JPH03216746A - Memory protector - Google Patents

Abstract

PURPOSE:To surely protect the memory data on a RAM against the runaway of a processor and the intentional and illicit accesses by setting the attribute data to an attribute memory to inhibit the writing operation in accordance with the data word of a data memory storing the writing operation inhibiting data. CONSTITUTION:The attribute data is set to an attribute memory 21 to inhibit the data rewriting operation is accordance with the data word inhibiting the writing operation out of those data stored in a data memory 5. Thus the accesses are defined as errors every time a CPU 1 tries to rewrite the corresponding data stored in the memory 5. Thus the data rewriting operation is inhibited. That is, the attribute data inhibiting the data writing operation is set to the memory 21 so that the data stored in the corresponding area of the memory 5 can be protected. Thus it is possible to surely protect the memory data on a RAM against the runaway of a processor and the intentional and illicit accesses.

Description

DETAILED DESCRIPTION OF THE INVENTION [Object of the Invention] (Field of Industrial Application) The present invention relates to a memory protection device that protects data in a memory used in a device using a microprocessor.

(Prior Art) Conventionally, memories used in devices using microprocessors include ROM (read-only memory), R
AM (random access memory) and the like are known. Since writing of data to ROM is prohibited, it has the advantage that memory data can be reliably protected even if an abnormality occurs in the device. [Kazi, ROM once set in the device
To update the ROM data, it is necessary to replace the ROM with another one or use a dedicated data rewriting device to rewrite the data stored in the ROM. It had to be taken out, which required time and effort.

On the other hand, since data can be freely written to and read from RAM, it is suitable as a storage means for data that is frequently updated. However, since the memory data in this RAM can be rewritten, there is a risk that necessary data may be destroyed due to equipment abnormality, etc., and protection measures are required to prevent this and protect the memory data. . Conventionally, therefore, memory data has been protected by incorporating into the processor a software program that prohibits rewriting of memory data in the event of an abnormality.

However, with this software program-based memory data protection means, there is a risk that the program may stop working and the memory data may be destroyed due to a runaway of the processor, or may be rewritten due to deliberate unauthorized access. For this reason, there is a problem in that it cannot be applied to devices such as those in various process control fields where data destruction would lead to serious danger.

(Problem to be Solved by the Invention) As described above, in the conventional technology in which memory data in RAM is protected by a software program, it is difficult to prevent data from being destroyed due to a runaway processor, etc. It was not possible to reliably protect against unauthorized access, etc. For this reason, there is an inconvenience that this method cannot be applied to devices such as those in various process control fields where data abnormalities can lead to serious danger.

SUMMARY OF THE INVENTION Therefore, an object of the present invention is to provide a memory protection device that can reliably protect memory data in RAM from a runaway processor or intentional unauthorized access.

[Structure of the Invention] (Means for Solving the Problems) In a protection device for a data memory that stores a plurality of words of data in units of words, an attribute that stores attributes for each word of the data memory in units of one or more words. a memory; a memory attribute generating means for generating an attribute corresponding to a data word to be accessed from the attribute memory in response to a data access to the data memory; and an access attribute generating means for generating an attribute indicating the type of data access to the data memory. , and determining means for determining whether execution of data access to the data memory is permitted based on a combination of the memory attribute and the access attribute generated by these generating means.

Note that an unused bit of the parity pit storage memory provided for the data memory can be used as the attribute memory.

Furthermore, it is advantageous to provide means for forcibly generating a specific instruction code when it is determined that data access to the data memory cannot be executed.

(Function) In a memory protection device having such a configuration, the attribute memory is used to specify attributes for each word of the data memory, such as whether to permit or prohibit writing of data, permit or prohibit reading of data, etc. information is stored in units of one or more words.

