JP2016081291A - Access inspection apparatus and information processing system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To prevent an access error due to software, with small-scale circuit configuration.SOLUTION: An access inspection apparatus 5 manages an address value of a target instruction specified as an instruction to be executed in accessing a device 7, as a target address value. The access inspection apparatus 5 receives an address value of the instruction to be executed by a processor 1, as a program counter value, and holds the received program counter value. When the processor executes one of the target instruction and an instruction other than the target instruction, to access the device 7, the access inspection apparatus 5 determines whether the held program counter value coincides with the target address value, and allows the processor 1 to access the device 7 when the program counter value coincides with the target address value, or prohibits the processor 1 from accessing the device 7 when the program counter value does not coincide with the target address value.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a technique for checking access from a processor to a device.

As a protection function against an S / W (Software) error, there are a memory protection device using an MMU (Memory Management Unit) and a memory protection technology realized by S / W.
However, when the MMU is used, an OS (Operating System) is required, and there is a problem that it cannot be used in a system in which task switching overhead is large and real-time performance is required.
Also, the realization method by S / W has a problem that overhead occurs in the processing and the real-time property is also lowered.

  For example, in the computer system shown in Patent Document 1, a bus for process ID (Identifier) data communication is provided, and when the bus master designates the address of the bus slave and reads and writes data, the bus master By receiving the process ID issued by the bus slave and determining whether it is a process ID allowing access, erroneous access is prevented without using an OS and ensuring real-time performance.

JP 2010-250470 A

However, in the case of Patent Document 1, there is a problem that the wiring resources for the process ID bus connection increase, leading to an increase in chip area and a decrease in operating frequency.
For example, when several tens of process IDs are required, about six bus connections are connected to a large number of peripheral I / O (Input / Output) devices.

  The main object of the present invention is to solve the above-mentioned problems, and it is a main object of the present invention to prevent erroneous access due to S / W with a small circuit configuration.

The access inspection apparatus according to the present invention is:
An access inspection device for inspecting access from a processor to a device,
A target address value management unit that manages, as a target address value, an address value of a target instruction that is designated as an instruction executed when accessing the device;
A program counter value holding unit that receives an address value of an instruction to be executed by the processor as a program counter value and holds the received program counter value;
When the processor executes either the target instruction or an instruction other than the target instruction to access the device, the program counter value of the program counter value holding unit is changed to the target address value management unit. It is determined whether or not it matches a target address value, and when the program counter value matches the target address value, the processor is allowed to access the device, and the program counter value and the target address value are And an access determination unit that prohibits access to the device by the processor when they do not match.

In the present invention, access to the device is prohibited when the program counter value does not match the permitted address value.
Therefore, according to the present invention, erroneous access to a device due to S / W abnormality can be prohibited with a small circuit configuration.

1 is a schematic diagram illustrating a configuration example of an information processing system according to a first embodiment. 3 is a flowchart showing an outline of operation according to the first embodiment. 3 is a diagram illustrating an example of a memory space of the information processing system according to Embodiment 1. FIG. 6 is a diagram illustrating an example of a PC value access permission area of peripheral I / O according to Embodiment 1. FIG. 6 is a schematic diagram illustrating a configuration example of an information processing system according to Embodiment 2. FIG. 10 is a flowchart showing an outline of operation according to the second embodiment. FIG. 10 is a diagram illustrating an example of a memory space of an information processing system according to a third embodiment. FIG. 10 is a diagram illustrating an example of a PC value access permission area of peripheral I / O according to the third embodiment. 1 is a schematic diagram illustrating a configuration example of an access inspection apparatus according to Embodiment 1. FIG.

Embodiment 1 FIG.
In this embodiment and the following embodiments, an error caused by S / W that can flexibly cope with increase / decrease in peripheral IO by using a small circuit and a minimum (one) bus wiring. An information processing system capable of preventing occurrence of access and detecting occurrence of erroneous access will be described.

