JPS62251841A - Single chip microcomputer - Google Patents

Abstract

PURPOSE:To improve the security of the titled microcomputer system by providing the system with an execution permission specifying means with a test mode function, executing the prescribed data processing of software stored in a memory at the time of permission, and after the end of its test, turning the execution permission specifying means to an inhibition state. CONSTITUTION:A mask ROM 103-2 storing a user program or data is arranged in a mask ROM block 103 and a flag 105-5 for discriminating the permission/ inhibition of a test mode is arranged in a CPU control part 5. Receiving a test mode request signal from a request line 105-6, the control part 105 inputs an instruction code in a ROM 103-2 through a register 4 and sets up the leading address of a test mode processing routine in a ROM 105-3. When the flag 105-5 is not set up, data are fetched from the ROM 103-2 to a bus 2 and outputted to an execution part 101, and after executing the prescribed processing of the data, the flag 105-5 is set up.

Description

DETAILED DESCRIPTION OF THE INVENTION [Field of Industrial Application] The present invention relates to a single-chip microcomputer that integrates test mode functionality and computer functionality on a single semiconductor substrate.

[Conventional technology]

In recent years, advances in LSI manufacturing technology have led to higher integration in the field of single-chip microcomputers.
The functions integrated on a single semiconductor substrate are also becoming more sophisticated. Examples include an increase in the capacity of built-in memory and an improvement in data processing capacity.

Along with this, the software that controls single-chip microcomputers has gradually become more sophisticated, and software that combines the know-how of various companies is now built into the chip.However, recently, problems have arisen in which this software is stolen. ing.

For example, there are some cases that have become a major social problem, such as copying the programs of TV game machines and creating fake banknotes by exploiting the control software of banknote exchange machines.

Therefore, recently there has been a growing interest and demand for software security against such software theft.

In general, the M program copy function of a single-chip microcomputer is a function (hereinafter referred to as
This function can be easily performed using the test mode function.

The above function was originally added for checking programs and data stored in built-in memory, and is built into almost all single-chip microcomputers.

FIG. 3 shows a block diagram of a conventional single-chip microcomputer with a built-in test mode function, and the operation will be explained below based on the diagram. In FIG. 3, address bus 1 is a bus for transferring address data. The data bus 2 is a bus for transferring processing data of the central processing unit ft (hereinafter referred to as CPU). The built-in ROM block 3 is a memory block that stores a program counter, user programs, and data. Generally, ROM includes ROM with a fixed mask (hereinafter referred to as mask ROM) and read-only memory (hereinafter referred to as FR) in which data can be written.
There are two types of FROM: UVEFROM, which erases data in the memory using ultraviolet rays, and E2FROM, which allows data to be written and erased electrically. The instruction register 4 is a register that stores an instruction code read from the built-in ROM block 3. The CPU control unit 5 is a block that controls program operations specified by instruction codes stored in the instruction register 4.

The accumulator 6 is a register that plays a central role in data processing. Temporary register 7 is arithmetic logic unit 8
This is a register that temporarily holds input data to the .

The arithmetic and logic operation unit 8 performs designated arithmetic and logic operations on the database stored in the accumulator 6 and the tempo register 7, and outputs the result to the data bus 2.

RAM 9 is a memory that can be accessed and reloaded, and is used as a general-purpose register and for storing various processing data.
The stored data addressed by the address bus 1 is output to the data bus 2, or the data on the data bus 2 is stored at the address location of the internal RAM 9 which is accessed by the address bus 1. The boat 10 is an output boat that has a function of outputting data on the data bus 2 to the outside.

Next, the operation will be explained. In conventional single-chip microcomputers with a built-in test mode function, the built-in RO
The instruction code at the address specified by the program counter in the M block 3 is read from the built-in ROM block 3 and stored in the instruction register 4 via the data bus 2. The instruction code stored in the instruction register 4 is sent to the CPU control unit 5.
input to PLA (programmable logic array)
It is decoded by hardware such as , and the instruction function is executed. For example, in the case of a binary operation between the accumulator 6 and a general-purpose register, the contents of the general-purpose register are read from the eight M9s and stored in the temporary register 7. Next, the arithmetic and logic operation unit 8 is operated, and the operation result is sent to the destination 7! via the data bus 2. If the input is Achiemulator 8, write there, and if it is a general-purpose register, write to RA.
Write to general-purpose register in MQ. All the above operations are CP
This is performed using a control signal decoded by hardware such as a PLA in the U control unit 5.

