JP2014174758A - Processor - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a processor with reduced overhead.SOLUTION: A microcomputer 100 for executing software formed of a plurality of components includes an arithmetic operation unit 10, a storage unit 20, and a protection unit 30. The protection unit 30 includes: a plurality of banks 331-33n storing memory protection information; a bank number register 33a on which a bank number is written; and a bank switching unit 31 for switching available banks by writing the bank number on the bank number register 33a. The bank switching unit 31 specifies a component to be executed by the arithmetic operation unit 10, and associates the bank corresponding to the specified component out of the banks 331-33n with the specified component in a one-to-one manner. Then, the bank switching unit 31 writes the bank number indicating the associated bank on the bank number register 33a when executed components are switched (S10-S40).

Description

  The present invention relates to a processing device having a calculation unit, a storage unit, and a protection unit that protects the storage unit by defining access of the calculation unit to the storage unit.

  Conventionally, as shown in Patent Document 1, for example, a microcomputer including a calculation unit (CPU in Patent Document 1), a protection information storage unit, and a memory access control device has been proposed. The protection information storage unit stores memory protection information for designating whether to permit or prohibit access to the memory space by a program executed by the arithmetic unit. The memory access control device determines whether to permit a memory access request by the arithmetic unit based on the memory protection information.

JP 2007-287103 A

  By the way, the software executed by the arithmetic unit may be composed of a plurality of components. Each of the plurality of components uses a different memory area. In addition, this component may consist of, for example, a safety component that satisfies a predetermined safety standard and a non-safety component that has no limit on the safety standard. Moreover, since there is no restriction | limiting in a safety standard, it is also considered that a non-safety component is a component which does not satisfy a safety standard. If a bug is included in the non-safety component, the arithmetic unit may cause a malfunction of accessing data unnecessary to operate based on the non-safety component when operating based on the non-safety component. .

  For example, in the microcomputer disclosed in Patent Document 1, it is determined whether or not to permit a memory access request by a calculation unit based on the protection setting register group including a plurality of registers storing memory protection information and the memory protection information. A memory access control device. As a result, it is possible to prevent a malfunction that data unnecessary for the operation unit to operate is accessed.

  However, in such a microcomputer, necessary memory protection information differs for each component. For this reason, when switching the component (program) to be executed, the setting of a plurality of registers constituting the protection setting register group is changed, which causes a problem that overhead is large. That is, there is a problem that processing time and load are excessively increased by rewriting a plurality of registers in order to change the memory protection information for each component.

  In view of the above problems, an object of the present invention is to provide a processing apparatus with reduced overhead.

In order to achieve the above object, the present invention provides:
A processing device for executing software composed of a plurality of components,
A calculation unit (10) for performing calculation processing based on each component;
A storage unit (20) for storing data for calculation processing by the calculation unit;
A protection unit (30) for protecting the storage unit by defining access to the storage unit by the arithmetic unit;
The protection part
While having a plurality of banks (331 to 33n) including a plurality of registers in which memory protection information including data indicating an address in the storage unit accessed by the calculation unit and data defining whether processing by the calculation unit is possible is stored,
A bank number register (33a) in which a bank number indicating a valid bank among a plurality of banks is written;
A specifying means (S10) for specifying a component to be executed by the calculation unit;
Corresponding means (S20) for associating the components specified by the specifying means with the banks corresponding to the specified components in the plurality of banks on a one-to-one basis;
When the component to be executed is switched to the component specified by the specifying unit, the bank number indicating the bank associated by the association unit is written in the bank number register, thereby switching the effective bank (S30, S40). ) And
According to the memory protection information stored in the register of the bank that is enabled by the switching unit, the storage unit is protected by defining access to the storage unit by the arithmetic unit.

  Thus, according to the present invention, when the component to be executed is switched, it is possible to switch to the bank corresponding to the component to be executed simply by writing the bank number in the bank number register. That is, according to the present invention, when the component to be executed is switched, the memory protection information can be switched only by writing the bank number in the bank number register. Therefore, the present invention specifies the access to the storage unit by the arithmetic unit according to the memory protection information stored in the plurality of registers by simply writing the bank number corresponding to the component to be executed to the bank number register. The storage unit can be protected. For this reason, as described above, according to the present invention, when the component to be executed is switched, it is not necessary to rewrite a plurality of registers, and overhead is reduced.

