JPH03141446A - Memory protection circuit - Google Patents

Abstract

PURPOSE:To improve the system safety by providing a storage means which sets a memory protection area based on a program of a microprocessor and a deciding means which decides the propriety of an access by reference to the storage means. CONSTITUTION:A CPU 11 is provided together with the supervisor programs 14 and 15, an address space 13, a memory control part 12 which limits the accesses, a storage means 18 for a memory protection range, and a deciding means 19 which decides the propriety of protection when an access is given to the space 13. When the program 14 gives an access with monopolization to an area 17 in the space 13, a protection range of the area 17 is first set to the means 18. No access is permitted to a set address area from the program 15 for a period during which the program 14 sets a protection range to the means 18 and cancels it. Thus the system safety is improved.

Description

DETAILED DESCRIPTION OF THE INVENTION [Field of Industrial Application] The present invention relates to a memory protection circuit, and particularly to a memory protection circuit in a multi-OS system in which a plurality of OSs can operate on a single processor.

[Conventional technology]

Conventional protection circuits separate the address space from the program space.
It is divided into 10 spaces, and access is protected using a different method for each space. FIG. 6 explains the conventional address space access protection function. In Figure 6, 3
1 is a microprocessor (hereinafter abbreviated as CPU), 32 is a memory control unit, and 33 is an address space. The I10 space 39 is set according to the memory-Malbutton I10 method, in which the I10 board can be regarded as the same as memory.

C: Supervisor program 34 running on PU 31
The same applies to the user program 35, in which when the program space 38 is accessed, the address conversion mechanism 36 in the memory control unit 32 determines whether access is possible, and if access is not possible, an exception 3H is generated. The minimum unit of access restriction is a page (-4KB unit for boat fishing).

Next, when the user program 35 running on the CPU 31 accesses the work/○ space 39, the memory control unit 32
The internal I10 protection mechanism 37 determines whether access is possible, and if access is not possible, an exception 3H is generated. Access to the supervisor program 34 is not restricted.

In recent years, multi-OS systems in which multiple OSs operate independently on a single CPU and multi-processor systems in which multiple CPUs share an address space have been developed.

In the above system, a plurality of supervisor programs exist, and conventional protection circuits cannot sufficiently protect the address space.

In particular, protection of the ■/○ space cannot be performed at all, so a system is generally adopted in which each supervisor program exclusively uses the entire I10 space. Although this method improves security, there are problems in terms of effective use of I10100.

In order to solve the above problems and improve system security and efficiency, more advanced address space protection is essential.

[Problem to be solved by the invention]

The above-mentioned conventional technology has a problem with system security because the address space cannot be sufficiently protected in the case of multiple OSs. In addition, in the method of protecting the entire I10 space depending on the level of the supervisor program, if a supervisor program disables access to I10100, other programs will be unable to access the entire I10 space, which reduces the effective use of address space and processing speed. There was a problem.

The present invention aims to provide a more advanced protection circuit in order to improve system safety, and also to provide a memory protection circuit with a flexible protection range in order to effectively utilize address space. do.

[Means to solve the problem]

FIG. 1 is a diagram showing the principle of a memory protection circuit according to the present invention to achieve the above object, where 11 is a CPU% 14
．． 15 is a supervisor program, 13 is an address space, 12 is a memory control unit that restricts access when the CPUI 1 accesses the address space 13, 18 is a storage means for storing the range of memory protection, 19 is a CPU II
When accessing the address space 13, the determination means determines whether or not the address can be protected based on the setting contents of the storage means 18. When the supervisor program 14 exclusively accesses the area 17 within the address space 13, the protection range of the area 17 is set in the storage means 18 before the access is made.

From the time the program 14 sets protection on the storage means 18 until the protection is released, the set address area is protected from being accessed by other supervisor programs, thereby improving the security of the system. .

Further, even while the supervisor program 14 protects the area 17, the supervisor program 15 can access any address space other than the area 17, thereby making effective use of the address space and improving processing speed. be able to.

[Effect]

In FIG. 1, supervisor programs 14 and 15 have unique program levels and operate independently.

When the program 14 wants to exclusively use the area 17, it sets the address and range of the area it wants to exclusively use in the storage means 18 in the memory control unit 12.