By doing this, when data access is performed from the processor to the data memory, the memory attribute generation means generates an attribute corresponding to the data word to be accessed from the attribute memory, and at the same time, the access attribute generation means generates an attribute for the data access. Attributes indicating the type are generated, and based on a combination of these attributes, it is determined whether or not to permit execution of data access to the data memory. Therefore, by storing in the attribute memory an attribute that prohibits writing corresponding to a data word of the data memory in which data that prohibits rewriting is stored, the data can be protected.

Note that memory usage efficiency can be improved by substituting unused bits of the parity pit storage memory provided for the data memory as the attribute memory.

Furthermore, by generating a no-operation code when data access cannot be executed, it becomes possible to take appropriate measures in the event of an abnormality.

(Example) Hereinafter, an example in which the present invention is applied to the microcomputer system shown in FIG. 1 will be described with reference to the drawings.

In Figure 1, 1 is a CPU as a microprocessor.
(Central processing unit), and this CPU 1 is connected to a data memory 5, a memory attribute generator 6 via each bus line of an address bus 2, a data bus 3, and a control signal bus
and an access attribute generator 7 are connected respectively. Further, a peripheral circuit 8 for controlling peripheral devices such as a printer, a display, and a keyboard, and an error detector 9 are connected to the CPUI via the control signal bus 4.

The error detector 9 is connected to the memory attribute generator 6 and the access attribute generator 7 via a memory attribute bus 10 and an access attribute bus 11, respectively. Further, the error detector 9 is capable of outputting a memory write protection signal S1 and a memory read protection signal S2 to the data memory 5 at appropriate times.

The data memory 5 is composed of RAM, and the CPU
Program data for I to control various parts, program data for various tasks activated by the peripheral circuit 8, etc. are stored.

The memory attribute generator 6 has an attribute memory 21 as shown in FIG. This attribute memory 21 is arranged one-to-one or one-to-one for the data words stored in the data memory 5.
This is a memory that stores attribute data in correspondence with n pairs (n≧2). The addresses of the attribute memory 21 and the addresses of the data memory 5 have a one-to-one correspondence. Note that the attributes include a data write attribute that indicates whether writing of data is prohibited or permitted, a data read attribute that indicates whether reading of data is prohibited or permitted, and whether reading of data is prohibited when fetching an operation code. There are program execution attributes that indicate whether permission is granted, and task level attributes that select hierarchical privilege levels, so-called task levels, assigned to various tasks.

On the other hand, a memory address signal A1 is sent to the address input terminal ADR of the attribute memory 21 via the address bus 2.
is input. Further, data on the data bus 3 is inputted to the data input terminal DIN via the output port 22 and the latch circuit 23. Here, the output boat 22 is selected by a boat address signal A2 input via the address bus 2, and at this time reads data on the data path 3 and outputs it to the latch circuit 23. The latch circuit 23 outputs data to the attribute memory 21 based on the write control signal S3 input via the control signal bus 4.

The write terminal WE of the attribute memory 21 has an AND circuit 2.
A write signal WS, which is the output of No. 4, is input. Further, a read signal RS, which is an output of the logic NOT circuit 25, is input to the read terminal RE. Here, the AND circuit 24 outputs a data memory read signal S4 input via the control signal bus 4 and an attribute memory write permission signal S.
Compute the AND with 5. The logic negation circuit 25 calculates the logic negation of the attribute memory write permission signal S5.

A data output terminal DOUT of the attribute memory 21 is connected to the attribute data bus 10. Thus, when an address is specified by the memory address signal A1 while the read signal RS is being input, the attribute data of the specified address is output to the attribute data path 10 as the memory attribute data signal p. It has become.

Further, when an address is specified by the memory address signal A1 while the write signal WS is input (at this time, the read signal RS is not input), the attribute data input to the data input terminal DIN is stored at the specified address. It is now set.

The access attribute generator 7 generates a status corresponding to the access type (reading, writing, etc.) as an access attribute each time the data memory 5 is accessed once. As shown, it has an access status encoder 31, an output port 32, and a latch circuit 33.

