WO2005121979A1

WO2005121979A1 - Access control device and access control method

Info

Publication number: WO2005121979A1
Application number: PCT/JP2005/009512
Authority: WO
Inventors: Masaaki Harada; Hideyuki Kanzaki; Tomohiko Kitamura
Original assignee: Matsushita Electric Industrial Co., Ltd.
Priority date: 2004-06-14
Filing date: 2005-05-25
Publication date: 2005-12-22
Also published as: JP2007264679A

Abstract

It is possible to improve security in a multi-processor system while reducing the cost. There is provided an access control device judging whether access is enabled to at least one shared bus slave shared by a plurality of bus maters from the bus masters. The access control device includes: an access enabled/disabled information storage unit for storing access enabled/disabled information inhibiting access to a predetermined area of the shared bus slave from the bus masters; and an access enabled/disabled judgment unit used when a bus master makes a request to access a desired area of the shared bus slave, for judging whether the bus master can access the area of the shared bus slave of the access request destination according to the access enabled/disabled information in the access enabled/disabled information storage unit.

Description

Specification

Access control device and access control method

Technical field

The present invention relates to an access control device that controls access between a bus master and a shared bus slave. Background art

[0002] At present, with the progress of high functionality and high integration of LSI (Large Scale Integrated circuit), a multiprocessor system including a plurality of processors is becoming popular. In the field of digital AV home appliances, a unified memory configuration that shares information resources such as main storage is indispensable due to low cost. For this reason, when a secret program of a certain processor is stored in the shared memory, security deterioration such as tampering or stealing of the secret program by another processor has become a problem.

[0003] Patent Document 1 discloses a multiprocessor system in which each processor has an access restriction mechanism as a mechanism for restricting access to a shared memory. The access restriction mechanism in each processor restricts access by executing software programs that prevent the generation of addresses. Patent Document 2 discloses a method in which a dedicated memory is provided for each processor so that only the specific processor can access the dedicated memory of the specific processor.

Patent Document 1: Patent No. 2661733

Patent Document 2: JP-A-6-96235

Disclosure of the invention

However, in the multiprocessor system of Patent Document 1, an address generation protection device is provided for each central processing unit as an access restriction mechanism. Then, access control to the shared memory of the corresponding processor is performed by software processing for each address generation protection device. Also, there is no restriction on rewriting of software for restricting access. Therefore, for example, the sequence of a program that executes access restrictions or the specifications of hardware are exploited, and if the program is tampered with, unauthorized access to the access-restricted area of another processor can be made. Like this. As a result, there is a risk that confidential data and programs are falsified or stolen, which poses a security problem. Also, in the method of providing a dedicated memory dedicated to each processor in Patent Document 2, it is necessary to separately provide a dedicated RAM (Random Access Memory) or a dedicated ROM (Read Only Memory) as a dedicated memory, which increases the cost of a multiprocessor system. . In particular, the method of incorporating a dedicated memory in an LSI lacks flexibility because the capacity of the dedicated memory to be used must be fixed at the LSI design stage. In addition, in the method of externally connecting dedicated memory to a system LSI equipped with a multiprocessor, the number of external terminals of the LSI increases due to the connection between the external dedicated memory and the LSI, resulting in an increase in LSI cost. .

Therefore, an object of the present invention is to improve security in a multiprocessor system while reducing cost increase.

[0006] The first invention of the present application is an access control device that performs access control on access to at least one shared bus slave that is shared by a plurality of bus masters in order to solve the above problem. And the following components.

'An access permission / non-permission information storage unit which stores access permission / prohibition information for prohibiting the shared bus slave from accessing a predetermined area.

• When an access request is made to a desired area of the shared bus slave, the bus master moves the bus master to an area of the shared bus slave to which the access request is made based on the access permission information of the access permission information storage unit. An access permission / non-permission determining unit that determines whether or not access is possible.

[0007] When an access request is made from the nosmaster to a desired area of the shared bus slave, the access permission / inhibition determination section determines access permission / inhibition based on the access permission / inhibition information. Here, the shared bus slave means a shared resource such as a general-purpose memory and various control registers shared by a plurality of nosmasters. If access is prohibited by the access permission / inhibition judgment unit, the no-smaster cannot access the area requested by the shared bus slave. Therefore, only the bus master permitted by the access permission / non-permission determining unit can access the predetermined area of the shared bus slave, so that a dedicated area for a specific bus master can be secured on the shared bus slave. Therefore, unauthorized access by a bus master other than the specific bus master can be prohibited, and security can be improved. For example, program tampering or malfunction Accordingly, even when a bus master other than the specific bus master attempts to access the dedicated area of the specific bus master, the access can be prohibited by the access permission / inhibition determination unit.

Further, since the bus masters share the shared bus slaves, it is not necessary to separately provide a dedicated bus slave for each specific bus master. Therefore, it is possible to reduce the cost of providing a bus wiring and a terminal for connecting a separate bus slave and a bus master.

[0009] The second invention of the present application is the bus master identification unit according to the first invention of the present application, which identifies a bus master that has made the access request based on an access request from the bus master to a desired area of the shared bus slave. The access control device further comprises: an access control unit that performs the determination based on the access control information of the bus master identified by the bus master identification unit.

[0010] The bus master identification unit identifies whether an access request is made by any of the bus masters, and outputs the access request to the access availability determination unit. When an access request is made from a plurality of bus masters, the bus master identification unit may select whether to accept an access request from a shifted bus master. For example, an access request from a high-priority bus master is accepted.

[0011] In a third invention of the present application, in the first invention of the present application, the access permission / prohibition information is a prohibition address designating an access prohibition area or a permission address designating an access permission area in the shared bus slave for each path master. The access permission / inhibition judging unit is characterized in that the bus master judges whether or not the bus master can access the area of the shared bus slave to which the access request is made, based on a prohibition address or a permission address corresponding to the bus master. An access control device is provided.

[0012] The access permission / non-permission information storage unit stores, for each bus master, a prohibited address of an area in the shared bus slave where access is prohibited or a permitted address of an area where access is permitted. The prohibited address or permitted address is compared with the address of the area of the shared bus slave to which the bus master has issued the access request. If the address of the access request destination is a prohibited address, the access by the bus master can be prohibited. On the other hand, if the address of the access request destination is a permitted address, access by the nosmaster can be permitted. [0013] In a fourth invention of the present application, in the third invention of the present application, the prohibited address is a write access prohibited area for a shared bus slave for each bus master, or a read access prohibited area or a shared bus slave for the shared bus slave power. The permission address specifies a read access permission area to the shared bus slave, a read access permission area from the shared bus slave, or a total access permission area to the shared bus slave. An access control device characterized in that it is an address to be accessed.

[0014] It is possible to increase the degree of freedom such as permitting only reading of data from the shared bus slave or permitting only writing for each bus master.

[0015] In a fifth aspect of the present invention, based on the first aspect of the invention, the access permission / inhibition information is stored for each operation state of each bus master, and the access permission / inhibition determination unit operates in the operation state of the bus master that has issued the access request. On the basis of the operation state and the access permission / non-permission information for each operation state of the bus master, based on whether the bus master that has made the access request can access the area of the shared bus slave to which the access request is made or not. The present invention provides an access control device characterized by determining

[0016] It is determined whether or not the bus master can access the access request destination area according to the operation state of each bus master. Therefore, it is possible to secure a dedicated area on the shared bus slave that can be accessed only when a specific bus master is in a specific operation state. In addition, security is further improved by determining whether access is possible according to the operation state of the bus master.

[0017] In a sixth aspect of the present invention, in the first aspect of the invention, the shared bus slave is various control registers, and the access availability information is information for inhibiting access to the various control registers. When the bus master issues an access request to a desired area of the various control registers, the access permission / inhibition determination unit is configured to perform the access request based on the access permission / inhibition information for the various control registers. The present invention provides an access control device for determining whether or not an access request destination is capable of accessing various control register areas.

[0018] An access request is made from the bus master to a desired area of the shared control registers. In this case, the access permission / inhibition determination unit determines access permission / inhibition based on the access permission / inhibition information. Therefore, only the bus master permitted by the access permission / inhibition judging section can access the areas of the shared various control registers. For example, it is possible to prevent a bus master other than a specific bus master from illegally accessing various control registers and rewriting various control information.