At this time, the hardware automatically adds the program level of the supervisor program 14 to the information.

In this state, if a certain program accesses the address space, the determination means 19 in the memory control unit 12
refers to the contents of the storage means 18 and determines whether or not access is possible according to FIG. 2 (accessibility determination table).

As can be seen from FIG. 2, an exception is generated only when the access address is within the set range and the program level does not match, so resources can be used effectively and the safety of the entire system is improved.

〔Example〕

An embodiment of the present invention will be described below with reference to FIG.

FIG. 3 shows a multi-OS system, and the program level of each CPU 21 is level (1).

Supervisor program 1 (hereinafter referred to as level (2))
5VP1), supervisor program 2 (hereinafter referred to as 5
(abbreviated as VP2).

The address space register 24 includes a program level field 24a, a start address field 24b, an end address field 24c, and a valid bit field 24.
The inputs of the first address field 24b, the last address field 24c and the valid bit 24d are connected to the data bus 22b, and the inputs of the first address field 24b, the last address field 24c and the valid bit 24d are The output is connected to a comparison/judgment circuit 23.

The program level signal 29b from the CPU 21 is connected to the input of the program level field 24a and the comparison/judgment circuit 23, and the output of the program level field 24a is connected to the comparison/judgment circuit 23.

The input of the address latch 26 is connected to the address bus 22a, and the output of the address latch 26 is connected to the input of the comparison/judgment circuit 23 and gate 28a. Further, the input of the data latch 27 is connected to the data bus 22b, and the output of the data latch 27 is connected to the input of the gate 28c.

Gate opening/closing signal 2 output from the comparison/judgment circuit 23
9c is the control input of the gate 28a and the gate 2
8c, and the output of the gate 28a is connected to the address bus 22c, and the output of the gate 28a is connected to the control input of the gate 28C.
The output of is connected to data bus 22d.

Address space 25 is connected to the address bus 22c and the data bus 22d.

The access target of the address space 25 is determined by the address instructed by the CPU 21.

Next, the operation will be explained. The 5VPI 21a is the address area 25a (for example, ~1) of the address space 25.
In order to exclusively access the 5VPI 21
a sets the start address k in the start address field 24b in the address space register 24, sets the end address 1 in the end address field 24c, and sets a valid bit "1" in the valid bit field 24d.
Set. At the same time, the program level "1" of 5VP1, which is the content of the program level signal 29b from the CPU 21, is in the program level field 24a.
is set to

First, in a state where the address area 25a of the address space 25 is occupied by the 5VP1,
A case in which VP2 accesses the address space 25 will be explained.

5VP2 is a specific address 2 outside the address area 25a.
When it is the turn to output data to 5b, the specific address 25b
address m is set in the address latch 26 via the address bus 22a, and output data is set in the data latch 27 via the data bus 22b. Since the value of the valid bit field of the address space register 24 is "1", the comparison judgment circuit 23 determines whether the program level field 24 is
It is confirmed that the value “1” of a, the value “k” of the first address field 24b, and the value “l” of the last address 24C are valid, and the value “m” of the address latch 26 is
'' is compared with the value "k" of the first field 24b and the value "l" of the last address 24C. As a result, since the address m of the specific address 25b is outside the range of the address area 25a, the gate open/close signal 29c becomes "1", the gate 28a and the gate 28c are opened, and the address latch 26 is opened. The output is propagated to the address bus 22c, and the output of the data latch 27 is propagated to the data bus 22d.

Next, when 5VP2 outputs data to the specific address 25c in the address area 25a, the address n of the specific address 25c is set in the address latch 26, and the value IIn'' of the address latch 26 is set in the address latch 26, as described above.
compares the value "k" of the start address field 24b and the value "l" of the end address field 24c. As a result, since the address n of the specific address 25c is within the range of the address area 25a, the exception signal 29a from the comparison/judgment circuit 23 becomes "1", notifying the CPU 21 of the occurrence of an exception. At this time, the gate opening/closing signal 29c becomes "0°", and the gate 28a
And the gate 28c is closed.