It is a block diagram which shows schematic structure of the microcomputer in embodiment. It is a block diagram which shows schematic structure of the memory | storage part in embodiment. It is a flowchart which shows the processing operation of the bank switching part in embodiment. It is a conceptual diagram for demonstrating protection of the memory | storage part in embodiment. It is a conceptual diagram for demonstrating protection of the memory | storage part in a comparative example.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. In the present embodiment, an example in which the present invention (processing device) is applied to the microcomputer 100 is employed. The microcomputer 100 executes software composed of a plurality of different components. The plurality of components adopts an example including at least one safety component and at least one non-safety component.

  As described above, the safety component satisfies predetermined safety standards. Satisfaction of safety standards indicates that the product has been designed in accordance with a certified process. In other words, the safety component can be rephrased as a component designed according to the certified process. Incidentally, for example, an automobile safety level (ASIL) defined in ISO 26262 can be adopted as the safety standard. On the other hand, as described above, the non-safety component may be a component that does not satisfy the safety standard. In the present embodiment, a component that does not satisfy safety standards is adopted as the non-safety component.

  The microcomputer 100 can be applied to, for example, various electronic control devices that electronically control on-vehicle equipment. In addition, vehicle-mounted devices that are controlled by the electronic control device include powertrain devices such as engines, transmissions, and brakes, body devices such as air conditioners, seats, and door locks, and information systems such as navigation, ETC, and radio. Equipment and safety equipment such as airbags.

  As shown in FIG. 1, the microcomputer 100 includes a calculation unit 10, a storage unit 20, and a protection unit 30 as main parts.

  The arithmetic unit 10 corresponds to a so-called CPU (Central Processing Unit) and executes arithmetic processing based on components. In other words, the calculation unit 10 executes calculation processing based on the data stored in the storage unit 20. More specifically, the arithmetic unit 10 accesses the storage unit 20 and executes arithmetic processing based on data stored at the accessed address. The arithmetic unit 10 includes a program counter 11. The arithmetic unit 10 reads an instruction from a predetermined address in the storage unit 10 according to the value of the program counter 11 and executes arithmetic processing.

  As shown in FIG. 2, the storage unit 20 includes a ROM (Read Only Memory), a RAM (Random Access Memory), and a register. The storage unit 20 is collectively managed with a ROM, a RAM, and a register as one address space. The storage unit 20 stores data for the arithmetic processing unit 10 to perform arithmetic processing and data at the time of arithmetic processing. Specifically, the storage unit 20 stores the above-described software. More specifically, the execution program for each component is stored at a predetermined address in the storage unit 20.

  The protection unit 30 corresponds to a so-called memory management unit, and protects the storage unit 20 by defining access of the calculation unit 10 to data stored in the storage unit 20. The protection unit 30 includes a bank switching unit 31, an address table 32, and a register bank unit 33. The register bank unit 33 includes a bank number register 33a and a plurality of banks 331 to 33n.

  The bank switching unit 31 switches between invalid and valid states of the banks 331 to 33n. Specifically, the bank switching unit 31 switches between the invalid state and the valid state of each bank 331 to 33n by writing the bank number indicating the bank to be valid in the bank number register 33a. In other words, the bank switching unit 31 switches the bank in the valid state by setting the bank value to be used by switching in the bank number register 33a. In this way, the bank number register 33a is written with a bank number indicating a bank to be activated among the plurality of banks 331 to 33n. That is, the bank number of the bank in the valid state among the plurality of banks 331 to 33n is written in the bank number register 33a.

  In the address table 32, the address ranges in the storage unit 20 and the banks 331 to 33n corresponding to the address ranges are associated with each other. For example, as shown in FIG. 1, address A to address B are associated with the first bank 331, address B to address C are associated with the second bank 332, and address Y to address Z are associated with the Nth bank. 33n.