[0019] In a seventh invention of the present application, in the sixth invention of the present application, the various control registers are DMA control registers for storing DMA (Direct Memory Access) control information, and the access availability information is stored in the DMA control registers. When the access request is made to a desired area of the DMA control register, the access permission / inhibition determination unit, based on the access permission / inhibition information to the DMA control register, There is provided an access control device characterized in that a bus master that has made an access request determines whether or not the area of the DMA control register of the access request destination is accessible.

[0020] A DMA that can be activated only by a specific bus master, for example, a DMA that decrypts encrypted data and transfers it to the local memory inside the LSI, and a bus master other than the specific bus master specifies the transfer destination to the LSI external memory and activates the DMA However, it is possible to prevent illegal DMA activation, such as stealing decrypted plaintext data outside the LSI.

The eighth invention of the present application is the invention according to the first invention of the present application, wherein the data output to the shared bus slave is encrypted on the data bus between the bus master and the shared bus slave, Shared bus slave capability An access control device further comprising a bus encryption unit for decrypting data output to the bus master.

By providing the bus encryption unit on the data bus between the bus master and the shared bus slave, analysis by monitoring the data bus can be prevented. Therefore, security can be further improved.

The ninth invention of the present application is the first invention of the present application, further comprising a program authentication unit that authenticates a program executed by the bus master that has made the access request, wherein the access permission / inhibition determination unit includes: Based on the authentication result and the access availability information in the access availability information storage unit, the bus master that has made the access request determines whether or not it is possible to access the shared bus slave area of the access request destination. You An access control device is provided.

[0024] In a ninth invention of the present application, in the ninth invention of the present application, the bus master has a dedicated instruction for accessing the access permission information stored in the access permission information storage unit, and the bus master executes the dedicated instruction when the dedicated instruction is executed. An access request for decoding the instruction and accessing the access permission / inhibition information is issued. The access permission / inhibition determination unit receives the access request based on the dedicated instruction and receives the access request based on the program authentication unit. An access control device is provided, which determines whether to execute the access request.

By performing program authentication and determining whether access to the access permission information is possible, it is possible to prevent unauthorized rewriting of the access permission information, and to prevent access such as reading and rewriting of the access permission information. The degree of freedom can be increased.

[0026] In an eleventh invention of the present application, in the first invention of the present application, the bus master has a dedicated instruction for accessing the access permission information stored in the access permission information storage unit, and the bus master executes the dedicated instruction when the dedicated instruction is executed. An access control device for decoding an instruction and issuing an access request for accessing the access availability information is provided.

[0027] By having a dedicated instruction for accessing the access permission / inhibition information, the degree of freedom such as reading out or rewriting the access permission / inhibition information can be increased.

[0028] In a twelfth invention of the present application, in the first invention of the present application, the access permission / non-permission information storage unit is a register to which a specific address is assigned, and the bus master accesses the specific address so that the access is performed. An access control device characterized in that access to access permission information stored in a permission information storage unit is enabled.

[0029] In a thirteenth invention of the present application, in the eleventh or twelfth invention of the present application, the access permission / non-permission information includes restriction information on whether or not the user has permission to access the access permission / prohibition information. And an access control device for determining whether or not the access permission / inhibition information is accessible based on the restriction information.

[0030] By determining whether or not to access the access permission information, it is possible to increase the degree of freedom of access to the access permission information while restricting unauthorized access from a bus master that is not permitted to access, thereby improving security. . For example, access to access Even when the access permission / non-permission information is rewritten by the access, the degree of freedom such as changing the access permitted area by rewriting can be increased while securing the security at the time of rewriting.

[0031] In a fourteenth aspect of the present invention, in the first aspect of the invention, the access permission / inhibition determination unit determines that the bus master that has made the access request cannot access the area of the shared bus slave to which the access request is made. In this case, the access control device further includes a dummy response unit that performs a dummy response to the bus master that has made the access request.

Here, the dummy response means a dummy response that causes the bus master to erroneously recognize that the response is a response obtained from the actual access request destination. For example, when a bus master performs a write operation in an access prohibited area of a shared bus slave, a dummy response such as completion of reception of an access request and completion of data writing is performed without performing a write operation as requested. When performing a read operation to the access prohibited area, a dummy response such as completion of acceptance of an access request is performed without performing the read operation as requested. Therefore, it is difficult to distinguish between the access prohibited area and the access permitted area on the shared bus slave, and analysis for accessing the access prohibited area can be prevented.

[0033] In a fifteenth invention of the present application, in the first invention of the present application, the access permission / inhibition determination unit determines that the bus master that has made the access request cannot access the area of the shared bus slave to which the access request is made. In such a case, the access control apparatus further includes a dummy access unit that performs a dummy access to the shared bus slave of the access request destination.

[0034] Here, the dummy access means a dummy access that causes a bus observer to mistakenly determine that an access has been made to an actual access request destination. Even if it is determined that the nosmaster cannot access the shared bus slave area, some dummy access is performed to the shared bus slave. This dummy access can prevent analysis by monitoring the data bus between the bus master and the shared bus slave. For example, the analysis of the data bus for distinguishing between the access prohibited area and the access permitted area on the shared bus slave can be prevented. As a dummy access, in the case of a write operation, for example, an access destination Access is performed by writing while masking the data in the area, or issuing a read command instead of a write command. In the case of a read operation, for example, an access such as issuing a read command to an area to which access is permitted is performed.

[0035] A sixteenth invention of the present application includes a plurality of bus masters, and an access control device that performs access control on access to at least one shared bus slave whose power is also shared by the plurality of bus masters, The access control device includes: an access permission / non-permission information storage unit that stores access permission / prohibition information for prohibiting access from the bus master to the shared bus slave; and an access request from the bus master to a desired area of the shared bus slave. The access permission / inhibition determination unit determines whether the bus master can access the area of the shared bus slave of the access request destination based on the access permission information in the access permission information storage unit. A system LSI characterized by having

With the above configuration, it is possible to obtain a system LSI having the same functions and effects as the first invention of the present application.

A seventeenth invention of the present application provides the system LSI of the sixteenth invention of the present application, further comprising another bus slave accessible to the plurality of bus masters. The number of masters is not limited to one, and a plurality of masters can be provided.

[0038] The eighteenth invention of the present application is a DMA control device that performs access control on access to at least one shared bus slave in which a plurality of bus masters are also shared by the plurality of bus masters. A) a DMA controller for performing control; and a memory scheduler for controlling access to the shared bus slave, wherein the memory scheduler includes the access control device according to the first aspect of the present invention. Provide equipment.

As described above, the memory scheduler has the access control device of the first invention of the present application. Thus, when accessing a shared bus slave via the bus master S memory scheduler, only the bus master permitted by the access permission / non-permission determining unit can access a predetermined area of the shared bus slave. Therefore, similarly to the first invention of the present application, a dedicated area for a specific bus master is secured on the shared bus slave, and illegal operations by bus masters other than the specific bus master are performed. Access can be prohibited and security can be improved.

Further, since the bus masters share the shared bus slaves! /, It is not necessary to separately provide a dedicated bus slave for each specific bus master. Therefore, it is possible to reduce the cost of providing a bus wiring and a terminal for connecting a separate bus slave and a bus master.

The nineteenth invention of the present application is a DMA control device that performs access control on access to at least one shared bus slave in which a plurality of bus masters are shared by the plurality of bus masters. A) a DMA controller for controlling the access, and a memory scheduler for controlling access to the shared bus slave, wherein the DMA controller has the access control device according to the first aspect of the invention. Provide equipment.

A DMA controller that performs direct memory transfer has the access control device of the first invention of the present application. Thus, when the bus master accesses the shared bus slave via the DMA controller, only the nosmaster permitted by the access permission / non-permission judgment unit can access a predetermined area of the shared bus slave. Therefore, the same effect as the first invention of the present application can be obtained.

[0043] The twentieth invention of the present application is a DMA control device that performs access control on access to at least one shared bus slave in which a plurality of bus masters are shared by the plurality of bus masters. A memory controller for controlling access to the shared bus slave, the memory scheduler including the access control device according to claim 1, and the DMA controller including the DMA controller for controlling access to the shared bus slave. (1) To provide a DMA control device having the access control device according to the invention.

