second bank 2332 to the first bank 2331. That is, the bank switching section 231 switches the bank, which is a hardware part, from the second bank 2331 to the first bank 2332 .

As described above, since the second bank 2332 is switched to the first bank 2331, the access region of the second bank 2332 is switched to the access region of the first bank 2331. Thus, the access region is changed to the same state as in a case where the address data indicative of the third memory region of the memory section 220 is rewritten to the address data indicative of the first memory region of the memory section 220 and the address data indicative of the fourth memory region of the memory section 220 to which address data indicating the second memory region of the memory section 220 is rewritten. Further, since the second bank 2332 is switched to the first bank 2331, the operation region of the second bank 2332 is switched to the operation region of the first bank 2331. Thus, the operation region is changed to the same state as in a case where the operation data corresponding to the third storage region is rewritten to the operation data corresponding to the first storage region and the operation data corresponding to the fourth storage region is rewritten to the operation data corresponding to the second storage region. As described above, the operation data corresponding to the first memory region indicates that when the arithmetic section 210 accesses the first memory region, the arithmetic section 210 is allowed to read and execute the data stored in the first memory region, but not write the data into the first memory region allowed. The operation data corresponding to the second memory region indicates that when the arithmetic section 210 accesses the second memory region, the arithmetic section 210 is allowed to read the data stored in the second memory region and write the data in the second memory region but the data stored in the second memory region not allowed to execute data. As described above, when the microcomputer 200 switches the component from the non-secure component to the secure component, the bank switching section 231 switches the bank from the bank corresponding to the non-secure component to the bank corresponding to the secure component. Thus, the memory protection information is switched with a hardware method by switching the bank.

As described above, when the microcomputer 200 switches the current component to the target component, the microcomputer 200 switches the current bank to the target bank corresponding to the target component by writing the target bank number in the bank number register 233a. That is, the microcomputer 200 can permit or prohibit the arithmetic section 210 from accessing the memory section 220 to protect the memory section 220 by writing the target bank number corresponding to the target component in the bank number register 233a. Further, the microcomputer 200 permits or prohibits the arithmetic section 210 from accessing the memory section 220 to protect the memory section 220 based on the memory protection information stored in the plurality of registers of the target bank.

For example, when the microcomputer 200 switches the component from the current component that is the secure component to the target component that is the non-secure component, the memory section 220 is protected only by writing the bank number of the target bank corresponding to the target component into the bank number register 233a. Similarly, when the microcomputer 200 switches the current component, which is the non-secure component, to the target component, which is the secure component, the memory section 220 is protected only by writing the bank number of the target bank corresponding to the target component into the bank number register 233a.

As described above, when the arithmetic section 210 switches the current component, which is one of the plurality of components currently being executed by the arithmetic section 210, to the target component, the switching section writes the number indicating the target bank correlating with the target component , into the bank number register 233a to activate the target bank. Then, the protection section 230 allows or prohibits the arithmetic section 210 from accessing the memory section 220 based on the memory protection information stored in the plurality of registers of the target bank activated by the switch section S30, S40 to protect the memory section 220. That is, when the microcomputer 200 switches the current component to the target component, the microcomputer 200 does not need to rewrite multiple registers as described in the comparative example. Thus, overhead in the microcomputer 200 is reduced. That is, when the microcomputer 200 includes a plurality of banks 2331 to 233n corresponding to the plurality of components, the microcomputer 200 only needs to rewrite a current bank number corresponding to the current component to the target bank number corresponding to the target component. That is, overhead is reduced compared with a case where a plurality of registers are rewritten by the microcomputer as in FIG 8th illustrated comparative example is explained.

In general, a real-time performance in the electronic control device that the on controls the vehicle-mounted devices, important. Further, in the electronic control device that controls the vehicle-mounted devices, the execution state of the component is frequently switched. As described above, since the microcomputer 200 reduces overhead, the microcomputer 200 can be used in the electronic control device that controls the vehicle-mounted devices. In particular, the microcomputer 200 can be used in the electronic control device that controls power train devices. That is, the microcomputer 200 adequately satisfies the real-time performance required in the electronic control device.