*** Explanation of configuration ***
FIG. 1 is a block diagram of an information processing system 100 according to the present embodiment.
The information processing system according to the present embodiment includes a processor 1, a device 6 including an access inspection device 5, a device 7 including the access inspection device 5, an instruction acquisition timing pulse signal bus 2, an address bus 3, and a data bus 4. Consists of.
The processor 1 is, for example, a CPU (Central Processing Unit).
The device 6 is a memory, for example.
The device 7 is, for example, a peripheral I / O device (hereinafter also simply referred to as a peripheral I / O).

The processor 1 accesses the device 6 or the device 7.
When accessing the device 6, the processor 1 executes an instruction for accessing the device 6.
Further, when accessing the device 7, the processor 1 executes an instruction for accessing the device 7.
Prior to execution of an instruction, the processor 1 outputs the address of the instruction to be executed to the address bus 3 as a program counter value (hereinafter also referred to as a PC value).

The access inspection apparatus 5 inspects access from the processor 1 to the device 6 or the device 7.
Below, the access inspection apparatus 5 included in the device 7 will be described as a representative, but the same applies to the access inspection apparatus 5 included in the device 6.
The access inspection device 5 has, for example, a circuit configuration shown in FIG.
In FIG. 9, the target address value management unit 501 manages the address value of the target instruction specified as an instruction executed when accessing the device 7 as the target address value.
The target address value is also referred to as a PC value access permission area.
The PC value holding unit 502 receives an address value of an instruction to be executed by the processor 1 as a program counter value, and holds the received program counter value.
When the processor 1 executes either the target instruction or an instruction other than the target instruction to access the device 7, the access determination unit 503 displays the program counter value of the PC value holding unit 502 as the target address value management unit. It is determined whether or not it matches the target address value of 501.
When the program counter value matches the target address value, the access determination unit 503 permits the processor 1 to access the device 7.
On the other hand, when the program counter value does not match the target address value, the access determination unit 503 prohibits the processor 1 from accessing the device 7.
The access determination unit 503 permits or prohibits access to the device 7 by controlling write enable or read enable.

The instruction acquisition timing pulse signal bus 2 is a bus for outputting an instruction acquisition timing pulse signal from the processor 1 to the access inspection device 5.
The instruction acquisition timing pulse signal is a pulse signal for notifying the timing of outputting the program counter value from the processor 1 to the access inspection device 5.

  The address bus 3 is a bus for communicating address information between the processor 1 and the access checking device 5.

  The data bus 4 is a bus for communicating data between the processor 1 and the access checking device 5.

*** Explanation of operation ***

Next, an operation example of the information processing system according to the present embodiment will be described.
FIG. 2 is a flowchart showing an outline of the operation of the information processing system according to the present embodiment.

Since it is necessary to acquire an instruction constituting the program when executing the program, the processor 1 outputs an address value indicating the position of the instruction to the address bus 3 as a PC value (step 102).
That is, the processor 1 outputs the address value of the instruction to be executed as a PC value.
At the same time, the processor 1 outputs an instruction acquisition timing pulse signal to the instruction acquisition timing pulse signal bus 2 (step 102).

Each access inspection device 5 (bus slave) receives the instruction acquisition timing pulse signal output from the processor 1, latches the PC value with the address bus 3 using the received instruction acquisition timing pulse signal, and acquires the PC value. (Step 103).
That is, the PC value holding unit 502 in the access inspection apparatus 5 receives the PC value and holds the received PC value.

Consider a case where the processor 1 accesses the outside based on a program acquired from the device 6 (memory).
At this time, the processor 1 outputs the access destination address to the address bus 3 (step 104).
In each access inspection device 5 (bus slave), the access determination unit 503 determines whether it is an access to itself based on this address value (step 105).
Specifically, the access determination unit 503 of the access inspection apparatus 5 in the device 6 determines whether or not the access from the processor 1 is an access to the device 6.
Further, the access determination unit 503 of the access inspection apparatus 5 in the device 7 determines whether or not the access from the processor 1 is an access to the device 7.