Next, the operation of the conventional test mode function will be explained using FIG. Figure 4 shows the built-in R in Figure 3.
This figure shows the detailed configuration of the OM block 3. In FIG. 4, the program counter 31 is a built-in ROM (FR
This is an address pointer that points to the storage address of the instruction code stored in the OM (or mask ROM) 32. Built-in R
OM32 is a read-only memory used to store user programs and data, and the instruction code and data in the memory are output to the data bus 2. Note that when reading data, the program counter 31 is not used, but the bus 3 is read.
Directly address and read using the address value above 7. The test mode control unit 33 uses the test mode request line 3
This block operates when a signal is output to 6, and controls the operation of the test mode function. PROGRAM COUNTER RESET &134 is a signal line used to reset the program counter 31 when the test mode function is executed, and a signal is output from the test mode control section 33 to the program counter 31. Program counter increment 35
is an input line for incrementing the program counter 31 when the test mode function is executed, and the test mode control unit 33 outputs the υ signal to the program counter 31.

When a high voltage is applied to a specific external terminal of a conventional single-chip microcomputer, a signal is output to the test mode request line 36 and input to the test mode control section 33. The test mode control unit 33 immediately outputs a signal to the program power unreset HJI 34 after the IA power is applied,
The inside of the program counter 31 is cleared to Q. Then, the instruction code or data at the address specified by the program controller 31 is read out from the built-in ROM 32 and output onto the data bus 2, and further the data on the data bus 2 is output via the boat 10 to the outside.

Thereafter, the test mode control unit 33 outputs a signal to the program counter increment head 35, increments the program counter 31, and increments the program counter 31.
The instruction code or data in the built-in ROM 32 specified by 1 is outputted to the outside by the boat 10. Then, similarly, a signal is output to the program counter increment head 35, the program counter 31 is sequentially incremented, and the data in the built-in memory 32 is sequentially output to the outside via the data bus 2 and the boat 10.

In this manner, the test mode control unit 33 sequentially sends the contents of the built-in ROM 32 in which the user program and data are stored to the data bus 2, and outputs them to the outside via the boat 10.

Using the above means, the user applies a high voltage to a specific external terminal of the chip and executes the test mode function, thereby reading out the program and data in the built-in ROM 32 to the outside via the boat 10 and checking it. Can be done.

[Problem that the invention seeks to solve]

In a single-chip microcomputer with a built-in test mode function as described above, by using the test mode function, the built-in user program and data can be easily read externally, so that highly confidential programs and data can be easily read out. Even if the software is installed, a malicious third party can easily read it from the outside, and there is little or no protection for the built-in software.

[Failure to solve the problem]

The single-chip microcomputer of the present invention is a single-chip microcomputer that integrates computer functions and test mode functions on a single semiconductor substrate, and has a read-only memory for storing user notware and various instruction functions. and test mode +j! The microprogram that controls the IIF judgment and execution is stored in the microROM (N'J), the microaddress setting circuit that sets the start address of the processing routine stored in the OM, and the execution of the test mode function. When a test mode function execution request is made, permission for test mode function execution is determined based on a processing routine of a microprogram for test mode control, and in the case of test mode function execution, the above-mentioned processing is performed. A routine performs predetermined data processing on the software stored in the ROM, and after the test is completed, the means for specifying execution permission is set to a prohibited state, thereby prohibiting future execution of the test mode function. It is characterized by improved accuracy and safety.

〔Example〕

Next, an embodiment of a single-chip microcomputer according to the present invention will be described with reference to FIGS. 1 and 2.

FIG. 1 shows the structure of a first embodiment of a single-chip microcomputer according to the present invention. First, the constituent elements will be explained. In the first example, the mask ROM block 103 and the CPU control section 105 respectively correspond to the internal ROM block 3 and the CPU control section 5 in FIG. 3 of the conventional example. Also, accumulator 6 in FIG. The temporary register 7 and the arithmetic and logic operation unit 8 are collectively shown as an execution unit 101 in FIG.