In the present embodiment, the bank switching section 231 confirms the program counter 211 and executes the in 6 processing shown only when the value of the program counter 211 changes in a discontinuous manner. That is, the arithmetic section 210 controls the specifying section S10, the correlating section S20 and the switching section S30, S40 to operate only when the value of the program counter 211 changes in a discontinuous manner.

When the value of the program counter 211 changes continuously, the arithmetic section 210 executes the instructions stored in the storage section 220 in a predetermined order, and the value of the program counter 211 is updated by incrementing a constant value after each execution of the instruction. When the value of the program counter 211 changes discontinuously, the value of the program counter 211 is updated to a specific address defined by the arithmetic section 210 based on an execution result of the instruction. For example, when the arithmetic section 210 executes interrupt processing, task processing, and function processing, the value of the program counter 211 is updated to the specific address. Thus, when the arithmetic section 210 executes the instructions stored in the storage section 220 in the predetermined order, it is possible for the bank switching section 231 to switch the in 6 shown skips processing. Further, when the arithmetic section 210 executes the interrupt processing, the task processing, or the function processing, it is possible for the bank switching section 231 to switch the in 6 performs the processing shown. With this configuration, the bank switching section 231 is activated only when the operation of the bank switching section 231 is necessary. Thus, power consumption of the microcomputer 200 can be reduced.

In the present embodiment, the protection section 230 allows or prohibits the arithmetic section 210 from accessing the memory section 220 based on the access type. In a conventional configuration, the protection section is usually divided into an instruction protection section that protects instructions stored in the storage section and a data protection section that protects data stored in the storage section. In the present embodiment, since the protection section 230 allows or prohibits the arithmetic section 210 to access the memory section 220 based on the access type, the protection section 230 need not be divided into the instruction protection section and the data protection section. Further, in a case where read access must be permitted and write access must be prohibited, the protection section 230 according to the present embodiment can permit read access and prohibit write access by determining the access type of each access. Thus, flexibility in protecting the memory section 20 is enhanced.

Further, the specifying section S10 that specifies the target component, the correlating section S20 that correlates the target component with the target bank, and the switching section S30, S40 that sets the effective bank can be obtained by a software program or a hardware circuit.

The invention can be summarized as follows. A processing device includes an arithmetic section, a storage section, and a protection section. The protection section protects the memory section by allowing or prohibiting the arithmetic section to access the memory section. The storage section stores a software program including a secure component and a non-secure component. The protection section stores address data, operation data and protection data. When the arithmetic section switches a current component from the secure component to the non-secure component, the arithmetic section rewrites the protection data to enable protection of the storage section. When the arithmetic section switches the current component from the non-secure component to the secure component, the arithmetic section rewrites the protection data to disable protection of the memory section.

Claims (6)