  The address table 32 is a table for determining a bank corresponding to the component that the arithmetic unit 10 is going to execute. Therefore, instead of the address table 32, a component table in which each component and each bank 331 to 33n corresponding to each component are associated can be adopted. For example, the component table in which the safety component in FIG. 4 and the first bank 331 are associated with each other and the non-safety component in FIG. 4 and the second bank 332 in association with each other can be adopted. Note that both the address table 32 and the component table may be referred to as a correspondence table.

  Each of the banks 331 to 33n includes a plurality of registers, and stores memory protection information including data indicating an address in the storage unit 20 accessed by the arithmetic unit 10 and data defining whether processing by the arithmetic unit 10 is possible. . That is, one bank is provided with a plurality of registers necessary for one component. Memory protection information corresponding to each component is stored in a plurality of registers. Each bank 331-33n is provided corresponding to each component. For example, when the bank corresponding to the first component is the first bank 331, memory protection information corresponding to the first component is stored in the first bank 331. Similarly, when the bank corresponding to the second component is the second bank 332, the memory protection information corresponding to the second component is stored in the second bank 332. It can also be said that each bank 331 to 33n includes a plurality of registers for setting the protection unit 30.

  The protection unit 30 configured as described above protects the storage unit 20 based on the memory protection information stored in each of the banks 331 to 33n. That is, the protection unit 30 defines the access of the arithmetic unit 10 to the data stored in the storage unit 20 according to the memory protection information stored in the plurality of registers of the bank that has become valid. Protect. In other words, the protection unit 30 stipulates that the arithmetic unit 10 unnecessarily accesses the memory area (address range) of the storage unit 20 in accordance with the memory protection information stored in the plurality of registers of the bank that has become valid. Thus, the storage unit 20 is protected.

  Here, the processing operation of the microcomputer 100 will be described with reference to FIGS. The bank switching unit 31 executes the processing shown in the flowchart of FIG. 3 in synchronization with the clock of the calculation unit 10.

  In step S10, the program counter 11 is confirmed (referenced). The bank switching unit 31 identifies the component that the calculation unit 10 is going to execute by confirming the program counter 11 (identification means). More specifically, first, the bank switching unit 31 identifies (determines) the address on the storage unit 20 of the component (execution program) that the calculation unit 10 is to execute by checking the program counter 11. That is, the bank switching unit 31 identifies the address on the storage unit 20 used by the component that the calculation unit 10 is going to execute by checking the program counter 11. Therefore, the bank switching unit 31 can be rephrased as indirectly identifying the component that the calculation unit 10 is to execute by recognizing this address. In the following, the address on the storage unit 20 of the execution program that the calculation unit 10 is to execute is also referred to as an execution address.

  Generally, the program counter 11 is hardware necessary for the operation of the CPU (here, the arithmetic unit 10) of the microcomputer. For this reason, by executing the processing described in step S10 described above, it is possible to determine the execution address without adding any special hardware. That is, the component which the calculating part 10 is going to perform can be specified, without adding hardware specially.

  The component can also be specified as follows. The bank switching unit 31 holds information indicating the address range of the execution program in each component stored in the storage unit 20. That is, the bank switching unit 31 holds a table in which each component is associated with an address range on the storage unit 20 in which each component (execution program) is stored. Further, the bank switching unit 31 identifies the execution address by checking the program counter 11 as described above. Then, the bank switching unit 31 refers to the above-described table, and identifies the component that the calculation unit 10 is to execute, depending on whether the execution address is included in the address range associated with which component. Therefore, it can be said that the bank switching unit 31 directly specifies the component that the calculation unit 10 is to execute by specifying the execution address.

  In step S20, the address table 32 is confirmed. The bank switching unit 31 checks the address table 32 and associates the component (address) specified in step S10 with the bank corresponding to the specified component in the plurality of banks 331 to 33n on a one-to-one basis (associating means). . Specifically, the bank switching unit 31 selects (extracts) from the address table 32 a bank associated with the address range including the address specified in step S10. In other words, it can be said that the bank switching unit 31 determines a bank corresponding to the component specified in step S10 from the plurality of banks 331 to 33n.

  In this way, by using the address specified using the address table 32 and the program counter 11, the bank corresponding to the component to be executed by the arithmetic unit 10 is determined without directly specifying the component. Can do.