Mask ROM block 103 and CPU control unit 10 in the single-chip micro combinator according to the present invention
Components other than 5 are the same as the conventional example shown in FIG.
Only the configuration of 05 will be explained.

Mask ROM block 103 is program counter 10
The program counter 103-1 is an address pointer pointing to an instruction code storage address in the mask ROM 103-2. The mask ROM 103-2 is a 7-dedicated memory used for storing user programs or data, and the instruction code in the memory is stored in the instruction register 4 via the data bus 2, and the processing corresponding to each instruction is It is executed by the CPU control unit 105. When reading data, the data in the mask ROM 103-2 is output to the data bus 2 by directly specifying the address using the address value on the bus 103-3. The CPU control unit 105 is a block that controls instruction execution and test mode function operation, and includes microaddress setting circuits 105-1. Micro program counter 105-2゜Micro program R
OM105-3. Decoder 105-4. Test mode permission flag 105-5. Test mode request line 10
It consists of 5-6.

When the micro address setting circuit 105-1 receives the test mode request signal via the test mode request line 105-6, it sets the test mode processing routine start address in the micro program counter 105-2. The microprogram counter 105-2 points to the address of the microinstruction in the microprogram ROM 105-3 in which the process corresponding to the instruction is stored, based on the instruction code taken into the instruction register 4, and has an incrementing function. ing. Micro program ROM10
A read-only memory 5-3 stores control information corresponding to each command, and outputs control signals to each section via a decoder 105-4. Also, this micro program ROM1
05-3 also includes a test mode processing routine that controls the operation of the test mode function and determines permission to execute the test mode function. Test mode permission flag 105-5 allows test mode.

This flag is used to determine prohibition, and writing and reading data to this flag is performed by a dedicated CPU instruction. Further, this flag is cleared in the initial state, and once set, it is a semi-fixed flag that cannot be erased.

Next, -C operation will be explained using the above-mentioned components.

In the single-chip microcomputer in the wooden 1 embodiment, the data at the address specified by the program counter 103-1 in the mask ROM block 103 is read from the mask ROM 103-2 and sent to the instruction register 4 via the data bus 2. Store. The instruction code stored in the instruction register 4 is output to the CPU control unit 105, and when no signal is output to the test mode request line 105-6, the instruction code is stored directly in the micro program counter 105-2 from the micro address setting circuit 105-IK. , gives an entry address in the microprogram ROM 105-3 that performs the process corresponding to each instruction.Then, the microprogram counter 105-2 is automatically incremented, and the entry address in the microprogram ROM 105-3 in which each instruction execution sequence is stored is given. The addresses are sequentially pointed to.Then, the signals outputted by the microprogram ROM 105-3 are encoded by the decoder 105-4, and control signals are sent to each section to execute command functions.

The above is the instruction execution form of the single-chip microcomputer of the first embodiment. Next, the execution of the test mode function in the first embodiment will be explained. When a high voltage is applied to a specific external terminal of this chip, a signal is output to the test mode request line 105-6 and input to the micro address setting circuit 105-1. The micro address setting circuit 105-1 is a micro program counter 105.
The start address of the test mode processing routine in the microprogram ROM 1os-3 is set to -2.

Thereafter, permission determination and execution of the test mode function are performed by the microprogram.

Now, in the test mode processing routine in the microprogram ROM 105-3, processing is performed in the following sequence.

■: Read the value of the test mode permission lag 105-5.

■: If the test mode permission flag 105-5 is set in ■, it is determined that the test mode function execution is prohibited, and this test mode processing routine enters an infinite loop without executing the test mode function.

■: If the test mode permission flag 105-5 is not set in ■, it is determined that the test mode function execution is permitted, and the program counter 103-1 in the mask ROM block 103 is reset.

■Data corresponding to the address specified by the nib program counter 103-1 is stored in the mask ROM2O3-2.
It is taken out from inside and output to data bus 2.

■: Output the data on the data bus 2 to the execution unit 101,
The execution unit 101 performs predetermined data processing such as adding parity bits and encryption, and outputs the processed data onto the data bus 2 again.