[0044] The bus master can access the shared bus slave via a memory scheduler or a DMA controller. Therefore, since each of the memory scheduler and the DMA controller has the access control device, the access to the shared bus slave can be restricted.

[0045] The twentieth invention of the present application is directed to an access control for performing access control on access to at least one shared bus slave in which a plurality of bus masters are also shared by the plurality of bus masters. A method for storing access permission / prohibition information for inhibiting access to the shared bus slave from the bus master, and when an access request to a desired area of the shared bus slave is made from the bus master, Determining whether the bus master can access the area of the shared bus slave to which the access request is made, based on the access permission information of the access permission information storage unit. Provide a method.

By using the access control device of the present invention, unauthorized access to the shared bus slave by a bus master other than a specific bus master can be prohibited, and security can be improved.

Brief Description of Drawings

FIG. 1 is a configuration diagram of a multiprocessor system according to a first embodiment.

FIG. 2 is an example of access permission information stored in DB33.

FIG. 3 is an example of a flowchart showing an example of access control processing.

FIG. 4 is a configuration diagram of a multiprocessor system according to a second embodiment.

FIG. 5 is an example of access permission / prohibition information corresponding to an operation state stored in DB33.

FIG. 6 is a configuration diagram of a multiprocessor system according to a third embodiment.

[FIG. 7] Access permission information An example of rewrite command permission information in DB33.

FIG. 8 is a configuration diagram of a multiprocessor system according to a fourth embodiment.

FIG. 9 is a configuration diagram of a multiprocessor system according to a fifth embodiment.

FIG. 10 is a configuration diagram of a multiprocessor system according to a sixth embodiment.

FIG. 11 is a configuration diagram of a multiprocessor system according to a seventh embodiment.

FIG. 12 is another configuration diagram of the multiprocessor system according to the seventh embodiment.

FIG. 13 is a configuration diagram of a multiprocessor system according to an eighth embodiment.

FIG. 14 is another configuration diagram of the multiprocessor system according to the eighth embodiment.

FIG. 15 is a configuration diagram of a multiprocessor system according to a ninth embodiment.

FIG. 16 is a configuration diagram (1) of a multiprocessor system according to a tenth embodiment.

FIG. 17 is a configuration diagram (2) of a multiprocessor system according to a tenth embodiment. FIG. 18 is a configuration diagram (3) of a multiprocessor system according to a tenth embodiment.

FIG. 19 is a configuration diagram (4) of a multiprocessor system according to a tenth embodiment.

BEST MODE FOR CARRYING OUT THE INVENTION

The multiprocessor system having the access control unit of the present invention shares resources such as processor memories. The shared memory of the multiprocessor system is configured by a dedicated processor dedicated area, which area is divided and assigned to each processor, and a shared area shared by the multiprocessors. A plurality of processors constituting the multiprocessor system are connected to an access control unit for restricting access to the shared memory. When an access request is made from a processor to a desired area of the shared memory, the access control unit prohibits accesses other than the area allocated to the processor. Therefore, unauthorized access by processors other than the specific processor can be prohibited, and security can be improved.

FIG. 1 is a configuration diagram of a multiprocessor system according to a first embodiment of the present invention.

[0050] (1) Configuration

A multiprocessor system 1000 having an access control unit according to the first embodiment includes a multiprocessor 100, a bus master identification unit 200, an access control unit 300, an IF (lnterFace) unit 400, and a shared bus slave 500. The multiprocessor 100 has a first bus master 10a, a second bus master 10b, and a third bus master 10c, which are processors. The first bus master 10a, the second bus master 10b, the third bus master 10c,... Share the shared bus slave 500 as a shared resource such as a memory. The nosmaster identification unit 200 is connected to the first bus master 10a, the second bus master 10b, the third bus master 10c,..., And receives an access request from each nosmaster 10. The identification result and the access request in the bus master identification unit 200 are input to the access control unit 300, and are input to the shared bus slave 500 via the IF unit 400. Then, the access result from the shared bus slave 500 is output to each bus master 10 via the IF unit 400. Hereinafter, the shared bus slave 500, the bus master identification unit 200, the access control unit 300, and the IF unit 400 will be described.

[0052] (1 1) Shared bus slave

The shared bus slave 500 is a general-purpose memory or the like, and is shared by the first bus master 10a, the second bus master 10b, the third bus master 10c,. The shared bus slave 500 is divided, and as shown in FIG. 1, a first bus master dedicated area 50a, a second bus master dedicated area 50b, a third bus master dedicated area 50c, and so on are assigned to each bus master. The shared area 51 to be shared is allocated.

[0053] (1-2) Bus master identification unit

Upon receiving an access request from the bus master 10 to the shared bus slave 500, the bus master identification unit 200 identifies which bus master 10 is the access request. Then, it outputs the access request and the identification result to access control section 300. When an access request is made from a plurality of bus masters 10, for example, it is determined which access request from which bus master 10 has priority according to the priority. As a method of identifying a bus master, in the present embodiment, since a plurality of no-access input ports correspond one-to-one with a specific bus master, the bus master is identified by detecting which input port accesses the bus. There is a way to do it. The access request is made by a signal such as an address for accessing a desired area in the shared bus slave 500 and write data.

[0054] (1-3) Access control unit

The access control section 300 includes an access permission / non-permission determining section 31 and an access permission / non-permission information DB33. Access permission information DB33 stores access permission information for each nosmaster 10. The access permission / prohibition information is information that prohibits the shared bus slave 500 from accessing a predetermined area for each bus master 10. FIG. 2 shows an example of the access permission information stored in the access permission information DB 33. In FIG. 2, the access prohibited area in the shared bus slave 500 is designated for each bus master 10 by the access prohibited area start address and the access prohibited area end address. If the access prohibited area start address and the access prohibited area end address are the same address, the access prohibited area exists. Shall not. Based on the access permission / non-permission information shown in FIG. 2, only the first bus master 10a can access the 64 KB space of the address 0x8000—0000 to 8000—FFFF in the shared bus slave 500. Here, the access prohibited area is an area that prohibits only write access to the shared bus slave 500, an area that prohibits only read access from the shared bus slave 500, or prohibits both write and read access. Or an area where all access is prohibited. By doing so, it is possible to increase the degree of freedom such as permitting only reading of data from the shared bus slave or permitting only writing for each nosmaster.

The access permission / non-permission determining section 31 determines access permission / rejection by comparing the access request / identification result input from the bus master identification section 200 with the access permission / prohibition information in the access permission / prohibition information DB 33. For example, it is assumed that the second bus master 10b is identified by the bus master identification unit 200, and an access request to the address 0x8000-0000 in the shared bus slave 500 is input from the second bus master 10b to the access availability determination unit 31. The access permission / inhibition determination unit 31 refers to the access permission / inhibition information DB 33 and prohibits the second bus master 10b from accessing the address 0x8000 — 0000 to 8000 — FFFF! 2 Access to address 0x8000—0000 of bus master 10b is prohibited. On the other hand, when the second bus master 10b issues an access request to an address other than 0x8000—0000 to 8000—FFFF, the access permission / non-permission determination unit 31 permits the second bus master 10b to access the shared bus slave 500. I do. The access permission / non-permission judgment unit 31 outputs the result of the judgment to the IF unit 400.

Here, it is preferable that the connection between the bus master identification unit 200 and the access control unit 300 has a hard-wired configuration, since the identification result can be prevented from being falsified.

[0057] In the above description, the access permission / prohibition information may be an access permission address that specifies an access permission area for permitting the shared bus slave 500 to access a predetermined area in each power bus master 10, which is information on an access prohibition area. . Here, the access permitted area where access is permitted is an area that permits only write access to the shared bus slave 500, an area that permits only read access from the shared bus slave 500, or both an area that permits writing and reading. May be prohibited, or all access may be prohibited. When an access request to the access permitted area is made, The access to the shared bus slave from the bus master that has made the bus request is permitted. On the other hand, when an access request is made to an area other than the access permitted area, access to the shared bus slave 500 from the bus master making the access request is prohibited.

The access request by the bus master 10 may be made by the bus master 10 designating a specific address allocated to the access permission / non-permission information DB 33. At this time, the access permission information DB33 is, for example, a register to which a specific address is assigned.