  Note that when the bank switching unit 31 directly specifies in step S10, the bank corresponding to the component specified in step S10 can be determined by referring to the component table described above.

  In step S30, it is determined whether or not component switching is necessary (determination means). The bank switching unit 31 determines whether it is necessary to switch components based on the currently executed component and the component specified in step S10. The bank switching unit 31 proceeds to step S40 when it is determined that component switching is necessary, and skips step S40 when it is determined that switching is not necessary, and ends the processing shown in the flowchart.

  In step S40, the bank is switched (switching means). When the component to be executed is switched to the component specified in step S10, the bank switching unit 31 switches the bank in the valid state to the bank associated in step S20. At this time, the bank switching unit 31 switches the bank in the valid state by writing the bank number indicating the bank associated in step S20 to the bank number register 33a. That is, the bank switching unit 31 writes the bank number indicating the bank corresponding to this component in the bank number register 33a in order to enable the bank corresponding to the component that the arithmetic unit 10 is to execute.

  As described above, the bank switching unit 31 refers to the address table 32 and switches the bank depending on which address range in the address table 32 the execution address (the value of the program counter 11) is included in. Then, when switching the bank, the bank switching unit 31 writes the bank number indicating the bank to be made valid in the bank number register 33a.

  Here, the processing operation of the microcomputer 100 will be described in comparison with the processing operation of the microcomputer in the comparative example. FIG. 4 is a conceptual diagram for explaining protection of the storage unit 20 in the microcomputer 100. In FIG. 4, an example in which the safety component execution program is stored at addresses A to B of the storage unit 20 and the non-safe component execution program is stored at addresses B to C is adopted.

  On the other hand, FIG. 5 is a conceptual diagram for explaining protection of the storage unit in the comparative example. Unlike the microcomputer 100, the microcomputer of the comparative example does not have the banks 331 to 33n, and includes a plurality of registers in which memory protection information is stored in the protection unit. That is, the plurality of registers in the microcomputer of the comparative example corresponds to one bank of the microcomputer 100. Further, in FIG. 5, an example is adopted in which the safety component execution program is stored at addresses A to B of the storage unit, and the non-safe component execution program is stored at addresses B to C.

  Hereinafter, the plurality of registers storing the memory protection information in the comparative example are also referred to as protection registers. In the protection register, a memory area in which data of an address permitting access by the arithmetic unit is stored is also referred to as an access area, and a memory area in which data indicating the processing content (protection state) of the arithmetic unit is stored is also referred to as a processing area. The data stored in the access area includes data indicating a protection start address and data indicating a protection end address, and these may be collectively referred to as data indicating address setting. Furthermore, the data stored in the processing area can also be referred to as data indicating protection settings. In addition, (circle) shown in FIG. 5 has shown permission of the process by the calculating part in a comparative example, and x has shown prohibition of the process by a calculating part.

  Similarly, in the banks 331 to 33n of the microcomputer 100, the memory area where the data of the address permitting the access of the arithmetic unit 10 is stored is the access area, and the data indicating the processing content (protection state) of the arithmetic unit 10 is stored. The memory area is also referred to as a processing area. The data stored in the access area includes data indicating a protection start address and data indicating a protection end address, and these may be collectively referred to as data indicating address setting. Furthermore, the data stored in the processing area can also be referred to as data indicating protection settings. In FIG. 4, “◯” indicates that processing by the calculation unit 10 is permitted, and “x” indicates that processing by the calculation unit 10 is prohibited.

  First, the case where the arithmetic unit of the comparative example executes the safety component will be described with reference to FIG. In this case, the address area stores data indicating the address A as the protection start address of the storage unit and data indicating the address B as the protection end address of the storage unit. In another address area, data indicating the address C is stored as the protection start address of the storage unit, and data indicating the address D is stored as the protection end address of the storage unit. The protection start address A to the protection end address B of this storage unit are referred to as a first memory area. On the other hand, the protection end address D from the protection start address C of the storage unit is referred to as a second memory area.

  Further, when the arithmetic unit accesses the first memory area, the processing area includes data indicating read (read) permission, execution permission, and write (write) prohibition in the first memory area. It is remembered. In another processing area, data indicating permission of writing, permission of reading, and prohibition of execution in the second memory area is stored when the arithmetic unit accesses the second memory area. .