■: Data on data bus 2 is passed through port 10,
Output to outside.

■Mask ROM including value of Niprogram counter 103-1
The final address value of 103-2 is compared, and if they match, this test mode processing routine enters an infinite loop.

If they do not match, move to the next step.

(2) Increment the nib program counter 103-1.

■: Move to the processing step.

The above is the test mode function permission determination and test mode function execution form using the microprogram.

In the above embodiment, the microprogram counter 105-2 controls the microprogram ROM 105.
-3 is specified, however, a method of specifying the address using a specific field within the microinstruction may also be used.

The conventional test mode function was built in by the manufacturer for the purpose of testing the operation during the manufacture of single-chip microcontrollers.Using the above function allows you to easily read the built-in programs and data, and is a software protection measure. was not done at all. However, in the first embodiment of the present invention, a test mode permission flag 105-5 is built in, and by using a microprogram, a high degree of built-in software protection is easily realized.

The test mode permission flag 105-5 is set to
Investing only by special order of U: 4! This is a semi-fixed flag that can be set, but cannot be erased if -&cent is entered. Therefore, during the development and debugging of the software in the mask ROM 103-2, the manufacturer does not set the above flag and allows the built-in software to be read by the test mode function. Then, when the product is shipped to the market after debugging of the built-in software is completed, the test mode permission flag 105-5 is set to prohibit further execution of the test mode function, thereby making it impossible to read out the built-in programs and data. . With the above means, protection for built-in software can be realized while the test mode function is built-in.

Furthermore, in the wooden version 1 embodiment, since the determination of the test mode permission flag and the execution of the test mode function are realized by a microprogram, a parity pit is added to the built-in program.

By performing data processing such as encryption, it is easy to improve the reliability and security of data. Furthermore, it is extremely difficult to decipher the above processing sequence, and compared to execution using a macro program, it is more difficult for built-in software to perform data processing. A high degree of protection is possible.

Also, the test mode permission flag 105-5 is set to C.
Since it is executed using a dedicated instruction of the PU, it is absolutely impossible to change the flag value by external operation, and the above means is extremely safe.

Next, a second embodiment of a single-chip microcomputer according to the present invention 1/C will be described with reference to FIG. First, the constituent elements will be explained. FROM7' in Figure 2
The lock 203 corresponds to the mask ROM block 103 Vc in FIG.
OM203-2 corresponds to mask ROM103-2 in FIG. Also, in response to the test mode permission flag 105-5 in the CPυ control unit 105 in FIG.
In the figure, the test mode permission parameter 203-3 is FR
It is assigned to a specific address within OM2O3-2, and the test mode permission flag 105-5 does not exist in the 8g2 embodiment. Components other than the above are MX
It is exactly the same as Figure 1. Therefore, the following is FROM block 2
Only the configuration of 03 will be explained.

PROM block 203 is the program counter 203
-1 and FROM 203-2, and program counter 203-1 is an address counter pointing to the instruction code storage address of FROM 203-2. FROM2
03-2 is a programmable read-only memory used for storing user programs or data, and the instruction codes in the memory are stored in the instruction register 4 via the data bus 2, and the processing corresponding to each instruction is executed by the CPU? t+
This is executed by the 1ll1 unit 105. When reading data, the data in FROM 203-2 is output to data bus 2 by directly specifying the address using the address value on path 203-4. Test mode permission parameter 20
3-3 is a parameter used to determine whether the test mode is permitted or prohibited, and is assigned to the contents of a specific address in FROM 203-2. Writing and reading of data to the above parameters is performed by dedicated instructions from the CPU.

Next, the operation will be explained using Figure @2.

The operation of the single-chip microcombinator in the second implementation mode is similar to that in the first embodiment, and the command functions are executed by the microprogram.

Also, the above configuration 4! The basic test mode function execution form is almost the same as the execution form layer in the first embodiment.

That is, when a high voltage is applied to a specific external terminal of this chip, a signal is output to the test mode request line 105-6 and input to the micro address setting circuit 105-1.

The micro address setting circuit 105-1 then sends the micro program R to the micro program counter 105-2.
Set the start address of the test mode processing routine in OM105-3. Thereafter, permission determination and execution of the test mode function are performed by the microprogram.