The access status encoder 31 sets a data read attribute as an access attribute when a data memory read signal s4 is input via the control signal bus 4, and a data write attribute as an access attribute when a data memory write signal S6 is input. When the operation code fetch signal s7 is input, a program execution attribute is generated as an access attribute, and the generated access attribute signal q1 is output to the access attribute bus 11. The output port 32 is selected by the boat address signal A3 input via the address bus 2, and reads the task level data D2 generated from the peripheral circuit 8 from the data bus 3 and outputs it as a task level attribute signal q2 to the latch circuit. Output to 33. The latch circuit 33 outputs the task level attribute signal q2 to the access attribute bus 11 based on the write control signal S8 input via the control signal bus 4.

The error detector 9 includes an error determination section 41 and a gate circuit 42, as shown in FIG.

The error determination unit 41 transmits the memory attribute data signal p generated from the memory attribute generator 6 and the access attribute signal q1 or task level attribute signal q2 generated from the access attribute generator 7 to the memory attribute bus 10 and The system inputs each input from the access attribute bus 11, examines the relationship between the two by using the matching relationship, inclusion relationship, or appropriate calculation, and determines whether or not an error occurs based on the result.The determination result is used as the determination signal a described above. Gate circuit 4
2 is output. Also, when determining an error, interrupt signal b
and a transfer acknowledge signal C to the control signal bus 4. The gate circuit 42
When the judgment signal a from the error judgment unit 41 indicates permission to access the data memory 5, that is, when it is not an error judgment, the data memory read signal S4 or the data memory write signal S6 from the control signal bus 4 is sent to the memory respectively. It is output to the write terminal WE or the read terminal RE of the data memory 5 as a write protection signal S1 or a memory read protection signal S2.

Therefore, if the data memory 5 is selected by the chip select signal CS from the control signal bus 4 and the memory write protection signal S1 is input to the write terminal WE, the address signal A1 input to the address terminal ADH is
Data input/output terminal I/O to the address specified by
It is designed to write the data entered in. On the other hand, if the memory read protection signal S2 is input to the read terminal RE while being selected by the chip select signal CS, the data at the address specified by the address signal A1 input to the address terminal ADR is transferred to the data. It is configured to output to the data bus 3 from the input/output terminal I/O.

In this embodiment configured in this way, the addresses of the data memory 5 and the addresses of the attribute memory 21 provided in the attribute memory generator 6 correspond one-to-one, and are stored in the data memory 5. The attributes of the data word can be set to the corresponding addresses in the attribute memory 21. That is, by selecting the attribute setting mode, the AND circuit 2
4 becomes active, and at this time, the attribute data output from the latch circuit 23 is written to the address specified by the memory address signal A1. It can be set arbitrarily by specifying the address and attribute data.

When the CPU 1 accesses the data memory 5 with the attribute of the data word stored in the data memory 5 set at the corresponding address in the attribute memory 21, the attribute memory generator 6 outputs information from the attribute memory 21. The attribute data set at the corresponding address is output to the memory attribute bus 10 as a memory attribute data signal p. At the same time, the access attribute generator 7 outputs an access attribute signal q1 corresponding to the access type to the access attribute bus 1l. The error detector 9 then compares the memory attribute data signal p and the access attribute signal q1.

For example, when the two match, it is determined that there is no error, and the access signal to the data memory 5, that is, the data memory read signal S4 or the data memory write signal S6, is used as the memory write protection signal S1 or the memory read protection signal S2, respectively. The data is supplied to the memory 5. As a result, the data memory 5 is accessed.

On the other hand, if the error detector 9 determines that there is an error, output of the access signal to the data memory 5 is prohibited. Therefore, data memory 5 becomes inaccessible. Also, at this time, the error detector 9 detects that CP
An interrupt is applied to the UI, and a transfer acknowledge signal C is sent. As a result, the access cycle of the CPU 1 ends midway.