  In this case, the protection unit defines access to the storage unit of the calculation unit in the first memory area and the second memory area. Then, when the arithmetic unit accesses the first memory area, the protection unit permits reading and execution in the first memory area and prohibits writing. In addition, when the arithmetic unit accesses the second memory area, the protection unit permits writing and reading in the second memory area and prohibits execution. Furthermore, when the arithmetic unit accesses a memory area other than the first memory area and the second memory area, the protection unit performs all reading, writing, and execution in the memory area other than the first memory area and the second memory area. Is prohibited.

  Next, the case where the arithmetic unit of the comparative example shifts from a state where the safety component is implemented to a state where the non-safety component is executed will be described with reference to FIG.

  In this case, the data in the protection register is rewritten by the arithmetic unit. Specifically, as shown in FIG. 5, in the access area, the protection start address is rewritten from the data indicating the address A to the data indicating the address B, and the protection end address is the data indicating the address C from the data indicating the address B. To be rewritten. In another address area, the protection start address is rewritten from data indicating the address C to data indicating the address D, and the protection end address is rewritten from data indicating the address D to data indicating the address E.

  Therefore, data indicating the address B as the protection start address of the storage unit and data indicating the address C as the protection end address of the storage unit are stored in the address area. In another address area, data indicating the address D is stored as the protection start address of the storage unit, and data indicating the address E is stored as the protection end address of the storage unit. Note that the protection end address C to the protection end address C of the storage unit are referred to as a third memory area. On the other hand, the protection end address E to the protection end address E of the storage unit are referred to as a fourth memory area.

Further, the processing area is rewritten with data indicating permission for writing, permission for reading, and permission for execution in the third memory area when the arithmetic unit accesses the third memory area.
In addition, when the arithmetic unit accesses the fourth memory area, the data in another processing area is rewritten to data indicating permission of writing, permission of reading, and prohibition of execution in the fourth memory area. Thus, when the microcomputer of the comparative example is switched from the safety component to the non-safety component, the data in the protection register (memory protection information) is rewritten in software by the arithmetic unit.

  In this case, the protection unit defines access to the storage unit of the calculation unit in the third memory area and the fourth memory area. Then, when the arithmetic unit accesses the third memory area, the protection unit permits all reading, writing, and execution in the third memory area. In addition, when the arithmetic unit accesses the fourth memory area, the protection unit permits writing and reading in the fourth memory area and prohibits execution. Further, when the arithmetic unit accesses a memory area other than the third memory area and the fourth memory area, the protection unit performs all reading, writing, and execution in the memory area other than the third memory area and the fourth memory area. Is prohibited.

  Next, the case where the arithmetic unit of the comparative example shifts from the state in which the non-safety component is implemented to the state in which the safety component is executed will be described with reference to FIG.

  In this case, the data in the protection register is rewritten by the arithmetic unit. Specifically, as shown in FIG. 5, the data in the access area is rewritten from the third memory area and the fourth memory area to the first memory area and the second memory area. In addition, when the arithmetic unit 10 accesses the first memory area, the processing area is rewritten with data indicating read permission, execution permission, and write permission in the first memory area. Furthermore, when the arithmetic unit 10 accesses the second memory area, the data in another processing area is rewritten with data indicating permission of writing, permission of reading, and prohibition of execution in the second memory area. Thus, when the microcomputer of the comparative example is switched from the non-safety component to the safety component, the data (memory protection information) in the protection register is rewritten in software by the arithmetic unit.

  In this case, the protection unit defines access to the storage unit of the calculation unit in the first memory area and the second memory area. Then, when the arithmetic unit accesses the first memory area, the protection unit permits reading and execution in the first memory area and prohibits writing. In addition, when the arithmetic unit accesses the second memory area, the protection unit permits writing and reading in the second memory area and prohibits execution. When the arithmetic unit accesses a memory area other than the first memory area and the second memory area, the protection unit performs all reading, writing, and execution in the memory area other than the first memory area and the second memory area. Is prohibited.