When 5vpi accesses the address space 25,
The comparison/judgment circuit 23 compares the content "1" of the program level signal 29b from the CPU 21 with the value "1" of the program level field 24a, and when the results are the same, the gate open/close signal 29c is output. “
1'' and open the gates 28a and 28c.

At this time, it is determined by the gate opening/closing signal 29 whether the address to be accessed is within the range of the address area 25a or outside the range.
It does not affect the state of c.

FIG. 4 shows details of the comparison and determination circuit 23. The program level signal 29b and the output of the program level field 24a are connected to the input of the 6-level determination circuit 42, which is a comparison circuit section 41 corresponding to one entry of the address space register 24. The output is connected to AND gate 46.

The output of the address latch 26 and the output of the start address field 24b are connected to the input of the start address determination circuit 43, and the output of the start address determination circuit 43 is connected to an AND gate 45. The output of the address latch 26 and the output of the end address field 24c are connected to the input of the end address determination circuit 44, and the output of the end address determination circuit 44 is connected to the AND gate 45.
connected to the remaining inputs of Also, the output of the AND gate 45 is connected to the remaining input of the AND gate 46,
The output of the AND gate 46 and the output of the valid bit field 24d are connected to the input of an AND gate 47.

The output of the AND gate 47 is connected to an OR gate 48 and an AND gate 49, the output of the OR gate 48 is connected to the CPU 21 as the exception signal 29a, and the output of the AND gate 49 is connected as the gate opening/closing signal 29c. , connected to the gate 28a and the gate 28C. The remaining inputs of the OR gate 48 and the A
The remaining inputs of the N and D gates 49 are connected to the comparator circuit section 4.
A signal group 4d output from a circuit equivalent to 1 is connected.

Next, the operation shown in FIG. 4 will be explained. The level determination circuit 42
compares the contents of the program level signal 29b and the program level field 24a, and if they match, makes the output of the level determination circuit 42 active (°1'').

The head address determination circuit 43 is connected to the address latch 2.
6 and the contents of the first address field 24b, and if the contents of the address latch 26 are larger than the contents of the first address field 24b, the output of the first address determination circuit 43 is activated (“1”).
Make it. Further, the end address determination circuit 44 compares the contents of the address latch 26 and the end address field 24.
If the contents of the address latch 26 are smaller than the contents of the end address field 24c, the output of the end address determination circuit 44 is activated ("1").

The output 4e of the AND gate 46 is determined as shown in the truth table of FIG. 5, and when the output is "1" and the valid bit field 24d is "1", the output of the AND gate 47 is "1".
O”, and the output 29a of the OR gate 48 (exception signal)
becomes "1" and notifies the CPU 21 of the occurrence of an exception.

When the output 4e of the AND gate 46 is "0", the output of the AND gate 47 is "1", and when the signal group 4d is all "1", the output 29 of the AND gate 49 is "1".
c (gate opening/closing signal) becomes “°1” and the gate 28
a and 28c are opened.

〔Effect of the invention〕

According to the present invention, the protected area covers the entire address space.
Since it can be specified with a variable length, the address space can be used effectively in multi-OS systems where there is a high possibility that multiple programs will access the address space at the same time, and this has the effect of improving the security of the system.

[Brief explanation of the drawing]

Fig. 1 is a diagram showing the principle of an embodiment of the present invention, Fig. 2 is a diagram illustrating access permission determination, Fig. 3 is a block diagram of an embodiment of the invention, and Fig. 4 is a detailed diagram of the comparison judgment circuit. 5 is a diagram showing the truth value of the signal 4e, and FIG. 6 is a diagram showing a conventional memory protection circuit. 17...Protected area, 18...Storage means, 19...
Judgment means, 23... Comparison/judgment circuit, 24... Address space register

Claims (1)

[Scope of Claims] 1. A memory protection circuit for a multi-OS system that is composed of a microprocessor and a memory that stores programs and data executed by the microprocessor, and in which a plurality of OSs can operate independently, comprising: 1. A memory protection circuit comprising a storage means for setting a memory protection area according to a program of a processor, and a determination means for referring to said storage means and determining whether or not access is possible. 2. The memory protection circuit according to claim 1, wherein said determining means is capable of applying access protection to an arbitrary address range set in said storage means.