Therefore, among the data stored in the data memory 5, data word (one or more) of data that is prohibited from being rewritten.
By setting attribute data that prohibits data writing in the attribute memory 21 in response to this, whenever the CPU attempts to rewrite the corresponding data on the data memory 5, the access can always be treated as an error, and the data Rewriting operations can be prohibited. In other words, by setting attribute data that prohibits data writing in the attribute memory 21, data stored in the corresponding area on the data memory 5 can be reliably protected.

Furthermore, for areas on the data memory 5 where no data has been set, attribute data that prohibits data reading is set in the corresponding area of the attribute memory 21. By doing this, the CPU
Even if data is read from the corresponding area on the data memory 5 due to a runaway of I, the access can be made an error.

At this time, an interrupt is applied to the CPU, a transfer acknowledge signal is sent, and the access cycle of the CPU is terminated, so that the runaway of the CPU 1 can be reset. Therefore, even if there is intentional unauthorized access, it can be reliably prevented.

Note that the present invention is not limited to the above embodiments,
It goes without saying that the present invention can be modified in various ways without departing from the scope of the invention.

For example, FIG. 5 shows a configuration example in which a parity memory 51 already provided for the data memory 5 is substituted for the function of the attribute memory 21 incorporated in the memory attribute generator 6. Parity memory 51 is for storing parity bits of data set in data memory 5, and unused bits on parity memory 51 are assigned to attribute data. In this case, not only the same effects as in the embodiment described above can be achieved, but also the memory usage efficiency can be improved.

It goes without saying that it is necessary to perform appropriate scheduling within the memory access cycle so as not to affect the original operation of the parity memory 51.

Further, FIG. 6 shows an example of a configuration in which a specific instruction code is generated when the error determining section 41 of the error detector 9 determines that an error has occurred. In this case, the instruction code generated from the code generator 61 in response to the error signal d from the error determination section 41 may be a no-operation code, a jump instruction code to an error processing task, or the like. By generating such an instruction code for the CPUI, appropriate measures can be taken to prevent the CPUI from operating unexpectedly when an access error occurs.

[Effects of the Invention] As described in detail above, according to the present invention, it is possible to provide a memory protection device that can reliably protect memory data in a RAM from a runaway processor or intentional unauthorized access.

Moreover, according to claim 2, it is possible to provide a memory protection device that can improve memory usage efficiency.

Furthermore, according to claim 3, it is possible to provide a memory protection device that can promptly take appropriate measures against the occurrence of an access error.

[Brief explanation of drawings]

1 to 4 are diagrams showing one embodiment of the present invention, in which FIG. 1 is a block diagram showing the overall configuration, FIG. 2 is a block diagram showing the configuration of the memory attribute generator, and FIG. 3 is a block diagram showing the configuration of the memory attribute generator. FIG. 4 is a block diagram showing the configuration of the access attribute generator, FIG. 4 is a block diagram showing the configuration of the error detector, FIG. 5 is a block diagram showing the configuration of a modified example in which parity memory is used as the attribute memory, and FIG. FIG. 3 is a block diagram showing an improved example of an error detector. 1... CPU, 5... Data memory, 6... Memory attribute generator, 7... Access attribute generator, 9...
Error detector, 21... Attribute memory, 5l... Validity memory, 61... Code generator.

Claims (3)

[Claims] (1) In a protection device for a data memory that stores multiple words of data in units of words, an attribute memory that stores attributes for each word of the data memory in units of one or more words, and a data access to the data memory are provided. memory attribute generating means for generating an attribute corresponding to the accessed data word from the attribute memory in response;
Access attribute generating means for generating an attribute indicating the type of data access to the data memory, and whether execution of data access to the data memory is permitted by a combination of the memory attribute and the access attribute generated by these generating means. What is claimed is: 1. A memory protection device characterized by comprising: determination means for determining whether the (2) The memory protection device according to claim 1, wherein the attribute memory substitutes an unused bit of a parity bit storage memory provided for the data memory. (3) The memory protection device according to claim 1, further comprising means for forcibly generating a specific instruction code when the determining means determines that data access to the data memory cannot be executed.