  Thus, the microcomputer of the comparative example needs to rewrite a plurality of registers, for example, when shifting from a state in which a safety component is executed to a state in which a non-safety component is executed. That is, the microcomputer of the comparative example realizes memory protection between components by rewriting a plurality of registers and changing the protection state each time the execution state of the arithmetic unit is switched. In this example, it is necessary to rewrite six registers each time the execution state of the arithmetic unit is switched.

  On the other hand, the microcomputer 100 executes processing as follows. First, the case where the calculation unit 10 executes the safety component will be described with reference to FIG. In this case, the program counter 11 stores values indicating addresses A to B. Therefore, the bank number indicating the first bank 331 corresponding to the safety component is written in the bank number register 33a. For this reason, the 1st bank 331 is in an effective state among a plurality of banks 331-33n.

  In the address area of the first bank 331, data indicating the address A as the protection start address of the storage unit 20 and data indicating the address B as the protection end address of the storage unit 20 are stored. Further, in another address area of the first bank 331, data indicating the address C as the protection start address of the storage unit 20 and data indicating the address D as the protection end address of the storage unit 20 are stored. The protection start address A to the protection end address B of the storage unit 20 are referred to as a first memory area as in the comparative example. On the other hand, the protection end address D from the protection start address C of the storage unit 20 is referred to as a second memory area as in the comparative example.

  Furthermore, each processing area of the first bank 331 stores data indicating read permission, execution permission, and write permission in the first memory area when the arithmetic unit 10 accesses the first memory area. Has been. Further, in the other processing area of the first bank 331, when the arithmetic unit 10 accesses the second memory area, each of the second memory area indicates write permission, read permission, and execution prohibition in the second memory area. Data is stored.

  In this case, the protection unit 30 defines the access to the storage unit 20 of the calculation unit 10 in the first memory area and the second memory area. When the arithmetic unit 10 accesses the first memory area, the protection unit 30 permits reading and execution in the first memory area and prohibits writing. Further, when the arithmetic unit 10 accesses the second memory area, the protection unit 30 permits writing and reading in the second memory area and prohibits execution. When the arithmetic unit 10 accesses a memory area other than the first memory area and the second memory area, the protection unit 30 reads, writes, and executes in the memory area other than the first memory area and the second memory area. Ban all of. In this way, the protection unit 30 protects the storage unit 20 by defining access to the storage unit 30 by the arithmetic unit 10 according to the memory protection information stored in the register of the first bank 331 that has become valid. To do.

  Next, with reference to FIG. 4, a description will be given of a case where the calculation unit 10 shifts from a state where the safety component is implemented to a state where the non-safety component is executed. That is, the case where the component which the calculating part 10 performs switches from a safety component to a non-safety component is demonstrated. In this case, the program counter 11 is rewritten from the value indicating the addresses A to B to the value indicating the addresses B to C.

  When the component to be executed is switched from the safety component to the non-safety component, the bank switching unit 31 switches the valid bank from the first bank 331 to the second bank 332. At this time, the bank switching unit 31 switches the valid bank from the first bank 331 to the second bank 332 by writing the bank number indicating the second bank 332 in the bank number register 33a. That is, the bank switching unit 31 switches the bank that is hardware from the first bank 331 to the second bank 332.

  As shown in FIG. 4, the address area of the second bank 332 stores data indicating the address B as the protection start address of the storage unit 20 and data indicating the address C as the protection end address of the storage unit 20. In another address area, data indicating the address D is stored as the protection start address of the storage unit 20, and data indicating the address E is stored as the protection end address of the storage unit. Note that the protection end address C to the protection end address C of the storage unit 20 are referred to as a third memory area as in the comparative example. On the other hand, the protection end address E to the protection end address E of the storage unit 20 are referred to as a fourth memory area as in the comparative example.

  As a result, the access area is in the same state as when the protection start address is rewritten from the data indicating the address A to the data indicating the address B, and the protection end address is rewritten from the data indicating the address B to the data indicating the address C. It can be. Another address area is the same as when the protection start address is rewritten from the data indicating the address C to the data indicating the address D, and the protection end address is rewritten from the data indicating the address D to the data indicating the address E. State.