(1 4) IF section

IF section 400 receives the access request and the determination result from access permission / inhibition determination section 31. The IF unit 400 generates a command for accessing the shared bus slave 500 based on the access request and the determination result. For example, when the shared bus slave 500 is a DRAM (Dynamic Random Access Memory), commands such as a RAS (Row Address Strobe signal) and a CAS (Column Address Strobe signal) for controlling the DRAM are generated. If the bus master 10 is permitted to access the area of the access request destination in the shared bus slave 500, the IF unit 400 accesses the area to which the access request was made based on the generated command. In addition, data reading and data writing are executed. When the data has been read, the IF unit 400 outputs the read data to the bus master 10 that has made the access request.

[0060] On the other hand, if the access is prohibited by the access permission / non-permission determining unit 31, the IF unit 400 may notify the bus master 10 that has made the access request that the access to the access request destination area is prohibited. good.

[0061] It is preferable that the IF unit 400 further includes a dummy response unit 41 for performing a dummy response and a dummy access unit 42 for performing a dummy access. Here, the dummy response is to make the bus master 10 erroneously recognize that the dummy request is a response that also has the actual access request destination when it is determined that the bus master 10 cannot access the area of the shared bus slave 500 of the access request destination. Means a dummy response to be made. The dummy response unit 41 returns a dummy response to the bus master 10 when the access permission determination unit 31 determines that the access request from the bus master 10 is an access request to the access prohibited area. For example, when a write operation is requested from the bus master 10 to the access prohibited area of the shared bus slave 500, the dummy response unit 41 Create a dummy response such as completion of reception of an access request and completion of data writing. Then, the created dummy response is sent to the bus master 10 without performing the write operation as requested. Further, the dummy access unit 42 may access a dummy area in the shared bus slave 500 that is not related to the area to which the access request is made, and perform the write operation. On the other hand, when a read operation request is issued from the nosmaster 10 to the access prohibited area, the read operation is not performed as requested, and the dummy response unit 41 completes the reception of the access request and performs dummy operations such as predetermined read data. Create a response and make a dummy response. Further, the dummy access unit 42 may access a dummy area irrelevant to the access request destination area and perform the read operation. Therefore, it is difficult to distinguish between the access prohibited area and the access permitted area on the shared bus slave 500, and it is possible to prevent analysis for accessing the access prohibited area. It is preferable to output random data or fixed values to the bus master, because the analysis becomes more difficult.

[0062] Dummy access means that when it is determined that the bus master 10 cannot access the area of the shared bus slave 500 of the access request destination, the access to the actual access request destination is shared with the IF unit 400. This means a dummy access performed to observe a signal between the bus slave 500 and a person who tries to steal information illegally. Even if it is determined that the nosmaster 10 cannot access the area of the shared bus slave 500, some dummy access is performed to the shared bus slave 500. Therefore, analysis by monitoring data noise between the bus master 10 and the shared bus slave 500 can be prevented. For example, by tracing the data bus, it is possible to prevent the access prohibited area and the access permitted area on the shared bus slave 500 from being distinguished from each other. As a dummy access, in the case of a write operation to an access prohibited area, access is permitted, for example, writing while masking data in the area of the access request destination, issuing a read command instead of a write command. Perform dummy access such as writing to an area that is not affected by writing. In the case of a read operation to an access prohibited area, an access such as issuing a read command to an area to which access is permitted is performed.

(2) Access control processing from bus master to bus slave

Next, the bus master 10 in the multiprocessor 100 accesses the shared bus slave 500. An access control process when a request is made will be described. FIG. 3 is an example of a flowchart showing an example of the access control process.

Step S 10: The bus master identification unit 200 receives an access request from the bus master 10 to a desired area of the shared bus slave 500.

Step S11: The bus master identification unit 200 identifies which bus master 10 is the access request based on the received access request.

Step S12: As a result of the identification in step S11, the bus master identification section 200 determines whether or not an access request is made from a plurality of bus masters 10! If there is an access request from a plurality of bus masters 10, in step 13, the bus master 10 that is given the right to access the shared bus slave is selected. On the other hand, in the case of an access request from one bus master 10, the access request and the identification result are output to the access permission / non-permission determining unit 31.

Step S13: The bus master identifying section 200 selects a bus master according to the priority of receiving the access request. The access request and identification result of the selected bus master 10 are output to the access permission / non-permission judgment unit 31.

Step S 14: The access permission / inhibition judging section 31 collates the access request and identification result from the bus master identification section 200 with the access permission information in the access permission information DB 33. For example, when the access request is the address of the access destination of the shared bus slave 500, whether the address is the address of the access prohibited area is checked with reference to the access permission / prohibition information DB33.

[0069] Step S15: If the access permission determination section 31 determines that access is permitted as a result of the comparison, access permission processing is performed in step S16. On the other hand, if it is determined that access is prohibited, access prohibition processing is performed in step S17.

Step S16: The IF unit 400 generates a command for accessing the access request destination area in the shared bus slave 500 based on the fact that the access is permitted by the access permission / non-permission determining unit 31. . The shared bus slave 500 is controlled based on the generated command to read data from an access request destination area in the shared bus slave 500 or write data to the access request destination area. I do. Step S17: The IF unit 400 performs an access prohibition process based on the fact that the access is prohibited by the access permission determination unit 31. The access prohibition processing includes (A) notification of access prohibition to the bus master 10, (B) dummy response processing by the dummy response unit 41, (C) dummy access by the dummy access unit 42, and the like.

(3) Effect

With the above configuration, in the microprocessor system 1000 according to the first embodiment, only the bus master 10 permitted by the access permission determination unit 31 can access a desired area of the shared bus slave 500. Therefore, a dedicated area for the specific bus master 10 can be secured on the shared bus slave 500. For this reason, it is possible to prevent data and programs from being read or tampered with by unauthorized access by a bus master other than a specific bus master, and to prevent unauthorized execution of the program and improve security. For example, even if a bus master other than the specific bus master attempts to access the dedicated area of the specific bus master due to a program falsification or malfunction, the access can be prohibited. More specifically, this is effective when a debugger is connected and an attempt is made to access a dedicated bus master area on the shared bus slave 500 as a bus master. At this time, first, the bus master identification unit 200 identifies from which bus master the access request is issued. Next, the access permission / non-permission determining unit 31 can prohibit the access request by recognizing, based on the access permission / prohibition information, that the access request is an access request to a non-permitted area.

Further, since the bus master 10 shares the shared bus slave 500, it is not necessary to provide a dedicated bus slave for each specific bus master. Therefore, it is possible to reduce the cost of providing bus wiring and terminals for connecting the bus master 10 to a separate bus slave such as a dedicated DRAM or SRAM.

FIG. 4 is a configuration diagram of a multiprocessor system according to the second embodiment of the present invention. The bus master identification unit 200 of the multiprocessor system 1000 according to the second embodiment receives an operation ID indicating the operation state of each bus master together with each bus master access request. Then, based on the access request, the bus master identification unit 200 identifies from which of the masters 10 the access request is. Further, the bus master identification unit 200 The identification result of the master, the access request and the operation ID are output to the access permission / non-permission judgment unit 31. When an access request is made from a plurality of bus masters 10, the bus master identification unit 200 selects a bus master that receives the access request. The access permission / prohibition information DB 33 stores access permission / prohibition information according to the operation state of each bus master 10. The access permission / non-permission determining unit 31 determines access permission / prohibition based on the identified operation state of the bus master 10 and the access permission / prohibition information. Other configurations of the second embodiment are the same as those of the first embodiment. The operating state includes, for example, information on a thread being executed.

FIG. 5 is an example of access permission / prohibition information according to the operation state stored in the access permission / prohibition information DB 33. When there are operation IDs 0 and 1 as the operation states, the access prohibition area is specified by the access prohibition start address and the access prohibition end address for each operation state of each bus master 10. When the operation ID is 0, the first bus master 10a can access the area of the address 0x8000—0000 to 8000—FFFF in the shared bus slave 500. On the other hand, if the operation ID is 1, access to the area at addresses 0x8000-0000 to 8000-FFFF is prohibited.

Next, access control processing when an access request is made from the bus master 10 to the shared bus slave 500 will be described with reference to FIG. 2 again.

Step S 10: The bus master identification unit 200 receives an access request from the bus master 10.