The microprogram checks the content of the test mode permission parameter 203-3, and if it is sQs, executes the test mode function. However, the test mode permission parameter 203-3 takes a value of % Q I/ in the initial state. If the test mode function is above the 1st'! A
As in the case of the preferred example, data other than % Q I/ is written in the test mode permission parameter 203-3 by a dedicated instruction of the CPU, and reading of the program and data in the FROM 203-2 is prohibited thereafter.

In the second embodiment, it is possible to erase and rewrite the value of the test mode permission parameter 203-3, but if FROM 203-2 is a UVBPROM, the data in the test mode permission parameter 203-3 can be erased with ultraviolet light. There is no problem because other programs and data will also be erased by erasing. In addition, in the case of F'' FROM 203-2, this can be handled by prohibiting the writing of data to the test mode permission parameter 203-3 using the built-in program. Data protection has been realized, and the security of the built-in software has been improved.Additionally, the text mode permission bar 2 meter 203-2 can only be activated by commands from the CPU.
Since the value of 3 can be manipulated, it is impossible to change it from the outside, so the above processing sequence is highly secure.

〔Effect of the invention〕

As explained above, in the single-chip 7" microcomputer using the pressure body of the present invention, unlike the conventional single-chip microcomputer with a built-in test mode function, the test mode By setting the test mode permission parameter (in case the built-in program area is FROM) in the built-in memory (for mask ROM), these values are determined by the microprogram and the test mode permission stops at 1M. Therefore, if you set the test mode permission flag at the time of product shipment or write data other than %Q to the test mode permission parameter to disable the test mode function, the internal memory program and Data cannot be read outside the chip, which has a great effect on built-in software and data protection.

Furthermore, in the single-chip microcomputer according to the present invention, as described above, the microprogram
Since the test mode permission flag or test mode permission parameter is checked and the operation of the test mode function is controlled, it is extremely difficult to decipher the above processing sequence, and the built-in programs and data are subject to extremely high security. Effects can be obtained.

[Brief explanation of drawings]

FIG. 1 is a block diagram of a first embodiment of a single-chip microcomputer according to the present invention, and FIG. 2 is a block diagram of a second embodiment of a single-chip microcomputer according to the present invention.
FIG. 3 is a block diagram of a single-chip microcomputer with a built-in conventional test mode function, and FIG. 4 is a block diagram of the built-in ROM in FIG. 3.
FIG. 3 is a configuration diagram of block 3. 1... Address bus 2... Data bus 3... Inner jl [ROM block 4...
Instruction register 5... CPU control unit 6... Accumulator 7... Temporary register 8... Arithmetic logic unit 9... RAM 10. ...Boat 31 ...Program counter 32 ...Built-in ROM 33 ...Test mode control section 34 ...Program counter reset line 35
...Program counter increment line 36.
...Test mode request line 37...Bus 101...Execution unit 103...Mask ROM block 103-1...Program counter 103-2
...Mask ROM 103-3 ... Bus 105 ... CPU control section 105-1 ... Micro address setting circuit 10
5-2...Micro program counter 105
-3...Micro ROM105-4...
・Decoder 105-5 “°°°°° test mode permission flag 105
-6...Test mode request line 203...
・PROM block 203-1...Program counter 203-2
......FROM 203-3...Test mode permission parameter 2
03-4...Bus agent Patent attorney Susumu Uchihara ゛Kan l IM Mere Figure 1 J Figure C Conventional example)' Kaya 4n (iAro unpublished column

Claims (1)

[Claims] A single-chip microcomputer that integrates computer functions and test mode functions on a single semiconductor substrate includes a memory for storing user software, a microprogram memory for executing instruction functions, and a processing routine stored in the microprogram memory. It has an address setting circuit for setting a start address, and a means for specifying execution permission of a test mode function, and executes a test mode processing routine in the microprogram memory when a test mode function execution request is made, and specifies permission for test mode function execution. In this case, the software stored in the memory is tested by performing predetermined data processing,
A single-chip microcomputer characterized in that the means for specifying execution permission is set to a prohibited state after a test is completed.