If it is not an access to itself, the access determination unit 503 of the access checking device 5 (bus slave) does not process anything (step 105: NO).
If the access is to itself (step 105: YES), the access determination unit 503 of the access inspection device 5 (bus slave) determines whether the PC value is appropriate (step 106).
That is, the access determination unit 503 determines whether the PC value latched by the instruction acquisition timing pulse signal output from the processor 1 is an address value at which an instruction appropriate for access to itself is stored. The determination is made by collating with the PC value access permission area (target address value) of the holding unit 502.
If the PC value is appropriate (step 106: YES), the access determination unit 503 of the access checking device 5 (bus slave) permits access from the processor 1 (step 107).
If the PC value is not appropriate (step 106: NO), the access determination unit 503 of the access inspection device 5 (bus slave) prohibits access from the processor 1 (step 108).

FIG. 3 is a diagram illustrating an example of a memory space of the information processing system according to the first embodiment.
FIG. 4 is a diagram illustrating an example of a PC value access permission area owned by the target address value management unit 501 in the access inspection device 5 of the device 7 (peripheral I / O) according to the first embodiment.
According to FIGS. 3 and 4, since the PC value access permission area owned by the target address value management unit 501 of the access inspection device 5 of the device 7 is 1000 to 1003, the access is performed only when the access is from the process A1. Permit and prohibit access from others.

That is, an instruction corresponding to the process A1 (hereinafter referred to as instruction A1) is designated as an instruction executed when accessing the device 7 (peripheral I / O).
Instruction A1 is stored at addresses 1000 to 1003 in the memory space.
In the access inspection device 5 of the device 7 (peripheral I / O), the target address value management unit 501 stores addresses 1000 to 1003 that are addresses of the instruction A1 (FIG. 4).
The processor 1 needs to execute the instruction A1 in order to access the device 7 (peripheral I / O).
When executing the instruction A1, the processor 1 outputs the addresses 1000 to 1003 in which the instruction A1 is stored as the PC value to the address bus 3 (step 102 in FIG. 2).
The access inspection device 5 of the device 7 (peripheral I / O) and the access inspection device 5 of the device 6 (memory) each acquire a PC value from the address bus 3 and store it in the PC value holding unit 502 (FIG. 2). Step 103).
The processor 1 executes the instruction A1, outputs the address of the device 7 (peripheral I / O) to the address bus 3, and accesses the device 7 (peripheral I / O) (steps 104 and 105 in FIG. 2). .
In the access inspection device 5 of the device 7 (peripheral I / O), the access determination unit 503 compares the addresses 1000 to 1003 acquired in step 103 with the address values shown in FIG. 4 and determines that they match. The access from the processor 1 is permitted (step 106 and step 107 in FIG. 2).

On the other hand, when the processor 1 executes an instruction corresponding to the process B1 (hereinafter referred to as instruction B1) in order to access the device 6 (memory), the processor 1 has an address 2000 to 2003 where the instruction B1 is stored. Is output to the address bus 3 as a PC value (step 102 in FIG. 2).
The access inspection device 5 of the device 7 (peripheral I / O) and the access inspection device 5 of the device 6 (memory) each acquire a PC value from the address bus 3 and store it in the PC value holding unit 502 (FIG. 2). Step 103).
The processor 1 originally executes the instruction B1 to access the device 6 (memory). However, when the processor 1 accesses the device 7 (peripheral I / O) by executing the instruction B1 due to an S / W error ( In steps 104 and 105 in FIG. 2, in the access inspection apparatus 5 of the device 7 (peripheral I / O), the access determination unit 503 compares the addresses 2000 to 2003 acquired in step 103 with the address values in FIG. Then, it is determined that they do not match, and access from the processor 1 is prohibited (step 106 and step 108 in FIG. 2).

*** Explanation of effects ***
As described above, in the present embodiment, the access inspection device 5 acquires a PC value using the instruction acquisition timing pulse signal, and when the processor 1 accesses the program, the PC value is appropriate for access to itself. Is not stored, the access is prohibited when it is not appropriate, and the access is permitted only when it is appropriate.
Thereby, it is possible to prevent erroneous access due to an S / W error with a simple configuration.
Further, when an erroneous access occurs, an S / W error can be identified by referring to a PC value stored as error information in the access inspection apparatus.