Step S11: The bus master identification unit 200 identifies which bus master 10 is the access request. Further, the no-master identification unit 200 may identify the operation state of the bus master 10. The operation state is identified based on, for example, an operation ID input from the bus master 10 in response to an access request.

Steps S12 and S13: The bus master identification unit 200 selects the nosmaster 10, and outputs the access request, the identification result, and the operation state of the selected bus master 10 to the access availability determination unit 31.

Step S 14: The access permission / non-permission determining section 31 compares the access request from the bus master identifying section 200, the identification result, the operation state, and the access permission / prohibition information in the access permission / prohibition information DB 33. Collate.

Steps S15, S16, S17: If access is permitted, access permission processing is performed in step S16. On the other hand, if it is determined that the access is prohibited, the access prohibition process is performed in step S17!

With the above configuration, it is possible to secure a dedicated area on shared bus slave 500 that can be accessed only when a specific bus master 10 is in a specific operation state. As described above, in addition to performing access permission / inhibition determination for each bus master, access permission / inhibition determination is performed in accordance with the operation state of each bus master 10, whereby security can be further enhanced. For example, it is assumed that a media processing processor power and a certain nosmaster power are read and executed from a shared bus slave 500 composed of a shared memory as a media processing program of a confidential algorithm. An exclusive operation ID is output from the nosmaster in response to this operation state, and in the case of the exclusive operation ID, the access permission / non-permission judgment unit 31 permits the access request. On the other hand, when another processing program other than the confidential algorithm is developed in the same media processing processor, an operation ID other than a dedicated operation ID is output. However, in the case of the operation ID, the access request is not permitted in the access permission / non-permission determining unit 31. Therefore, it cannot access confidential media processing programs. By such access permission determination, it is possible to prevent reading of a confidential media processing program when another processing program is being executed in the same media processing processor.

FIG. 6 is a configuration diagram of a multiprocessor system according to the third embodiment. In the multiprocessor system 1000 according to the third embodiment, the first bus master 10a has a dedicated instruction for accessing the access permission information. Examples of the dedicated instruction include a read instruction for reading the access permission information and a write instruction for writing / rewriting the access permission information. Then, when accessing the access permission information, the first bus master 10a decodes the dedicated instruction and outputs an access request based on the dedicated instruction to the bus master identification unit 200. Bus master identification section 200 outputs an access request to access permission / inhibition determination section 31. The access permission / non-permission judgment unit 31 determines whether the first bus master 10a It is determined based on the access permission information in the access permission information DB 33 whether or not to permit an access request for accessing the access permission information. Here, the access permission information in the access permission information DB 33 includes restriction information on whether access to the access permission information is permitted or not for each bus master. FIG. 7 is an example of the restriction information in the access permission information DB33. In FIG. 7, whether or not access to the access permission information is permitted is set for each bus master as restriction information. Further, the restriction information may be information indicating whether or not access is possible for each type of access availability information of each bus master. That is, the information may prohibit only read access to the access permission information, prohibit only write access, or prohibit both read access and write access. Other configurations of the third embodiment are the same as those of the first embodiment.

Here, the access to the access permission information based on the dedicated instruction is performed by, for example, accessing a predetermined address of a register.

When the multiprocessor system is configured as shown in FIG. 6, it is possible to change the access permission area of the bus master as follows by accessing the access permission information and rewriting the access permission information. For example, suppose a bus master downloads a new program via a network. When a certain bus master needs to extend the dedicated area in the shared bus slave 500 to execute the new program, a certain bus master decodes a write instruction for rewriting the access enable / disable information, and requests an access based on the write instruction. Is output. This access request is executed, for example, by accessing a specific address of the register 35 in the access permission / non-permission determining unit 31. The bus master identification unit 200 receives an access request based on a write instruction, and identifies the bus master making the access request. The access permission / inhibition determination unit 31 determines whether to permit the access request output by the nosmaster based on the access permission information in the access permission information DB 33. Here, the access availability information in the access availability information DB33 includes, for each bus master, restriction information as to whether or not the access request based on the write instruction is permitted. If the access request by the identified nosmaster is permitted, the access permission information in the access permission information DB 33 is rewritten based on the access request to the access permission information. With this rewrite, the bus master is now in the extended shared bus slave 500 It is possible to execute a new program using the area. On the other hand, when access is prohibited based on the access permission information, execution of rewriting of the access permission information is prohibited.

[0085] Further, it is possible to limit access requests based on a read command for reading access permission information. For example, first, the bus master identification unit 200 receives an access request based on a read command from the bus master, and identifies the bus master that has output the access request. The access permission / non-permission determining unit 31 reads the access permission / prohibition information in the access permission / prohibition information DB 33 based on the read command only when reading by the identified bus master is permitted. Then, the read access permission / inhibition information is output to the IF unit 400 and output to the bus master that has issued the read instruction.

As described above, by determining whether or not to access the access permission information, it is possible to increase the degree of freedom in accessing the access permission information while restricting unauthorized access from a bus master that is not permitted to access, thereby improving security. Can be enhanced. In addition, by reading the access permission / rejection information while restricting illegal reading, debugging efficiency can be improved while security is improved.

In the above description, the access request to the access permission information is performed using the same node as the access request to the shared bus slave. Good.

FIG. 8 is a configuration diagram of a multiprocessor system according to a fourth embodiment of the present invention. The multiprocessor system 1000 according to the fourth embodiment has a program authentication unit 21 in a bus master identification unit 200. When the program is authenticated by the program authentication unit 21, the access request is permitted. Other configurations of the fourth embodiment are the same as those of the first embodiment.

The program authentication unit 21 authenticates whether the program executed by the bus master 10 is legitimate or illegal, and outputs the authentication result to the access permission / non-permission determining unit 31. As a program authentication method, for example, program authentication is performed using encryption / decryption techniques such as a public key, a secret key, and an electronic signature. Then, the program authentication unit 21 outputs the authentication result to the access permission determination unit 31. When the program authentication unit 21 determines that the program executed by the bus master 10 is not valid, the access permission determination unit 31 prohibits the access request from the bus master 10. For example, the access permission / non-permission determining unit 31 checks the access request of the bus master 10 against the access permission / prohibition information in the access permission / prohibition information DB 33, and the access is prohibited if the access request is permitted but the program is not authenticated. You. That is, the access permission / non-permission determining unit 31 permits the access request of the bus master 10 only when the program is authenticated and the access request is permitted by the access permission / prohibition information.

As described above, in the multiprocessor system according to the fourth embodiment, when the bus master is executing an unauthenticated program, access to the access request destination in the shared bus slave is prohibited. be able to. Therefore, security can be further improved. In this example, the program authentication unit 21 is provided in the bus master identification unit 200. However, the program authentication unit 21 may be configured as an independent function block that is not provided in the bus master identification unit 200. Further, the access permission information in the access permission information DB33 may include information on whether or not the program needs to be authenticated in order to determine that the program is accessible.

[0092] <Fifth Embodiment Example>

FIG. 9 is a configuration diagram of a multiprocessor system according to a fifth embodiment of the present invention. In the fifth embodiment, program authentication is performed in the same manner as in the fourth embodiment, and access permission / inhibition determination for the access permission information shown in the third embodiment is performed. The first bus master 10a of the multiprocessor system according to the fifth embodiment has a dedicated instruction for accessing the access permission information as in the third embodiment. The access permission information in the access permission information DB 33 includes restriction information on whether or not the access to the access permission information is permitted for each bus master. Further, the bus master identification unit 200 has a program authentication unit 21 as in the fourth embodiment. Other configurations of the fifth embodiment are the same as those of the first embodiment.

[0093] When accessing the access permission information, the first bus master 10a outputs an access request based on a dedicated instruction to the bus master identification unit 200. The bus master identifying unit 200 issues an access request and identifies a bus master. The program authentication unit 21 in the bus master identification unit 200 determines whether the program executed by the bus master 10 is legitimate or not. Authentication is performed, and the authentication result is output to the access permission determination unit 31. The access permission / non-permission determining unit 31 receives the authentication result, the identification result, and the access request. The access permission / non-permission determining unit 31 determines whether to permit the access request based on the access permission / prohibition information in the access permission / prohibition information DB 33, and permits or prohibits the access request from the bus master 10 based on the authentication result. I do. As described above, even when an access request is made by decoding a dedicated instruction such as a read instruction or a write instruction, security can be further enhanced by using program authentication together. Note that here, an example in which a dedicated instruction for accessing the access permission information is provided is shown. The access permission information DB may be a register to which an address is assigned, that is, the access permission information is obtained by accessing the address. You can access to,.