A processing device comprising: an arithmetic section (10); a storage section (20) storing data based on which the arithmetic section (10) generates a performs arithmetic processing; and a protection section (30) that protects the storage section (20) by allowing or prohibiting an access of the arithmetic section (10) to the storage section (20) based on an access type, the storage section (20) storing a software program containing plural includes components, and the plurality of components includes at least a secure component and a non-secure component, the secure component meeting a predetermined security standard and the non-secure component failing to meet the predetermined security standard, wherein the protection section (30) includes a plurality of registers (31) and a management section ( 32), the plurality of registers (31) storing address data, operation data and protection data, the address data indicating an address range of the memory section (20) to be accessed by the arithmetic section (10), the operation data indicating a specific operation performed by the Arithmetic section (10 ) is to be executed on the memory section (20) based on the access type, and the protection data indicate whether protection of the memory section (20) is activated or deactivated, wherein if the management section (32) determines based on the protection data that the protection of the memory section (20) is activated by the arithmetic section (10), the management section (32) specifies the address range of the memory section (20) to be accessed by the arithmetic section (10) based on the address data and the specific operation to be performed by the arithmetic section (10) to be executed on the memory section (20) is determined based on the operation data, wherein when the management section (32) determines based on the protection data that the protection of the memory section (20) by the arithmetic section (10) is disabled, the Management section (32) a specification of the address range of the memory section (20) to which the arithmetic section (10) is to be accessed, and a determination of the specific operation to be performed by the arithmetic section (10) on the memory section (20), wherein a size of the protection data is smaller than a sum of a size of the address data and a size of the operation data wherein when the arithmetic section (10) switches a current component which is one of the plurality of components currently being executed by the arithmetic section (10) from the non-secure component to the secure component, the arithmetic section (10) saves the protection data, stored in the plurality of registers (31) to disable protection of the memory section (20), and wherein when the arithmetic section (10) switches the current component from the secure component to the non-secure component, the arithmetic section (10 ) rewrites the protection data stored in the plurality of registers (31) to protect the S to activate the memory section (20). Processing device according to claim 1 , characterized in that the at least one secure component includes a first secure component and a second secure component, the first secure component has a security level that is lower than a predetermined security level, the second secure component has a security level that is equal to or greater than the predetermined security level is when the arithmetic section (10) switches the current component from the second secure component to the first secure component, the arithmetic section (10) switches the protection data stored in the plurality of registers (31) to switch the protection of the storage section (20), and when the arithmetic section (10) switches the current component from the first secure component to the second secure component, the arithmetic section (10) rewrites the protection data stored in the plurality of registers (31). to protect the memory section ( 20) to disable. A processing device that executes a software program including a plurality of components, comprising: an arithmetic section (210) that performs arithmetic processing based on each of the plurality of components; a storage section (220) storing data for arithmetic processing performed by said arithmetic section (210); and a protection section (230) that protects the storage section (220) by allowing or prohibiting an access of the arithmetic section (210) to the storage section (220) based on an access type, the protection section (230) protecting a plurality of banks (2331 to 233n ), a bank number register (233a), a specifying section (S10), a correlation section (S20), and a switching section (S30, S40), each of the plurality of banks (2331 to 233n) including a plurality of registers in which memory protection information of the memory section (220 ) are stored, the memory protection information containing address data and operation data, the address data containing an address range of the memory section (220) to be accessed by the arithmetic section (210), and the operation data indicates a specific operation to be performed by the arithmetic section (210) on the memory section (220) based on the access type, the bank number register (233a ) stores a number indicating one of the plural banks (2331 to 233n) to be activated, the specifying section (S10) specifying a target component to be executed by the arithmetic section (210) from the plural components, the correlating section (S20) the target component correlates with a target bank selected from the plurality of banks (2331 to 233n), wherein when the arithmetic section (210) has a current component that is one of the plurality of components currently being executed by the arithmetic section (210), switches to the target component, the switching section (S30, S40) a number indicating the target bank associated with the target k omponente is correlated, writes in the bank number register (233a) to activate the target bank, and wherein the protection section (230) the access of the arithmetic section (210) to the memory section (220) based on the memory protection information in the plurality of registers of the target bank are stored which is activated by the switching section (S30, S40) is allowed or prohibited to protect the storage section (220). Processing device according to claim 3 , further characterized by a program counter (211) storing a value based on which the arithmetic section (210) carries out the arithmetic processing, the arithmetic section (210) including the specifying section (S10), the correlating section (S20) and the switching section (S30 , S40) of the protection section (S230) to operate only when the value of the program counter (211) changes in a discontinuous manner. Processing device according to claim 3 or 4 , characterized in that each of the plurality of components included in the software program corresponds to an execution program stored in a predetermined address area of the memory section (220), the value of the program counter (211) indicates an address of the memory section (220), in which the execution program to be executed is stored, the specifying section (S10) stores information indicating the predetermined address areas of the memory section (220) in which the execution areas of the plurality of components are stored, and when the specifying section (S10) based on the information that are stored in the specifying section (S10), determines that the address of the memory section (220) in which the execution program to be executed is stored is included in one of predetermined address areas of the memory section (220) in which the execution programs of the plurality of components are stored et, the specifying section (S10) specifies the component corresponding to the one of the predetermined address areas of the storage section (220) as the target component. Processing device according to claim 5 , characterized in that the arithmetic section (210) executes the arithmetic processing based on the value of the program counter (211), and the specifying section (S10) the predetermined address area of the memory section (220) in which the execution program to be executed by the arithmetic section (210). is stored based on the value of the program counter (211).

Images