  Further, in the processing area of the second bank 332, when the arithmetic unit 10 accesses the third memory area, each data indicating write permission, read permission, and execution permission in the third memory area is stored. Has been. Further, in another processing area in the second bank 332, when the arithmetic unit 10 accesses the fourth memory area, each data indicating permission of writing, permission of reading, and prohibition of execution in the fourth memory area Is remembered.

  As a result, when the processing unit 10 accesses the third memory area, the processing area is the same as when the data indicating the write permission, the read permission, and the execution permission is rewritten in the third memory area. It can be in the state of. In addition, when the arithmetic unit 10 accesses the fourth memory area, the data in another processing area is rewritten with data indicating permission of writing, permission of reading, and prohibition of execution in the fourth memory area. It can be in the same state as the case. As described above, when the microcomputer 100 switches from the safety component to the non-safety component, the bank switching unit 31 switches the bank to switch the memory protection information in hardware.

  In this case, the protection unit 30 defines the access to the storage unit 20 of the calculation unit 10 in the third memory area and the fourth memory area. Then, when the arithmetic unit 10 accesses the third memory area, the protection unit 30 permits all reading, writing, and execution in the third memory area. Further, when the arithmetic unit 10 accesses the fourth memory area, the protection unit 30 permits writing and reading in the fourth memory area and prohibits execution. When the arithmetic unit 10 accesses a memory area other than the third memory area and the fourth memory area, the protection unit 30 reads, writes, and executes in the memory areas other than the third memory area and the fourth memory area. Ban all of. In this way, the protection unit 30 protects the storage unit 20 by defining access to the storage unit 30 by the arithmetic unit 10 according to the memory protection information stored in the register of the second bank 332 that has become valid. To do.

  Next, the case where the arithmetic unit of the comparative example shifts from the state in which the non-safety component is implemented to the state in which the safety component is executed will be described with reference to FIG. That is, the case where the component executed by the arithmetic unit 10 is switched from the non-safe component to the safe component will be described. In this case, the program counter 11 is rewritten from the value indicating the addresses B to C to the value indicating the addresses A to B.

  The bank switching unit 31 switches the bank in the valid state from the second bank 332 to the first bank 331 when the component to be executed is switched from the non-safe component to the safety component. At this time, the bank switching unit 31 switches the valid bank from the second bank 332 to the first bank 331 by writing the bank number indicating the first bank 331 into the bank number register 33a. That is, the bank switching unit 31 switches the bank that is hardware from the second bank 332 to the first bank 331. The first bank 331 is as described above.

  As a result, the access area can be in the same state as when rewritten from the third memory area and the fourth memory area to the first memory area and the second memory area. The processing area is the same as when the arithmetic unit 10 accesses the first memory area and is rewritten with data indicating read permission, execution permission, and write permission in the first memory area. It can be in the state of. Further, when the arithmetic unit 10 accesses the second memory area, the data in the other processing area is rewritten into data indicating permission of writing, permission of reading, and prohibition of execution in the second memory area. It can be in the same state as the case. Thus, the microcomputer 100 switches the memory protection information in hardware by switching the bank by the bank switching unit 31 when switching from the non-safety component to the safety component.

  As described so far, the microcomputer 100 can switch to the bank corresponding to the component to be executed simply by writing the bank number to the bank number register 33a when the component to be executed is switched. That is, the microcomputer 100 can protect the storage unit 20 by defining the access to the storage unit 20 by the arithmetic unit 10 only by writing the bank number corresponding to the component to be executed to the bank number register 33a. . The microcomputer 100 protects the storage unit 20 by defining access to the storage unit 20 by the arithmetic unit 10 according to the memory protection information stored in the plurality of registers.

  For example, as in the above-described example, the microcomputer 100 can protect the storage unit 20 only by writing the bank number in the bank number register 33a when the executed component is shifted from the safety component to the non-safety component. . Similarly, the microcomputer 100 can protect the storage unit 20 only by writing the bank number in the bank number register 33a when the executed component shifts from the non-safe component to the safe component.

  For this reason, since the microcomputer 100 does not need to rewrite a plurality of registers when the component to be executed is switched as in the above-described comparative example, overhead is reduced. That is, since the microcomputer 100 prepares a plurality of banks 331 to 33n corresponding to each component in advance and rewrites the bank number of the bank number register 33a, overhead is suppressed rather than rewriting the plurality of registers.