As described above, the device 6 and the device 7 according to the present embodiment are
PC value is acquired by latching the address bus 3 using an instruction acquisition timing pulse signal that conveys the timing when the processor 1 acquires an instruction from the device 6;
When accessed from the program,
It is determined by checking whether or not the previously obtained PC value is an address value in which a program suitable for access to itself is stored, by comparing with one PC value access permission area owned by itself,
Access is prohibited when it is not appropriate,
It has been described that the access checking device 5 that permits access only when appropriate is provided.
The processor 1 according to the present embodiment acquires an instruction sequence stored in the device 6 and performs data processing according to the instruction. The address bus 3 determines an access destination when the processor 1 transmits and receives data. The data bus 4 is used for transferring data transmitted and received by the processor 1.

Embodiment 2. FIG.
*** Explanation of configuration ***
Hereinafter, an information processing system according to the second embodiment will be described with reference to FIGS.
FIG. 5 is a block diagram of an information processing system according to the second embodiment.
In FIG. 5, the processor 8 is the same as the processor 1, the instruction acquisition timing pulse signal bus 9 is the same as the instruction acquisition timing pulse signal bus 2, the address bus 10 is the same as the address bus 3, and the data bus 11 is The same as the data bus 4.
The access inspection device 12 is the same as the access inspection device 5, the device 13 is the same as the device 6, and the device 14 is the same as the device 7.
In the information processing system according to the second embodiment, an interrupt generation device 15 is added as compared with the information processing system according to the first embodiment.
The interrupt generation device 15 generates an interrupt to the processor 8 when an abnormal access to the device 13 or the device 14 is notified from the access inspection device 12, and the processor 8 is notified of the abnormal access to the device 13 or the device 14. Notice.
The internal configuration of the access inspection device 12 is as shown in FIG.
Hereinafter, differences from the first embodiment will be mainly described.
Matters not described below are the same as those in the first embodiment.

*** Explanation of operation ***
Next, the operation of the information processing system according to this embodiment will be described.
FIG. 6 is a flowchart showing an outline of the operation of the information processing system according to the present embodiment.

  The operations of Step 202 to Step 205, Step 206, and Step 207 are the same as Step 102 to Step 105, Step 106, and Step 107 of the flowchart shown in FIG.

When the PC value is not appropriate (step 206: NO), the access determination unit 503 of the access check device 12 (bus slave) does not permit access from the processor 8 and sends the acquired PC value to the interrupt generation device 15. The abnormal access is notified by outputting (step 208).
The interrupt generation device 15 generates an abnormality detection interrupt to the processor 8 and notifies the processor 8 of the occurrence of abnormal access (step 209).

*** Explanation of effects ***
As described above, in this embodiment, when an abnormal access is notified from the access inspection device 12, the interrupt generation device 15 generates an abnormality detection interrupt to the processor 8 and notifies the processor 8 of the occurrence of an erroneous access. it can.

Embodiment 3 FIG.
In the third embodiment, in the information processing system according to the first embodiment or the information processing system according to the second embodiment, an example in which there are a plurality of PC value access permission areas (target address values) owned by the access inspection device will be described. To do.
Hereinafter, differences from the first embodiment and the second embodiment will be mainly described.
Matters not described below are the same as those in the first or second embodiment.

FIG. 7 shows an example of a memory space of the information processing system according to the third embodiment.
FIG. 8 is a diagram illustrating an example of a PC value access permission area owned by the access checking apparatus according to the third embodiment.
In FIG. 7, the address value of the instruction corresponding to the process A1 (hereinafter referred to as instruction A1) is addresses 1000 to 1003, and the address value of the instruction corresponding to the process A2 (hereinafter referred to as instruction A2) is as address 3000 to 3003. is there.
According to FIG. 8, the target address value management unit 501 stores addresses 1000 to 1003 and addresses 3000 to 3001 as PC value access permission areas (target address values).
For this reason, the access determination unit 503 according to the present embodiment permits access based on the instructions A1 and A2, and prohibits access based on other instructions.