[0094] <Sixth embodiment example>

FIG. 10 is a configuration diagram of a multiprocessor system according to the sixth embodiment of the present invention. A multiprocessor system 1000 having an access control unit according to the sixth embodiment has a first bus master identification unit 200a and a second bus master identification unit 200b. The bus master 150 including the second bus master 10b and the third bus master 10c is connected to the first bus master identification unit 200a, and the first bus master 10a is connected to the second bus master identification unit 200b. Other configurations are the same as those of the first embodiment.

[0095] An access request from the second bus master 10b and the third bus master 10c is output to the first bus master identification unit 200a, and an access request from the first bus master 10a is output to the second bus master identification unit 20 Ob. When receiving the access request, the first bus master identification unit 200a identifies whether the request is an access request from the second bus master 10b or an access request from the third bus master 10c. In the case of an access request from both the second bus master 10b and the third bus master 10c, it is determined which of the bus masters receives the access request, for example, according to the priority of receiving the access request. Further, first bus master identification section 200a outputs the identification result to second bus master identification section 200b. The second bus master identification unit 200b accepts an access request from the first bus master 10a and determines whether to accept the access request of the first bus master 10a by the ability to accept the access request of the bus master identified by the first bus master identification unit 200a. . By providing a plurality of bus master identification units in this way, it is possible to reduce the number of wirings and the wiring length between the nosmaster and the bus master identification unit. The plurality of nosmaster identification units can be provided as appropriate in consideration of the number of bus masters, the number of wirings, and the wiring length.

[0097] <Seventh embodiment example>

FIG. 11 is a configuration diagram of a multiprocessor system according to a seventh embodiment of the present invention. The multiprocessor system 1000 includes a system LSI 600 and a shared bus slave 500. The system LSI 600 is formed such that the multiprocessor 100, the bus master identification unit 200, the access control unit 300, and the IF (InterFace) unit 400 are included on one chip. The shared bus slave 500 is a shared area external to the system LSI 600, and is configured by an external shared memory such as a DRAM and an SRAM (Static Random Access Memory). The internal configuration of each unit of the multiprocessor 100, the bus master identification unit 200, the access control unit 300, the IF (interFace) unit 400, and the shared bus slave 500 is the same as in the first embodiment. As described above, when the shared bus slave 500 is externally attached to the system LS 1600, the degree of freedom can be increased, such as changing the capacity of the shared area after designing the system LSI.

[0098] Further, a bus encryption unit 450 for encrypting / decrypting access data such as addresses, write data, and read data exchanged between the system LSI 600 and the shared bus slave 500 connected to the outside is provided. It is preferable to have. By providing the bus encryption unit 450, it is possible to prevent the access to the dedicated area of each bus master 10 in the shared bus slave 500 from being analyzed.

Further, as shown in FIG. 12, the system LSI 610 may be configured to include the shared bus slave 500 in the chip. By including the shared bus slave 500 in one chip, the confidentiality of access from the no master 10 to the shared bus slave can be improved.

[0100] <Eighth embodiment example>

FIG. 13 is a configuration diagram of a multiprocessor system according to an eighth embodiment of the present invention. The multiprocessor system 1000 includes a system LSI 620, a first shared bus slave 500a, and a second shared bus slave 500b. The system LSI 620 includes a multiprocessor 100, a bus master identification unit 200, an access control unit 300, a first IF unit 400a and a second IF unit 400b. It is formed so as to be included on one chip. The first shared bus slave 500a and the second shared bus slave 500b are connected to the first IF unit 400a and the second IF unit 400b, and are shared by a plurality of bus masters 10 in the system LSI 620. In the access control unit 300, a first access permission / non-permission judgment unit 31a corresponding to the first shared bus slave 500a and a second access permission / non-permission judgment unit 3lb corresponding to the second shared bus slave 500b are provided. . The first IF section 400a and the second IF section 400b are respectively provided between the first shared bus slave 500a and the first access permission / non-permission judgment section 31a, and between the second shared bus slave 500b and the second access permission / non-permission judgment section 31b. ing. Here, the first access availability determination unit 31a and the second access availability determination unit 31b have the same configuration as the access availability determination unit 31 of the first embodiment. Further, the first IF section 400a and the second IF section 400b have the same configuration as the IF section 400 of the first embodiment. Other multiprocessor 100 and bus master identification unit 200 access availability information DB33 has the same configuration as that of the first embodiment.

Further, as shown in FIG. 14, the system LSI 630 may be configured to include the second shared bus slave 500b in the chip, and the first shared bus slave 500a may be connected to the system LSI 630. Therefore, the secrecy of access from the bus master 10 to the second shared bus slave 500b can be improved. As described above, it is possible to obtain a multiprocessor system capable of restricting access while having various modes such as incorporating or externally attaching the first shared bus slave 500a and the second shared bus slave 500b inside the system LSI. . When a shared bus slave is externally attached, the degree of freedom can be increased, for example, by changing the capacity of the shared area.

[0102] <Ninth embodiment example>

FIG. 15 is a configuration diagram of a multiprocessor system according to the ninth embodiment of the present invention. The multiprocessor system 1000 is a data processing system that processes a large amount of data such as a facsimile machine, and includes a system LSI 640, a peripheral circuit unit 900 such as a scanner and a printer, and a memory unit 950 such as a DRAM and an SRAM. The system LSI 640 is connected to the peripheral circuit unit 900 and the memory unit 950, and is included on a single chip of the multiprocessor 100, the bus master identification unit 200, the access control unit 300, the DMA control unit 700, and the memory scheduler 800. It is formed as follows. According to the ninth embodiment, In the multiprocessor system 1000, in order to improve the data processing efficiency, data is directly transferred between the peripheral circuit unit 900 and the memory 950 without passing through the multi-processor 100. Hereinafter, the configurations and operations of the DMA control unit 700 and the memory scheduler 800 will be described.

[0103] The DMA control section 700 includes a host IF section 400, a shared bus slave 500, and a peripheral circuit IF section 750. The shared bus slave 500 is shared by a plurality of bus masters 10 constituting the multiprocessor 100. The shared bus slave 500 has a DMA control register that stores information (hereinafter, DMA control information) necessary for performing direct data transfer, such as a transfer mode, a transfer destination or transfer source address, and the number of transfer bytes. It is. The peripheral circuit IF section 750 of the DMA control section 700 is connected to the memory scheduler 800 and the peripheral circuit section 900. Further, the memory scheduler 800 is connected to a memory 950 outside the system LSI 640, and generates commands for accessing the memory. When direct memory transfer is performed, data input from the peripheral circuit unit 900 such as a scanner or a printer is transferred to the memory via the peripheral circuit IF unit 750 and the memory scheduler 800 based on the DMA control information in the shared bus slave 500. Transferred to 950.

Here, when an access request to the shared bus slave 500 is made from the bus master 10, the access is restricted based on the access permission information as in the first embodiment. First, the bus master identification unit 200 identifies the bus master 10 that has issued the access request. Then, the access permission / inhibition determination unit 31 determines access permission / inhibition based on the access permission / inhibition information in the access permission / inhibition information DB 33. When access is permitted by the access permission / non-permission determining unit 31, access to the shared bus slave 500 is performed via the host IF unit 400. In this way, by restricting access to the shared bus slave 500, which is a DMA control register, it is possible to prevent unauthorized access to DMA control information. That is, a dedicated area for the bus master can be secured in the shared bus slave 500 that is the DMA control register. Therefore, for example, unauthorized reading due to rewriting of DMA control information for reading and decrypting encrypted data from the peripheral circuit unit 900 can be prevented. Note that, here, the power in the example in which the shared bus slave 500 is the DMA control register is not limited thereto. In addition, accumulator, stack register, program counter, split And various control registers such as an embedded register and a flag register.

[0105] In the embodiments described above, in the present embodiment, 100 including a plurality of bus masters is referred to as a multiprocessor. Instead of a plurality of processors, a multimaster may be used.