  It should be noted that various electronic control devices that electronically control on-board equipment are systems in which real-time characteristics are emphasized and the execution state of components frequently changes. Therefore, since the microcomputer 100 can suppress overhead as described above, the microcomputer 100 is preferably applied to an electronic control device in a vehicle. In particular, the microcomputer 100 is preferably applied to an electronic control device that electronically controls powertrain equipment. That is, the microcomputer 100 is suitable for achieving the real-time property required for such an electronic control device.

  The bank switching unit 31 may check the program counter 11 and execute the process shown in the flowchart of FIG. 3 only when the transition of the program counter 11 is discontinuous. That is, the specifying unit, the association unit, and the switching unit may be executed only when the transition of the program counter 11 is discontinuous.

  Note that the transition of the program counter 11 is continuous indicates that the arithmetic unit 10 sequentially executes the instructions stored in the storage unit 20 and the program counter 11 is uniformly added and updated. On the other hand, when the transition of the program counter 11 is non-continuous, the arithmetic unit 10 executes interrupt processing, task processing, and function processing, so that the program counter 11 has a specific address obtained as a result of instruction execution by the arithmetic unit 10. Indicates when it is updated. Therefore, the bank switching unit 31 does not execute the instructions stored in the storage unit 20 by the calculation unit 10 in order, but only when the calculation unit 10 executes interrupt processing, task processing, and function processing. In other words, the process shown in the flowchart of FIG. By doing in this way, since the bank switching unit 31 operates only when necessary, the power consumption of the microcomputer 100 can be reduced.

  Further, the component to be executed is specified (identifying means), the association between the component and the bank (associating means), and the bank switching (switching means) in the valid state can be realized by either hardware or software. It is possible.

  The preferred embodiments of the present invention have been described above. However, the present invention is not limited to the embodiments described above, and various modifications can be made without departing from the spirit of the present invention.

  DESCRIPTION OF SYMBOLS 10 Calculation part, 11 Program counter, 20 Memory | storage part, 30 Protection part, 31 Bank switching part, 32 Address table, 33 Register bank part, 33a Bank number register, 331-33n 1st bank-nth bank, 100 Microcomputer

Claims (4)

A processing device for executing software composed of a plurality of components,
A calculation unit (10) for performing calculation processing based on each component;
A storage unit (20) for storing data for calculation processing by the calculation unit;
A protection unit (30) for protecting the storage unit by defining access to the storage unit by the arithmetic unit;
The protective part is
A plurality of banks (331 to 33n) including a plurality of registers storing memory protection information including data indicating an address in the storage unit accessed by the arithmetic unit and data defining whether processing by the arithmetic unit is possible With
A bank number register (33a) in which a bank number indicating the bank to be enabled among the plurality of banks is written;
A specifying means (S10) for specifying the component that the calculation unit is going to execute;
Association means (S20) for associating the component identified by the identification means with the bank corresponding to the component in the plurality of banks on a one-to-one basis;
When the component to be executed is switched to the component specified by the specifying unit, the bank number indicating the bank associated by the association unit is written in the bank number register, thereby enabling the bank in the valid state. Switching means (S30, S40) for switching between,
The storage unit is protected by defining access to the storage unit by the arithmetic unit according to the memory protection information stored in the register of the bank that is enabled by the switching unit. Processing equipment. The arithmetic unit executes arithmetic processing according to a value of a program counter,
The processing apparatus according to claim 1, wherein the protection unit executes the specifying unit, the association unit, and the switching unit only when the transition of the program counter is discontinuous. The execution program in each component is stored at a predetermined address in the storage unit,
The specifying unit holds information indicating an address range of an execution program in each component stored in the storage unit, and refers to the information, and the execution unit of the execution program that the calculation unit is about to execute The processing apparatus according to claim 1, wherein the component to be executed by the arithmetic unit is specified depending on which address range an address in the storage unit is included in. The arithmetic unit executes arithmetic processing according to a value of a program counter,
The processing device according to claim 3, wherein the specifying unit determines an address in the storage unit of an execution program to be executed by the arithmetic unit based on a value of the program counter.

Images