As described above, in the access inspection apparatus according to this embodiment, the target address value management unit 501 manages two or more target address values of two or more target instructions.
Further, the access determination unit 503 determines whether the PC value matches one of two or more target address values, and when the PC value matches any one of the target address values, the access determination unit 503 transfers the device to the device. Access to the device is prohibited when the PC value does not match any of the target address values.

  Thus, according to the present embodiment, it is possible to determine whether or not access is appropriate for a plurality of instructions by having the plurality of PC value access permission areas.

Embodiment 4 FIG.
In the information processing system according to the fourth embodiment, the PC value access permission area possessed by the access inspection device is programmable.
That is, in the present embodiment, the target address value managed by the PC value holding unit 502 can be changed.
Except that the target address value is programmable, it is the same as that shown in the first to third embodiments.

According to the present embodiment, by making the PC value access permission area programmable, each access checking device determines whether access is permitted or not according to the increase or decrease even if the peripheral I / O or the memory space increases or decreases. can do.
Further, even if the instruction executed when the processor accesses the device is changed, each access checking device can determine whether access is permitted or not in accordance with the change.

As mentioned above, although embodiment of this invention was described, you may implement in combination of 2 or more among these embodiment.
Alternatively, one of these embodiments may be partially implemented.
Alternatively, two or more of these embodiments may be partially combined.
In addition, this invention is not limited to these embodiment, A various change is possible as needed.

1 processor, 2 instruction acquisition timing pulse signal bus, 3 address bus, 4 data bus, 5 access inspection device, 6 devices, 7 devices, 8 processor, 9 instruction acquisition timing pulse signal bus, 10 address bus, 11 data bus, 12 Access inspection device, 13 device, 14 device, 15 interrupt generation device, 100 information processing system, 501 target address value management unit, 502 PC value holding unit, 503 access determination unit.

Claims (4)

An access inspection device for inspecting access from a processor to a device,
A target address value management unit that manages, as a target address value, an address value of a target instruction that is designated as an instruction executed when accessing the device;
A program counter value holding unit that receives an address value of an instruction to be executed by the processor as a program counter value and holds the received program counter value;
When the processor executes either the target instruction or an instruction other than the target instruction to access the device, the program counter value of the program counter value holding unit is changed to the target address value management unit. It is determined whether or not it matches a target address value, and when the program counter value matches the target address value, the processor is allowed to access the device, and the program counter value and the target address value are And an access determination unit that prohibits access to the device by the processor when they do not match. The target address value management unit
Manages two or more target address values of two or more target instructions,
The access determination unit
It is determined whether the program counter value matches any one of the two or more target address values, and when the program counter value matches any target address value, The access inspection apparatus according to claim 1, wherein access is permitted and access to the device by the processor is prohibited when the program counter value does not match any target address value.   The access inspection apparatus according to claim 1, wherein the target address value managed by the target address value management unit can be changed. An access inspection device for inspecting access from the processor to the device;
An information processing system having an interrupt generation device for generating an interrupt to the processor,
The access inspection device includes:
A target address value management unit that manages, as a target address value, an address value of a target instruction that is designated as an instruction executed when accessing the device;
A program counter value holding unit that receives an address value of an instruction to be executed by the processor as a program counter value and holds the received program counter value;
When the processor executes either the target instruction or an instruction other than the target instruction to access the device, the program counter value of the program counter value holding unit is changed to the target address value management unit. It is determined whether or not it matches a target address value, and when the program counter value matches the target address value, the processor is allowed to access the device, and the program counter value and the target address value are An access determination unit for prohibiting access to the device by the processor and notifying the interrupt generation device of abnormal access to the device, if they do not match,
The interrupt generator is
An information processing system that, when an abnormal access to the device is notified from the access inspection apparatus, generates an interrupt to the processor and notifies the processor of the abnormal access to the device.

Images