FIGS. 16 to 18 are configuration diagrams of a multiprocessor system according to the tenth embodiment of the present invention. The multiprocessor system 2000 is a data processing system that processes a large amount of data, and includes a system LSI 740, a peripheral circuit unit 900, and an external shared bus slave 500. The system LSI 740 is connected to the peripheral circuit unit 900 and the shared bus slave 500, and is formed so that the multiprocessor 100, the DMA controller 700, and the memory scheduler 800 are included on one chip. .

The DMA controller 700 directly controls data transfer between the peripheral circuit unit 900 and the shared bus slave 500 without passing through the multiprocessor 100 in order to improve data processing efficiency. Further, the memory scheduler 800 is connected to the shared bus slave 500 outside the system LSI 740, and generates commands for accessing the shared bus slave 500.

The multiprocessor 100 is composed of a plurality of bus masters 10 (bus masters 10a, 10b ′...), And the shared bus slave 500 is shared by the plurality of bus masters 10. For example, each bus master is assigned a dedicated first bus master dedicated area 50a, a second bus master dedicated area 50b, a third bus master dedicated area 50c, and a shared area 51 shared by each bus master 10. including. Further, each bus master 10 can access the shared bus slave 500 via the memory scheduler 800 or the DMA controller 700.

Here, in FIG. 16, the DMA controller 700 has a bus master identification unit 200a and an access control unit 300a, and in FIG. 17, both the DMA controller 700 and the memory scheduler 800 have a bus master identification unit and an access control unit. In FIG. 18, the memory scheduler 800 has a bus master identification unit 200b and an access control unit 300b. Hereinafter, each configuration will be described.

[0110] (1) Access control by DMA controller First, the configuration of FIG. 16 will be described below. The DMA controller 700 includes a no-master identification unit 200a, an access control unit 300a, a host IF (InterFace) unit 400a, a control register 550, and a peripheral circuit IF unit 750. Upon receiving an access request from each bus master 10 to the shared bus slave 500, the bus master identification unit 200a identifies which bus master 10 is the access request. Then, the access request and the identification result are output to the access control unit 300a.

[0111] The access control unit 300a includes an access permission / inhibition determination unit 3la and an access permission / inhibition information DB 33a. Access permission / non-permission information The DB 33a stores, for each bus master 10, access permission / non-permission information indicating whether or not access to the shared bus slave 500 is possible. For example, information that allows the first bus master 10a to access the first bus master dedicated area 50a, information that enables the second bus master 10b to access the second bus master dedicated area 50b, and information that allows the third bus master 10c to access the bus master dedicated area 50c. Access permission information including information for enabling access is stored.

[0112] The access permission / inhibition determination unit 31a performs access permission / inhibition determination by comparing the access request and the identification result input from the bus master identification unit 200a with the access permission / inhibition information in the access permission / inhibition information DB 33a. The access propriety judging section 31 outputs the judgment result to the host IF section 400a.

[0113] The control register 550 is a DMA control register that stores information (hereinafter, DMA control information) necessary for performing direct data transfer, such as a transfer mode, a transfer destination or transfer source address, and the number of transfer bytes. . The peripheral circuit IF section 750 is connected to the memory scheduler 800 and the peripheral circuit section 900.

Next, an operation of the multiprocessor system 2000 shown in FIG. 16 will be described. When an access request to the shared bus slave 500 is made from the nosmaster 10, the access is restricted based on the access permission information as in the first embodiment. First, the bus master identification unit 200a identifies the bus master 10 that has made the access request. Then, the access permission / non-permission determination unit 31a determines access permission / prohibition based on the access permission / prohibition information in the access permission / prohibition information DB 33a. When the access is permitted by the access permission / inhibition judging unit 3 la, the control register 550 is accessed through the host IF unit 400a. And peripheral times The path IF unit 750 transfers an access request from each bus master to the memory scheduler 800 based on the DMA control information in the control register. The memory scheduler 800 accesses the shared bus slave 500 based on the access request. At this time, the memory scheduler 800 also acquires the access result from the dedicated area or the shared area for each bus master. Then, the memory scheduler 800 transmits the access result to the peripheral circuit IF unit 750. The peripheral circuit IF unit 750 transmits the access result to each bus master 10.

According to the configuration of FIG. 16, when each bus master 10 accesses the shared bus slave 500 via the DMA controller 700, only the bus master permitted by the access permission / non-permission judging unit 3 la determines whether the shared bus slave 500 Can access the area. Therefore, a dedicated area for a specific bus master is secured on the shared bus slave, and illegal access by a bus master other than the specific bus master is prohibited, thereby improving security.

[0116] Further, information on access permission to the peripheral circuit unit 900 such as an external I / O and an external port may be stored in the access permission information DB 33a for each bus master 10. When each bus master 10 accesses the peripheral circuit section 900 via the DMA controller 700, only the bus master 10 to which access is permitted by the bus master identification section 200a and the access permission / non-permission determination section 31a is in the vicinity of a predetermined area to which access is permitted. The circuit section 900 becomes accessible. Therefore, security can be further improved.

Further, since the bus master 10 shares the shared bus slave 500, it is not necessary to separately provide a dedicated bus slave for each specific bus master 10. Therefore, it is possible to reduce the cost of providing bus wiring and terminals for connecting a separate bus slave and the bus master 10.

(2) Access control by DMA controller and memory scheduler

Next, the configuration of FIG. 17 will be described below. In FIG. 17, in addition to the DMA controller 700, the memory scheduler 800 further includes a bus master identification unit 200b and an access control unit 30.

Ob is provided. Since the configuration of the DMA controller is the same as that of FIG. 16, the description will be omitted, and the configuration of the memory scheduler 800 will be described below.

[0119] The memory scheduler 800 includes a no-master identification unit 200b, an access control unit 300b, and an IF (Inter

Face) section 400b and IF section 470. The bus master identification unit 200b When an access request from the master 10 to the shared bus slave 500 is received, it is identified which bus master 10 is the access request. Then, it outputs the access request and the identification result to the access control unit 300b.

[0120] The access control unit 300b has an access permission / inhibition determination unit 3lb and an access permission / inhibition information DB 33b. Access permission information DB33b stores access permission information indicating whether access to the shared bus slave 500 is possible or not for each bus master 10.

[0121] The access permission / inhibition determination unit 31b performs access permission / inhibition determination by comparing the access request and identification result input from the bus master identification unit 200a with the access permission / inhibition information in the access permission / inhibition information DB 33b. Access availability determination section 31b outputs the determination result to IF section 470.

Next, the operation of the multiprocessor system 2000 shown in FIG. 17 will be described. When an access request to the shared bus slave 500 is made from the nosmaster 10 via the memory scheduler, the access is restricted based on the access permission information as in the first embodiment. First, the bus master identification unit 200b identifies the bus master 10 that has made the access request. Then, the access permission / non-permission determining unit 31b determines access permission / prohibition based on the access permission / prohibition information in the access permission / prohibition information DB 33b. When the access is permitted by the access permission / non-permission determining unit 31b, the access to the permitted area of the shared bus slave 500 is performed via the IF unit 470. The IF unit 470 transmits the access result obtained from the shared bus slave 500 to each bus master 10.

According to the configuration of FIG. 17, even when an access request is issued from each bus master 10 to the memory scheduler 800 without passing through the DMA controller 700, only the bus master permitted by the access permission / inhibition determination unit 3 lb Able to access the specified area of the shared bus slave 500. Even when an access request is made from each bus master 10 via the DMA controller 700, only the bus masters permitted by the access permission / non-permission judging unit 31a in the DMA controller 700 access a predetermined area of the shared bus slave 500. it can. Therefore, a dedicated area for a specific bus master can be secured on the shared bus slave, and unauthorized access by a bus master other than the specific bus master can be prohibited, thereby improving security. [0124] (3) Access control by memory scheduler

Next, the configuration of FIG. 18 will be described below. In FIG. 18, only the memory scheduler 800 is provided with the bus master identification unit 200b and the access control unit 300b. The configuration of the memory scheduler 800 is the same as that of FIG. The DMA controller 700 has a host IF unit 400a that receives an access request from each bus master 10, a control register 550, and a peripheral circuit IF unit 750, and does not include the bus master identification unit 200a and the access control unit 30Oa.

The access request from each bus master 10 to the shared bus slave 500 is made via the DMA controller 700 and the memory scheduler 800, and the request is made directly via the memory scheduler 800. That is, an access request to the shared bus slave 500 is always made via the memory scheduler 800. Here, since the memory scheduler 800 is provided with the bus master identification unit 200b and the access control unit 300b, only the bus masters permitted by them can access the predetermined area of the shared bus slave 500. Therefore, a dedicated area for a specific bus master is secured on the shared bus slave, and unauthorized access by a bus master other than the specific bus master is prohibited, thereby improving security.

In FIGS. 16 to 18, a dedicated area for each bus master may be provided in the control register 550 as in the ninth embodiment. As an example, FIG. 19 shows a configuration in which the control register 550 in FIG. 17 is a control register shared by each bus master. Access permission information DB33a stores, for each bus master, access permission information indicating whether or not the dedicated area can be accessed. For example, access permission / non-permission information including information for enabling the first bus master 10a to access the first bus master dedicated area 550a and information for enabling the second bus master 10b to access the second bus master dedicated area 550b are stored. Then, when the bus master 10 has also made an access request to the control register 550, the bus master identification unit 200a and the access availability determination unit 31a control access to the control register 550 based on the access availability information DB 33a. By restricting access to the control register 550 in this way, unauthorized access to the DMA control information can be prevented.

Industrial applicability According to the present invention, unauthorized access by a bus master other than a specific bus master can be prohibited, and security can be improved. Therefore, the present invention can be used for improving the security of a multiprocessor system.

Claims

The scope of the claims

[1] A plurality of bus masters, an access control device that performs access control on access to at least one shared bus slave shared by the plurality of bus masters, wherein the no master is an access to a predetermined area of the shared bus slave. An access permission / non-permission information storage section for storing access permission / prohibition information for prohibiting

When an access request is made to a desired area of the shared bus slave, the bus master moves to the area of the shared bus slave of the access request destination based on the access permission information of the access permission information storage unit. An access permission / non-permission determining unit that determines whether access is possible;

An access control device comprising:

[2] The bus master capability further includes, based on the shared bus slave's access request to a desired area, V, a nosmaster identifying unit that identifies the nosmaster that has made the access request,

2. The access control device according to claim 1, wherein the access permission / inhibition determination unit makes the determination based on the access permission / inhibition information of the bus master identified by the nosmaster identification unit.

[3] The access permission / prohibition information is a prohibition address for specifying an access prohibition area or a permission address for specifying an access permission area in a shared bus slave for each bus master. 2. The access control device according to claim 1, wherein the bus master determines whether or not the bus master can access the area of the shared bus slave to which the access request is made, based on the permission address.

[4] The prohibited address is an address that specifies a write access prohibited area to the shared bus slave for each bus master, a read access prohibited area from the shared bus slave, or an all access prohibited area to the shared bus slave.

The permission address is a read access permission area to the shared bus slave, or a read access permission area to the shared bus slave or all the addresses to the shared bus slave. 4. The access control device according to claim 3, wherein the address is an address for specifying an access permission area.

[5] The access availability information is stored for each operation state of each bus master,

The access permission / inhibition determination unit receives an operation state of the bus master that has made the access request and, based on the operation state and the access permission information for each operation state of the bus master, determines whether the bus master that has made the access request has 2. The access control device according to claim 1, wherein it is determined whether or not the area of the shared bus slave to which the access request is made is accessible.

[6] The shared bus slaves are various control registers,

The access permission / prohibition information is information for prohibiting access to the various control registers.

When an access request is made to a desired area of the various control registers, the access permission / inhibition determination unit is configured to perform the access request to the bus master based on the access permission information to the various control registers. 2. The access control device according to claim 1, wherein the access control device determines whether or not the access request destination can access areas of the various control registers.

[7] The various control registers are DMs for storing DMA (Direct Memory Access) control information.

A control register

The access permission information is information for prohibiting access to the DMA control register.

When an access request is made to a desired area of the DMA control register, the access permission / inhibition determination unit makes the access request based on the access permission / inhibition information to the DMA control register. 7. The access control device according to claim 6, wherein the bus master determines whether or not the area of the DMA control register of the access request destination is accessible.

[8] Data output from the bus master to the shared bus slave is encrypted on a data bus between the bus master and the shared bus slave, and data output from the shared bus slave to the bus master is decrypted. It is further characterized by further including a bus encryption unit for making a droid. 2. The access control device according to claim 1, wherein:

[9] a program authentication unit that authenticates a program executed by the bus master that has made the access request,

The access permission / inhibition judging section is configured such that, based on the authentication result in the program authentication section and the access permission / inhibition information in the access permission / inhibition information storage section, the bus master that has made the access request is a shared bus slave of the access request destination. 2. The access control device according to claim 1, wherein it is determined whether or not an area can be accessed.

[10] The bus master has a dedicated instruction for accessing the access permission information stored in the access permission information storage unit, and decodes the dedicated instruction to access the access permission information when the dedicated instruction is executed. Issue an access request to

The access permission / inhibition determination unit receives an access request based on the dedicated command, and determines whether or not the ability to execute the access request is based on an authentication result received from the program authentication unit. 10. The access control device according to 9.

[11] The bus master has a dedicated instruction for accessing the access permission information stored in the access permission information storage unit, and decodes the dedicated instruction to access the access permission information when the dedicated instruction is executed. 2. The access control device according to claim 1, wherein the access control device issues an access request for the access control.

[12] The access permission / non-permission information storage unit is a register to which a specific address is assigned. When the bus master issues an access request to the specific address, the access permission / rejection information storage unit stores the access permission / rejection information storage unit. 2. The access control device according to claim 1, wherein the access control device requests access to permission information.

[13] The access permission / non-permission information includes restriction information on whether or not the user has permission to access the access permission / prohibition information,

13. The access control device according to claim 11, wherein the access permission / inhibition determination unit determines whether or not the access permission / inhibition information is accessible based on the restriction information.

[14] When the access permission / inhibition determination unit determines that the bus master that has made the access request cannot access the area of the shared bus slave to which the access request is made, 2. The access control device according to claim 1, further comprising a dummy response unit that performs a dummy response to the bus master that has made the access request.

[15] In the access permission / inhibition determination unit, when it is determined that the bus master making the access request cannot access the area of the shared bus slave to which the access request is made, the shared bus slave to which the access request is made is given. 2. The access control device according to claim 1, further comprising a dummy access unit that performs dummy access.

[16] With multiple bus masters,

An access control device for controlling access to at least one shared bus slave shared by the plurality of bus masters;

The access control device,

An access information storage unit that stores access information prohibiting access from the bus master to the shared bus slave;

In the case where an access request to the desired area of the shared bus slave is made, the bus master sets the area of the shared bus slave to which the access request is made based on the access availability information of the access availability information storage unit. An access permission / non-permission determining unit that determines whether or not access is possible;

A system LSI comprising:

17. The system LSI according to claim 16, further comprising a noslave accessible by the plurality of bus masters.

[18] A plurality of bus masters, a DMA controller which performs access control on access to at least one shared bus slave shared by the plurality of bus masters, and a DMA controller which performs DMA (Direct Memory Access) control;

A DMA control device, comprising: a memory scheduler for controlling access to the shared bus slave, wherein the memory scheduler has the access control device according to claim 1.

[19] A DMA controller which performs access control on access to at least one shared bus slave shared by the plurality of bus masters, A DMA controller that performs DMA (Direct Memory Access) control,

A DMA controller, comprising: a memory scheduler for controlling access to the shared bus slave, wherein the DMA controller has the access controller according to claim 1.

[20] A DMA controller which performs access control on access to at least one shared bus slave shared by the plurality of bus masters,

A DMA controller that performs DMA (Direct Memory Access) control,

A memory scheduler for controlling access to the shared bus slave, wherein the memory scheduler has the access control device according to claim 1;

An MA controller has the access control device according to claim 1.

DMA controller.

[21] An access control method for performing access control on access to at least one shared bus slave shared by the plurality of bus masters, wherein the access prohibits access from the bus master to the shared bus slave. A storage step for storing availability information;

In the case where an access request to the desired area of the shared bus slave is made, the bus master sets the area of the shared bus slave to which the access request is made based on the access availability information of the access availability information storage unit. A determining step of determining whether or not access is possible;

An access control method comprising: