Data processing device and memory protection method

Abstract

The present application relates to a data processing device and a memory protection method. The data processing device includes: a memory protection setting storage unit capable of storing a plurality of address parts as memory protection setting targets; a plurality of first determination units provided for each address part stored in the memory protection setting storage unit, and temporarily determining whether to allow the access request based on whether the access destination address specified by the access request corresponds to the address part obtained from the memory protection setting storage unit; and a second determination unit that finally determines whether to allow the access request based on classification information of the first determination unit and a result of the temporary determination.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] The entire disclosure of Japanese Patent Application No. 2018-115176 filed on June 18, 2018 including the specification, drawings and abstract is incorporated herein by reference. Technical Field

[0003] The present invention relates to a data processing device and a memory protection method, and can be applied to, for example, a data processing device in which a virtual machine operates. Background Art

[0004] Virtualization technology is referred to as a technology for building a virtual machine on a physical machine. In this virtualization technology, the virtual machine runs on management software called a virtual machine monitor. In a data processing device that incorporates virtualization technology, there may be two types of memory protection. One is memory protection set by a virtual machine monitor. The other is memory protection set by a virtual machine, more specifically, memory protection set by a program (e.g., an operating system) executed on the virtual machine.

[0005] In this regard, Japanese Patent Application No. 2016-509303 discloses a microprocessor core having a first MPU (memory protection unit) and a second MPU. Summary of the invention

[0006] In the microprocessor core described in Japanese Patent Application No. 2016-509303, when implementing the above two types of memory protection, the virtual machine uses the first MPU and the virtual machine monitor uses the second MPU. Here, the number of entries used in the first MPU and the number of entries used in the second MPU both depend on the virtual machine to be operated. That is, for example, when different virtual machines are operated sequentially in a time-division manner on a physical machine, the number of entries used in the first MPU and the number of entries used in the second MPU vary depending on which virtual machine is operating. Therefore, it is necessary to statically set the maximum number of entries used in the first MPU for each virtual machine operating on the physical machine to the number of entries of the first MPU when manufacturing the physical machine. Similarly, it is necessary to statically set the number of entries of the second MPU in consideration of each virtual machine that will operate on the physical machine when manufacturing the physical machine. In other words, the number of entries of the first MPU and the number of entries of the second MPU must both be the maximum number to be used. This leads to an increase in circuit scale.

[0007] According to one embodiment, a data processing device includes: a memory protection setting storage unit, which is capable of storing multiple address parts; multiple first determination units, which temporarily determine whether to allow an access request, and classification information determines whether each address part stored in the memory protection setting storage unit is for memory protection set by a virtual machine monitor or for memory protection set by a virtual machine; and a second determination unit, which finally determines whether to allow the access request based on the result of each temporary determination of each first determination unit.

[0008] According to the above-described embodiments, it is possible to realize a memory protection function set by a virtual machine monitor and a memory protection function set by a virtual machine while suppressing an increase in circuit scale. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] Figure 1 is a schematic diagram showing two types of memory protection in a data processing apparatus incorporating virtualization technology.

[0010] Figure 2 is a diagram showing the number of entries per MPU when two types of memory protection are implemented using two MPUs.

[0011] Figure 3 is a diagram showing the number of entries when two types of memory protection are implemented using one MPU.

[0012] Figure 4 is a block diagram showing a configuration example of a data processing device according to an overview of the embodiment.

[0013] Figure 5 is a block diagram of a configuration example of a data processing apparatus according to the first embodiment.

[0014] Figure 6 is a diagram showing an example of information stored in each entry in the MPU entry block.

[0015] Figure 7 is a block diagram illustrating an example of a configuration of a memory protection authority determination unit.

[0016] Figure 8 is a block diagram showing a configuration example of a final access determination unit according to the first embodiment.

[0017] Fig. 9 is a block diagram showing a configuration example of an entry register access right determination unit.

[0018] Fig.10 is a block diagram showing a configuration example of a setting register access right determination unit.

[0019] Fig.11is a block diagram showing a configuration example of a data processing apparatus according to the second embodiment.

[0020] Fig.12 is a block diagram showing a configuration example of a final access determination unit according to the second embodiment.

[0021] Fig.13 is a table showing an example of a relationship between host violation information and guest violation information received by the processing circuitry and violation information maintained by the processing circuitry.

[0022] Fig.14 is a table showing an example of a relationship between host violation information and guest violation information received by a processing circuit and a machine where an abnormality has occurred.

[0023] Fig.15 is a block diagram showing a configuration example of a data processing apparatus according to the third embodiment.

[0024] Fig.16 is a schematic diagram showing switching of setting information executed by an instruction of a virtual machine monitor.

[0025] Fig.17 is a schematic diagram showing the switching of setting information performed by appropriate instructions of the virtual machine.

[0026] Fig.18 is a schematic diagram showing switching of setting information executed by an inappropriate instruction on a virtual machine.

[0027] Fig.19 is a block diagram showing a configuration example of a final access determination unit according to the fourth embodiment. DETAILED DESCRIPTION

[0028] For the purpose of clear explanation, the following description and drawings are appropriately omitted and simplified. In the drawings, the same elements are represented by the same reference numerals, and their repeated description is omitted as necessary.

[0029] Before describing the embodiment, first, matters considered by the inventors regarding the embodiment will be described.

[0030] Figure 1 is a schematic diagram showing two types of memory protection in a data processing device incorporating virtualization technology. In virtualization technology, Figure 1 As shown, a virtual machine monitor 91 (also called a hypervisor) runs on a physical machine such as a CPU (central processing unit) 90. For example, virtual machines 92_1 and 92_2 are implemented on the virtual machine monitor 91. In each virtual machine, an OS and application software are installed. In some cases, an OS is not installed, and only application software is installed. Figure 1In the illustrated example, OS 920_1 and application software 921_1 are executed in virtual machine 92_1, and OS 920_2 and application software 921_2 and 921_3 are executed in virtual machine 92_2.

[0031] In a data processing apparatus incorporating such a virtualization technology, there may be memory protection set by a virtual machine (virtual machine 92_1 or virtual machine 92_2) and memory protection set by a virtual machine monitor 91. Figure 1 In , memory protection 95_1 and memory protection 95_2 are memory protections set by the virtual machine. Memory protection 95_1 is memory protection for preventing interference between application software in the virtual machine, and memory protection 95_2 is memory protection for preventing interference from application software to the OS. Figure 1 Memory protection 95_3 and memory protection 95_4 are memory protections set by the virtual machine monitor. Memory protection 95_3 is memory protection for preventing interference between virtual machines, and memory protection 95_4 is memory protection for preventing interference from the virtual machine to the virtual machine monitor.

[0032] Figure 2 is a diagram showing the number of entries per MPU when two types of memory protection are implemented using two MPUs. Figure 2 In the first MPU ( Figure 2 The MPU 1 in the example is an MPU for the memory protection function of the virtual machine, and the second MPU ( Figure 2 The MPU2 in FIG. 2 is an MPU used for the memory protection function of the virtual machine monitor. Figure 2 In the illustrated embodiment, four types of virtual machines, namely VM0, VM1, VM2 and VM3, operate in this order.

[0033] Here, in particular, at the time of operation of VM1, the memory protection of the virtual machine can be fully realized only by the memory protection of the virtual machine, so that the memory protection of the virtual machine monitor is not required. For this reason, many entries are required in MPU1 when VM1 is operating, but the number of entries required in MPU2 is 0. For example, this occurs when an operating system that provides a memory protection function that is highly reliable for the virtual machine monitor is executed on VM1. In addition, since there is no memory protection by the virtual machine during the operation of VM2, only the virtual machine monitor must perform memory protection. Therefore, during the operation of VM2, the number of entries required in MPU1 is zero, but the number of entries required in MPU2 is large. For example, this occurs when control software that does not have a memory protection function is executed on VM2.

[0034] like Figure 2As shown, the number of entries required for MPU1 and the number of entries required for MPU2 are not constant. Here, it is assumed that the number of entries required in MPU1 when VM1 is operating is N1, and the number of entries required in MPU2 when VM2 is operating is N2. Figure 2 As shown, when the number of entries of MPU1 is designed to be N1, there are remaining entries when virtual machines other than VM1 operate. Similarly, when the number of entries of MPU2 is designed to be N2, there are remaining entries when virtual machines other than VM2 operate.

[0035] on the other hand, Figure 3 FIG. 2 is a diagram showing the number of entries when two types of memory protection are implemented using one MPU. Figure 3 As shown, an effective configuration can be achieved by using the following entries: the entries are used for the memory protection function of the virtual machine or the memory protection function of the virtual machine monitor at a certain time, and can also be used for other memory protection functions at other times. In this case, for example, the number of entries to be provided in the MPU can be N3, which is less than the sum of N1 and N2. In the embodiments described below, a technique for implementing such dynamic entry setting will be described.

[0036] Before describing the embodiment in detail, an outline of the embodiment will be described. Figure 4 1 is a block diagram showing an example of the configuration of a data processing device 1 according to an overview of the embodiment. Figure 4 As shown, the data processing device 1 includes a memory protection setting storage unit 2 , a first determination unit 3 and a second determination unit 4 .

[0037] The memory protection setting storage unit 2 is a storage unit capable of storing a plurality of address portions for which memory protection is to be set. Here, the address portion stored in the memory protection setting storage unit 2 may be an address portion to which access is permitted or an address portion to which access is prohibited. For example, when access to the memory is prohibited by default, that is, when access is prohibited in principle, memory protection is achieved by setting an address portion to which access is permitted. In this case, the address portion stored in the memory protection setting storage unit 2 is an address portion to which access is permitted. Similarly, when access to the memory is permitted by default, that is, when access is permitted in principle, memory protection is achieved by setting an address portion to which access is prohibited. In this case, the address portion stored in the memory protection setting storage unit 2 is an address portion to which access is prohibited.

[0038] The memory protection setting storage unit 2 includes, for example, a plurality of storage areas (a plurality of registers) and stores an address portion in each storage area. Each storage area corresponds to the above-mentioned entry. In the memory protection setting storage unit 2, each entry can be used for memory protection by a virtual machine monitor or can be used for memory protection by a virtual machine. That is, the address portion can be set for each entry by the virtual machine monitor, or the address portion can be set by the virtual machine. Which memory protection each entry is used for is defined by the classification information described later. The memory protection setting storage unit 2 does not need to have classification information.

[0039] A plurality of first determination units 3 are provided. Specifically, a first determination unit 3 is provided for each address portion stored in the memory protection setting storage unit 2. The first determination unit 3 preliminarily determines whether to permit an access request based on whether a destination address specified by the access request corresponds to an address portion acquired from the memory protection setting storage unit 2. Each first determination unit 3 outputs a provisional determination result to the second determination unit.

[0040] The second determination unit 4 finally determines whether to allow access based on the classification information and the temporary determination result of the first determination unit 3. Here, the classification information is information for determining whether each address portion stored in the memory protection setting storage unit 2 is for memory protection set by the virtual machine monitor or for memory protection set by the virtual machine.

[0041] As described above, in the data processing device 1, it is possible to specify which of the two types of memory protection the address portion stored in the memory protection setting storage unit 2 is used for based on the classification information. Therefore, the second determination unit 4 can specify whether the temporary determination result of the first determination unit 3 should be identified as a temporary determination result for memory protection by a virtual machine monitor or a temporary determination result for memory protection by a virtual machine. Therefore, in the memory protection setting storage unit 2, even if entries for a virtual machine monitor and entries for a virtual machine are mixed, two types of memory protection can be appropriately implemented. The number of entries for a virtual machine monitor and the number of entries for a virtual machine in the memory protection setting storage unit 2 can be dynamically changed by the classification information. That is, according to the data processing device 1, the ratio of entries for a virtual machine monitor and entries for a virtual machine can be flexibly changed in the memory protection setting storage unit 2. Therefore, according to the data processing device 1, a memory protection function set by a virtual machine monitor and a memory protection function set by a virtual machine can be implemented while suppressing an increase in circuit scale.

[0042] As described above, the memory protection setting storage unit 2 does not need to store classification information. That is, the setting contents of the entries to be set by the virtual machine and the virtual machine monitor do not depend on whether memory protection by the above configuration is performed. Therefore, the influence on the existing technology can be suppressed when the above configuration is adopted.

[0043] The memory protection setting storage unit 2 may also store attribute information in association with the address portion, which attribute information is information about access attributes. Here, the attribute information may be, for example, information indicating which type of access the protection setting is used for (e.g., read access, write access, execute access, etc.). In addition, the attribute information may be, for example, information indicating which access permission the protection setting is used for (e.g., access in user mode, access in privileged mode, etc.). In addition, the attribute information may be information indicating which access source the protection setting is used for. In this case, the first determination unit 3 temporarily determines whether to allow the access request based on whether the address area of ​​the access destination specified by the access request corresponds to the address portion obtained from the memory protection setting storage unit 2 and whether the attribute of the access request matches the attribute information obtained from the memory protection setting storage unit 2. With this configuration, more detailed memory protection can be achieved.

[0044] First embodiment

[0045] Next, detailed description of the embodiment is described. Figure 5 1 is a block diagram showing a configuration example of a data processing device 10 according to the first embodiment. Figure 5 As shown, the data processing device 10 includes a processing circuit 11, a memory 12, a global setting information storage unit 13, an MPU entry unit 14, a temporary access determination unit 15, a final access determination unit 16, an entry register access right determination unit 17 and a setting register access right determination unit 18.

[0046] The processing circuit 11 is a circuit that performs various processes by executing a program, and is specifically a processor such as a CPU. The memory 12 is, for example, a volatile memory or a nonvolatile memory, and stores a program executed by the processing circuit 11, data used for the processing of the processing circuit 11, and the like. The program executed by the processing circuit 11 includes, for example, various programs such as a virtual machine monitor and a virtual machine. In the present embodiment, based on the information set in the MPU entry unit 14 and the entry boundary information obtained from the global setting information storage unit 13, a memory protection setting by a virtual machine monitor or a memory protection setting by a virtual machine is implemented for the memory 12.

[0047] The global setting information storage unit 13 is a register for storing entry boundary information. The global setting information storage unit 13 stores entry boundary information, which is information corresponding to the above-mentioned classification information, and is therefore also referred to as a classification information storage unit. The details of the entry boundary information will be described later. In addition to the entry boundary information, the global setting information storage unit 13 may store other comprehensive setting information for memory protection.

[0048] The MPU entry unit 14 corresponds to Figure 4 The memory protection setting storage unit 2 includes a total of n+1 entries from entry 140_0 to entry 140_n. That is, the MPU entry unit 14 is composed of, for example, n+1 registers. The setting information of the memory protection function is stored in each entry. Therefore, the MPU entry unit 14 can store the setting information of n+1 types of memory protection functions. The setting information is set in the MPU entry unit 14 by a virtual machine monitor or a virtual machine.

[0049] The setting information of the memory protection function set by the virtual machine monitor needs to be used for memory protection by the virtual machine monitor, and the setting information of the memory protection function set by the virtual machine needs to be used for memory protection by the virtual machine. Therefore, it is necessary to specify which setting information stored in the MPU entry unit 14 is the setting information set by the virtual machine monitor and which setting information is the setting information set by the virtual machine. In the present embodiment, entry boundary information is used for the specification. The entry boundary information corresponds to the above-mentioned classification information. The entry boundary information is the following information, which defines which entry among entries 140_0 to 140_n is an entry for the virtual machine and which entry is an entry for the virtual machine monitor. In the following description, the entry for the virtual machine is referred to as a guest management entry, and the entry for the virtual machine monitor is referred to as a host management entry. In addition, entry 140_0, entry 140_1... and entry 140_n are referred to as entry 140 when referenced without any special distinction.

[0050] exist Figure 5 In the figure, for ease of understanding, the MPU entry unit 14 is distinguished by hatching the guest management entry and the host management entry with different patterns. However, it is not necessary for the MPU entry unit 14 to distinguish whether each entry 140 is a guest management entry or a host management entry. That is, it is not necessary to set whether each entry 140 is a guest management entry or a host management entry in the MPU entry unit 14. This is because it can be distinguished by entry boundary information.

[0051] Figure 6 1 is a diagram showing an example of information stored in each entry 140 of the MPU entry unit 14. Figure 6As shown, in this embodiment, the lower limit address and the upper limit address of the definition address part are stored in each entry 140. In addition, each entry 140 stores attribute information in association with the lower limit address and the upper limit address, and the attribute information is information about access attributes. In this embodiment, it is assumed that access to the memory 12 is prohibited by default. Therefore, each entry 140 stores the lower limit address and the upper limit address of the address part that define access. In addition, in this embodiment, as attribute information, information indicating which access source sets protection for access is stored in each entry 140. Specifically, each entry 140 stores identifier information for identifying which program (virtual machine) sets protection for access. In the following description, this identifier information is referred to as MPID. The stored attribute information can be other information, such as access type and mode type (for example, user mode, privileged mode, etc.). In addition, multiple attribute information can be stored.

[0052] The temporary access determination unit 15 refers to the setting information of each entry 140. The temporary access determination unit 15 includes a memory protection authority determination unit 150_0, a memory protection authority determination unit 150_1 ... and a memory protection authority determination unit 150_n. In the following description, the memory protection authority determination unit 150_0, the memory protection authority determination unit 150_1 ... and the memory protection authority determination unit 150_n are referred to as the memory protection authority determination unit 150 when being referred to without making a special distinction.

[0053] The memory protection authority determination unit 150 corresponds to Figure 4 The memory protection authority determination unit 150 is a first determination unit 3 in the MPU entry unit 14, and is a circuit that temporarily determines whether access is possible based on the setting information stored in the MPU entry unit 14. A memory protection authority determination unit 150 is provided corresponding to each entry 140 of the MPU entry unit 14.

[0054] When there is an access request from the processing circuit 11, each memory protection authority determination unit 150 performs a temporary determination based on the setting information obtained from the MPU entry unit 14, and outputs the temporary determination result to the final access determination unit 16. That is, when there is an access request from the processing circuit 11, the memory protection authority determination unit 150_0 performs a temporary determination based on the setting information obtained from the entry 140_0. Similarly, the memory protection authority determination unit 150_i performs a temporary determination based on the setting information obtained from the entry 140_i. Where i is an integer greater than or equal to 0 and less than or equal to n. Therefore, when there is an access request from the processing circuit 11, the n+1 temporary determination results output from each memory protection authority determination unit 150 are output to the final access determination unit 16. The temporary determination result of the memory protection authority determination unit 150_0 is represented as Rlt0. Similarly, the temporary determination result of the memory protection authority determination unit 150_i is represented as Rlt i. Where i is an integer greater than or equal to 0 and less than or equal to n.

[0055] When accessing the memory 12, the processing circuit 11 outputs the access address, the VM flag and the attribute information. As described above, in the present embodiment, the attribute information is the MPID. The VM flag is information indicating whether the access is performed by the virtual machine monitor or the virtual machine, for example, when the value is 0, it indicates that the access is performed by the virtual machine monitor, and when the value is 1, it indicates that the access is performed by the virtual machine. That is, the VM flag can also be referred to as access source information, which indicates whether the access requested by the access request is an access through the virtual machine monitor. The VM flag is used by the final access determination unit 16 (described later) to control the access determination according to whether the access source is the virtual machine monitor. In the present embodiment, the control using the VM flag is performed in the final access determination unit 16, but when the control is performed without using the VM flag in the final access determination unit 16, the processing circuit 11 may not output the VM flag or the final access determination unit 16 may not receive the VM flag. The access information output from the processing circuit 11 in response to the access request from the processing circuit 11 may include other information, such as the access type and the access size.

[0056] When the processor 11 requests access, the access address and attribute information (MPID) are input to the memory protection authority determination unit 150. Each memory protection authority determination unit 150 compares the information (lower limit address, upper limit address, and attribute information) acquired from the MPU entry unit 14 with the information (access address and attribute information) input from the processing circuit 11, thereby temporarily determining whether to allow access.

[0057] Figure 7is a block diagram showing a configuration example of the memory protection authority determination unit 150. Figure 7 As shown, each memory protection authority determination unit 150 includes an address determination unit 151 , an attribute determination unit 152 , and an AND circuit 153 .

[0058] The lower limit address and the upper limit address from the MPU entry unit 14 and the access address from the processing circuit 11 are input to the address determination unit 151. The access address is, for example, an address area determined by an address and an access size. The address determination unit 151 is a circuit that determines whether the access address matches a condition defined based on the lower limit address and the upper limit address, for example, the lower limit address ≤ access address ≤ upper limit address. The address determination unit 151 outputs 1 as a determination result signal "ahit" when the input access address satisfies the condition, and outputs 0 as a determination result signal "ahit" when the input access address does not satisfy the condition. The determination result signal "ahit" is input to the AND circuit 153.

[0059] The attribute information from the MPU entry unit 14 and the attribute information from the processing circuit 11 are input to the attribute determination unit 152. The attribute determination unit 152 is a circuit that determines whether the attribute information input from the processing circuit 11 matches the condition defined based on the attribute information input from the MPU entry unit 14 (for example, "attribute information input from the processing circuit 11" = "attribute information input from the MPU entry unit 14"). In the present embodiment, the attribute determination unit 152 determines whether the MPID input from the processor 11 satisfies the condition based on the MPID input from the MPU entry unit 14, but the determination target is not limited to the MPID. That is, determination of other attribute information such as access type can be performed. The attribute determination unit 152 outputs a determination result signal "mhit". When the attribute information input from the processor 11 satisfies the condition, the attribute determination unit 152 outputs 1 as the determination result signal "mhit", and when the condition is not satisfied, 0 is output as the determination result signal "mhit". The determination result signal "mhit" is input to the AND circuit 153. In the MPID determination, it may be determined whether the MPID from the processor 11 matches any one of the plurality of MPIDs stored in the MPU entry unit 14 .

[0060] The determination result signal "ahit" and the determination result signal "mhit" are input to the AND circuit 153. The AND circuit 153 calculates the AND of these input signals and outputs the determination result signal "ehit". The determination result signal "ehit" is a signal indicating whether the access request from the processor 11 satisfies the condition defined by the setting information in the MPU entry unit 14. When the access request from the processor 11 satisfies the condition defined by the setting information in the MPU entry unit 14, that is, when the access request satisfies the condition in the address determination unit 151 and the access request satisfies the condition in the attribute determination unit 152, the determination result signal "ehit" becomes 1. Otherwise, the determination result signal "ehit" becomes 0. The determination result signal "ehit" is output to the final access determination unit 16 as a temporary determination result signal Rlt i.

[0061] In the present embodiment, the memory protection authority determination unit 150 determines the address and the attribute information, but may determine only the address. In this case, the attribute information may not be stored in the MPU entry unit 14.

[0062] Next, the final access determination unit 16 will be described. The n+1 temporary determination results output from each memory protection authority determination unit 150 are input to the final access determination unit 16. The VM flag is input to the final access determination unit 16 from the processing circuit 11. Entry boundary information is input to the final access determination unit 16 from the global setting information storage unit 13.

[0063] In the present embodiment, the entry boundary information indicates which entries in the entries 140 of the MPU entry unit 14 are guest management entries. That is, the entry boundary information indicates the number of entries of a series of entries 140 of the MPU entry unit 14 to be switched to the host management entries, that is, the minimum value of the number of entries of the host management entries. For example, when the value of the entry boundary information is 0, this means that all entries 140 of the MPU entry unit 14 are host management entries. When the entry boundary information is n+1, this means that all entries 140 of the MPU entry unit 14 are guest management entries.

[0064] Figure 8 is a block diagram showing a configuration example of the final access determination unit 16. Figure 8 As shown, the final access determination unit 16 includes a classification unit 160 , OR circuits 164A, 164B, and 165 , and an AND circuit 166 .

[0065] The classification unit 160 is a circuit that classifies the n+1 temporary determination results output from each memory protection permission determination unit 150 into a temporary determination result corresponding to a guest management entry and a temporary determination result corresponding to a host management entry. In other words, the classification unit 160 classifies the temporary determination results output from each memory protection permission determination unit 150 into a temporary determination result determined according to a memory protection condition set by a virtual machine and a temporary determination result determined according to a memory protection condition set by a virtual machine monitor.

[0066] Specifically, the classification unit 160 includes a decoder 161 and n+1 separation circuits 162_0 . . . 162_n.

[0067] The decoder 161 converts the entry boundary information input from the global setting information storage unit 13 into n+1 pieces of tag information VmEntry0 to VmEntryn. Here, VmEntry i is tag information corresponding to the temporary determination result Rlt i of the memory protection permission determination unit 150_i. Wherein i is an integer greater than or equal to 0 and less than or equal to n. Tag information is information that specifies whether each temporary determination result output from each memory protection permission determination unit 150 is a temporary determination result corresponding to a guest management entry or a temporary determination result corresponding to a host management entry. The decoder 161 generates the following binary tag information based on the entry boundary information. When the value of the entry boundary information is i, the decoder 161 sets the value of VmEntry(i-1) from VmEntry0 to 1, and sets the values ​​of VmEntryi to VmEntryn to 0. Therefore, when the value of the entry boundary information is 0, all values ​​from VmEntry0 to VmEntryn are 0, and when the value of the entry boundary information is n+1, all values ​​from VmEntry0 to VmEntryn are 1.

[0068] The separation circuit 162_i is connected to the memory protection authority determination unit 150_i, and receives the temporary determination result Rlti. The separation circuit 162_i includes two AND circuits 163A_i and 163B_i. The temporary determination result Rlt i output from the memory protection authority determination unit 150_i is input to the AND circuits 163A_i and 163B_i. The AND circuits 163A_i and 163B_i also receive the tag information VmEntry i output from the decoder 161. Note that the signal obtained by inverting the tag information VmEntry i output from the decoder 161 is input to the AND circuit 163B-i. The AND circuit 163A-i performs an AND operation on the temporary determination result Rlt i and the tag information VmEntry i, and outputs the operation result. The AND circuit 163B-i performs an AND operation on the inverted signal of the temporary determination result Rlt i and the tag information VmEntry i, and outputs the operation result. The output of the AND circuit 163A_i is input to the OR circuit 164A. The output of the AND circuit 163B_i is input to the OR circuit 164B. Therefore, all temporary determination results corresponding to the guest management entry and having a value of 1 are aggregated in the OR circuit 164A. Similarly, all temporary determination results corresponding to the host management entry and having a value of 1 are aggregated in the OR circuit 164B.

[0069] The OR circuit 164A determines whether the access request from the processing circuit 11 satisfies the condition defined by the setting information of any visitor management entry. The OR circuit 164A outputs a determination result signal "ghit". When the access request from the processing circuit 11 satisfies the condition defined by the setting information of any visitor management entry, the OR circuit 164A outputs 1 as the determination result signal "ghit", and when the access request does not satisfy the condition defined by the setting information of any visitor management entry, it outputs 0 as the determination result signal "ghit". The determination result signal "ghit" is input to the OR circuit 165.

[0070] The OR circuit 164B determines whether the access request from the processing circuit 11 satisfies the condition defined by the setting information of any host management entry. The OR circuit 164B outputs a determination result signal “hhit”. When the access request from the processing circuit 11 satisfies the condition defined by the setting information of any host management entry, the OR circuit 164B outputs 1 as the determination result signal “hhit”, and when the access request does not satisfy any condition defined by the setting information of the host management entry, 0 is output as the determination result signal “hhit”. The determination result signal “hhit” is input to the AND circuit 166.

[0071] The OR circuit 165 determines whether to adopt the temporary determination result corresponding to the guest management entry. The OR circuit 165 outputs the signal "grlt". The virtual machine runs under the management of the virtual machine monitor. Therefore, when the access source is the virtual machine monitor, it is preferred that the access is not restricted according to the memory protection function set by the virtual machine. Therefore, in the present embodiment, when the access source is the virtual machine monitor, the temporary determination result corresponding to the guest management entry is forced to be converted to 1. The inverted signal of the VM flag and the determination result signal "ghit" are input to the OR gate 165. As a result, when the access source is the virtual machine monitor, that is, when the value of the VM flag is 0, the OR circuit 165 outputs 1 as the signal "grlt" regardless of the value of the determination result signal "ghit".

[0072] The AND circuit 166 finally determines whether access to the memory 12 is permitted. The AND circuit 166 receives the signal "grlt" output from the OR circuit 165. In addition, the determination result signal "hhit" output from the OR circuit 164B is input to the AND circuit 166 as the signal "hrlt". As is apparent from the above description, the signal "grlt" is a signal indicating a determination result of access permission based on the setting information of the guest management entry, and access permission is indicated by a signal value of 1, and access prohibition is indicated by a signal value of 0. Similarly, the signal "hrlt" is a signal indicating a determination result of access permission or non-access permission based on the setting information of the host management entry, and access permission is indicated by a signal value of 1, and access prohibition is indicated by a signal value of 0.

[0073] The AND circuit 166 performs an AND operation on the input signal "grlt" and the signal "hrlt", and outputs the operation result as a final determination result of whether the memory 12 is accessible. When the operation result is 1, access to the memory 12 is permitted. When the operation result is 0, access to the memory 12 is prohibited.

[0074] As described above, in the final access determination unit 16, if the value of the VM flag is 0, the temporary determination result based on the setting information of the guest management entry is not used, and if the access is allowed by the determination based on the setting information of the host management entry (that is, when the signal "hrlt" = 1 is obtained), it is finally determined that the access is allowed. When the VM flag indicates 1, when the access is allowed based on the setting information of the guest management entry (that is, when the signal "grlt" is 1), and when the access is also allowed based on the setting information of the host management entry (that is, when the signal "hrlt" is 1), it is finally determined that the access is allowed. When a read access is performed, an access request may be speculatively issued to the memory 12, and the result of the read access may not be used after the memory protection determination.

[0075] Next, the entry register access permission determination unit 17 and the setting register access permission determination unit 18 will be described. Preferably, the writing to the MPU entry unit 14 is controlled so that the setting information of the host management entry of the MPU entry unit 14 is not rewritten in the guest mode. In addition, preferably, the writing to the global setting information storage unit 13 is controlled so that the comprehensive information used for memory protection, such as the entry boundary information, is not rewritten in the guest mode. That is, it is necessary to restrict the free writing of the virtual machine to the MPU entry unit 14 and the global setting information storage unit 13. The entry register access permission determination unit 17 and the setting register access permission determination unit 18 determine the permission to write, and restrict the free writing in the absence of permission. The guest mode is the operating mode of the data processing device 10 when operating the virtual machine. On the other hand, the operating mode of the data processing device 10 when operating the virtual machine monitor is called the host mode. The data processing device 10 implements the operation of the virtual machine monitor and the virtual machine by switching between the host mode and the guest mode in a time-sharing manner.

[0076] The entry register access permission determination unit 17 is a circuit that determines write permissions and restricts free writing to the MPU entry unit 14. The entry register access permission determination unit 17 (also referred to as a memory protection setting write control unit) controls writing to the storage area of ​​the memory protection setting storage unit (MPU entry unit 14) based on the address of the write target specified in the storage area of ​​the memory protection setting storage unit (MPU entry unit 14), classification information (entry boundary information), and write source information (VM flag) indicating whether writing is performed by a virtual machine monitor. According to such a configuration, secure writing to the memory protection setting storage unit (MPU entry unit 14) can be achieved. In the following, the specific configuration of the entry register access permission determination unit 17 will be described.

[0077] Fig. 9 1 is a block diagram showing a configuration example of the entry register access right determination unit 17. The entry register access right determination unit 17 receives a write destination address and a VM flag from the processing circuit 11. The VM flag is information indicating whether writing is performed by a virtual machine monitor or a virtual machine, and indicates write access by a virtual machine when a value is 1, and indicates write access by a virtual machine monitor when a value is 0. The entry register access right determination unit 17 receives entry boundary information from the global setting information storage unit 13.

[0078] like Fig. 9As shown, the entry register access right determination unit 17 includes a decoder 170, an address decoder 171, and n+1 determination circuits 172_0, ..., 172_n. In the following description, when the determination circuits 172_0, ..., 172_n are mentioned, they are referred to as determination circuits 172 without any particular distinction.

[0079] The decoder 170 is a circuit similar to that of the decoder 161 in the final access determination unit 16, and converts the entry boundary information input from the global setting information storage unit 13 into n+1 pieces of tag information VmEntry0 to VmEntryn. The n+1 pieces of tag information correspond one-to-one to the inputs of the n+1 determination circuits 172.

[0080] The address decoder 171 is a circuit for determining which entry 140 is accessed by the write destination address input from the processing circuit 11. For example, the address decoder 171 compares the address of each entry 140 in the MPU entry unit 14 with the address input from the processing circuit 11 to determine which entry 140 is to be accessed by the access requested by the write request. There are n+1 output signal lines corresponding to the respective entries 140. The address decoder 171 outputs 1 for the output signal line corresponding to the entry 140 that is the write destination, and outputs 0 for the output signal line corresponding to the entry 140 that is not the write destination. The n+1 output signal lines of the address decoder 171 correspond one-to-one to the inputs of the n+1 determination circuits 172. It is assumed that the signal input from the output signal line for the i-th entry 140 to the determination circuit 172_i is WrEntry i. Where i is an integer greater than or equal to 0 and less than or equal to n.

[0081] The n+1 determination circuits 172 are provided corresponding to the n+1 entries 140 of the MPU entry unit 14. The determination circuit 172_i corresponds to the i-th entry 140 of the MPU entry unit 14, and includes an OR circuit (OR circuit) 173_i and an AND circuit (AND circuit) 174_i.

[0082] The VM flag and the tag information VmEntry i are input to the OR circuit 173_i. However, the inverted signal of the VM flag is input to the OR circuit 173_i. The OR circuit 173_i calculates the logical OR of the inverted signal of the VM flag and the tag information VmEntry i, and outputs the logical OR of the inverted signal of the VM flag and the tag information VmEntry i.

[0083] The AND circuit 174_i determines whether writing to the i-th entry 140 is permitted. The AND circuit 174_i receives the output of the OR circuit 173_i and the signal WrEntry i output from the address decoder 171. The AND circuit 174_i calculates AND of the two input signals and outputs the calculation result as a determination result of whether writing to the i-th entry 140 is permitted. When the operation result is 1, writing to the i-th entry 140 is permitted. When the operation result is 0, writing to the i-th entry 140 is prohibited.

[0084] According to the entry register access right determination unit 17, when a write access to the i-th entry 140 occurs and the value of the VM flag is 0, that is, when the access source is the virtual machine monitor, the write access to this entry 140 is allowed. When a write access to the i-th entry 140 occurs and the value of the VM flag is 1 and the tag information VmEntry i indicates that the entry 140 is a guest management entry, the write access to the entry 140 is allowed. On the other hand, when a write access to the i-th entry 140 occurs and the value of the VM flag is 1 and the tag information VmEntry i indicates that the entry 140 is a host management entry, the write access to the entry 140 is not allowed. That is, writing is prohibited. That is, when the access source is a virtual machine, writing only the guest management entry in the entry 140 of the MPU entry unit 14 is allowed, and writing the host management entry is prohibited.

[0085] The setting register access right determination unit 18 is a circuit that determines write permission and restricts free writing to the global setting information storage unit 13. The setting register access right determination unit 18 is also called a classification information write control unit, and controls writing to the storage area of ​​the classification information storage unit (global setting information storage unit 13) based on the address of the designated write target in the storage area of ​​the classification information storage unit and the write source information (VM flag) indicating whether the writing is performed by the virtual machine monitor. According to such a configuration, secure writing to the classification information storage unit 13 can be achieved. Hereinafter, the specific configuration of the setting register access right determination unit 18 will be described.

[0086] Fig.10 is a block diagram showing a configuration example of the setting register access right determination unit 18. The setting register access right determination unit 18 receives a write destination address and a VM flag from the processing circuit 11. The VM flag is also information indicating whether the write is written by the virtual machine monitor or the virtual machine, and when the value is 1, it indicates a write access by the virtual machine, and when the value is 0, it indicates a write access by the virtual machine monitor.

[0087] like Fig.10As shown, the setting register access right determination unit 18 includes an address decoder 180 and a logic AND circuit 181 .

[0088] The address decoder 180 is a circuit for determining whether the write destination address input from the processing circuit 11 is an access to the global setting information storage unit 13. For example, the address decoder 180 compares each address of the global setting information storage unit 13 with the address input from the processing circuit 11 to determine whether the access requested by the write request is an access to the global setting information storage unit 13. The address decoder 180 outputs 1 when the address of the write destination input from the processing circuit 11 is an access to the global setting information storage unit 13, or outputs 0 if not.

[0089] The AND circuit 181 determines whether writing to the global setting information storage unit 13 is permitted. The output of the address decoder 180 and the VM flag are input to the AND circuit 181. The AND circuit 181 calculates AND of the two input signals and outputs the calculation result as a determination result of whether writing to the global setting information storage unit 13 is permitted. When the calculation result is 1, writing to the global setting information storage unit 13 is permitted. When the calculation result is 0, writing to the global setting information storage unit 13 is prohibited.

[0090] According to the setting register access right determination unit 18, when a write access to the global setting information storage unit 13 occurs and the value of the VM flag is 0, that is, when the access source is the virtual machine monitor, the write access to the global setting information storage unit 13 is allowed. When a write access to the global setting information storage unit 13 occurs and the value of the VM flag is 1, that is, when the access source is the virtual machine, the write access to the global setting information storage unit 13 is not allowed. In other words, writing is prohibited.

[0091] The first embodiment has been described above. As described above, in the data processing device 10 according to the first embodiment, it is possible to specify whether each entry 140 of the MPU entry unit 14 is a host management entry or a guest management entry based on the entry boundary information. Therefore, the final access determination unit 16 can specify whether each temporary determination result of the temporary access determination unit 15 (memory protection permission determination unit 150) is based on the setting information of the host management entry or the setting information of the guest management entry. Therefore, even if the guest management entry and the host management entry are mixed in the MPU entry unit 14, two types of memory protection can be appropriately implemented.

[0092] That is, according to the data processing device 10 of the first embodiment, the number of entries provided in the MPU entry unit 14 does not need to be the sum of the maximum number of entries required for the host management entries and the maximum number of entries required for the guest management entries. According to the data processing device 10, the ratio of the host management entries to the guest management entries can be flexibly changed by the entry boundary information. In the data processing device 10, when the context of the virtual machine is switched in the host mode, the optimal memory protection state can be constructed for each virtual machine by switching the setting information of each entry 140 and changing the entry boundary information. For example, Figure 3 As shown, four types of virtual machines can be implemented ( Figure 3 As described above, according to the data processing device 10, the memory protection function set by the virtual machine monitor and the memory protection function set by the virtual machine can be realized while suppressing the increase of the circuit scale.

[0093] The MPU entry unit 14 does not need to store entry boundary information. That is, the setting content of the entry 140 does not depend on whether the memory protection according to the configuration of this embodiment is performed. Therefore, when the configuration of this embodiment is adopted, the influence on the existing technology can be suppressed.

[0094] In view of the fact that the lower limit address and the upper limit address defining the address part are set in each entry 140 of the MPU entry unit 14, it can be said that the final access determination unit 16 in the present embodiment finally determines whether access is allowed as follows. That is, the final access determination unit 16 uses the first determination result and the second determination result to perform a predetermined logical operation to finally determine whether access is allowed. Here, the first determination result is a determination result (determination result signal "hhit") calculated based on the temporary determination result of the temporary access determination unit 15 (memory protection permission determination unit 150), which is used to classify the address part of the memory protection set by the virtual machine monitor through the classification information (entry boundary information). The second determination result is a determination result (determination result signal "ghit") calculated based on the temporary determination result of the temporary access determination unit 15 (memory protection permission determination unit 150), which is used to classify the address part of the memory protection set by the virtual machine monitor through the classification information (entry boundary information).

[0095] In the present embodiment, the MPU entry unit 14 stores not only the lower limit address and the upper limit address defining the address portion, but also stores attribute information associated with the address portion, which is information about access attributes. Then, the temporary access determination unit 15 (memory protection authority determination unit 150) temporarily determines whether to allow the access request based on whether the address area of ​​the access destination specified by the access request corresponds to the address portion set in the entry 140 and whether the attribute of the access request matches the attribute information set in the entry 140. Therefore, compared with the case where memory protection is implemented only by setting the address portion, more detailed memory protection can be implemented.

[0096] In the present embodiment, the final access determination unit 16 finally determines whether to allow access based on the classification information (entry boundary information), the temporary determination result of the temporary access determination unit 15 (memory protection permission determination unit 150), and the access source information (VM flag) indicating whether the access requested by the access request is access through the virtual machine monitor. Therefore, depending on whether the access source is the virtual machine monitor, it is possible to control whether to adopt the temporary determination result corresponding to the guest management entry. Therefore, when the access source is the virtual machine monitor, access restrictions according to the memory protection function set by the virtual machine can be prevented.

[0097] Second embodiment

[0098] Fig.11 2 is a block diagram showing a configuration example of a data processing device 20 according to the second embodiment. Fig.11 As shown, the data processing device 20 according to the second embodiment is different from the data processing device 10 according to the first embodiment in that information about the determination is output from the final access determination unit 21. In order to output the information about the determination, in the second embodiment, the final access determination unit 16 is replaced by the final access determination unit 21. The data processing device 20 has the same configuration as the data processing device 10 except that the final access determination unit 16 is replaced by the final access determination unit 21. In the following description, repeated descriptions are omitted, and points different from the first embodiment will be specifically described.

[0099] In the data processing device 20, the final access determination unit 21 outputs the abnormal classification information, the host violation information, and the guest violation information to the processing circuit 11. Here, the abnormal classification information is information indicating that the access request of the processing circuit 11 to the memory 12 is finally not allowed in the final access determination unit 21. The host violation information is information indicating that the access request of the processing circuit 11 to the memory 12 does not satisfy any condition defined by the setting information of the host management entry. The guest violation information is information indicating that the access request of the processing circuit 11 to the memory 12 does not satisfy any condition defined by the setting information of the guest management entry.

[0100] Fig.12 2 is a block diagram showing a configuration example of the final access determination unit 21 according to the second embodiment. Fig.12 As shown, the final access determination unit 21 differs from the final access determination unit 16 of the first embodiment in that a signal line 210 for outputting abnormal classification information, a signal line 211 for outputting host violation information, and a signal line 212 for outputting visitor violation information are added.

[0101] The signal line 210 is connected to the output of the AND circuit 166. The output signal of the AND circuit 166 is inverted by the inversion circuit 213 connected to the signal line 210, and is output as abnormality classification information to the processing circuit 11. When the value of the abnormality determination information is 1, the abnormality determination information indicates that the access request is finally not permitted in the final access determination unit 21.

[0102] The signal line 211 is connected to the output of the OR circuit 164B. The output signal of the OR circuit 164B is inverted by the inversion circuit 214 connected to the signal line 211, and is output as the host violation information to the processing circuit 11. When the value of the host violation information is 1, the host violation information indicates that the access request does not satisfy any condition defined by the setting information of the host management entry.

[0103] The signal line 212 is connected to the output of the OR circuit 164A. The output signal of the OR circuit 164A is inverted by the inversion circuit 215 connected to the signal line 212, and is output as the guest violation information to the processing circuit 11. When the value of the guest violation information is 1, the guest violation information indicates that the access request does not satisfy any condition defined by the setting information of the guest management entry.

[0104] Upon receiving the abnormality determination information indicating that the access request is not permitted, the processing circuit 11 performs, for example, occurrence of an abnormality, retention of violation information, or notification of a violation to a security mechanism. Fig.13 : is a table showing an example of the correspondence relationship between the host violation information and the guest violation information received by the processing circuit 11 and the violation information held by the processing circuit 11. Fig.13As shown, for example, when the value of the host violation information is 0 and the value of the guest violation information is 1, the processing circuit 11 records that the access request does not meet any condition defined by the setting information of the guest management entry. That is, in this case, the guest violation information is recorded. When the value of the host violation information is 1 and the value of the guest violation information is 0, the processing circuit 11 records that the access request does not meet any condition defined by the setting information of the host management entry. That is, in this case, the host violation information is recorded. When the values ​​of the host violation information and the guest violation information are both 1, the processing circuit 11 preferentially records that the access request does not meet any condition defined by the setting information of the guest management entry. That is, in this case, the guest violation information is preferentially recorded. When the values ​​of the host violation information and the guest violation information are both 0, the processing circuit 11 does not retain the violation information. Fig.13 In the example shown, the guest violation information is recorded first, but the abnormal information may be recorded for both the guest violation information and the host violation information, or the host violation information may be recorded first. The data processing device 20 may include a control mechanism for setting or changing the correspondence between the host violation information and the guest violation information and the violation information maintained by the processing circuit 11.

[0105] Fig.14 1 is a table showing an example of the correspondence between the host violation information and the guest violation information received by the processing circuit 11 and the machine generating the abnormality. Fig.14 As shown, for example, when the value of the host violation information is 0 and the value of the guest violation information is 1, the processing circuit 11 generates an exception in the virtual machine. When the value of the host violation information is 1 and the value of the guest violation information is 0, the processing circuit 11 generates an exception in the virtual machine monitor. When the values ​​of the host violation information and the guest violation information are both 1, the processing circuit 11 preferentially generates an exception in the virtual machine. When the values ​​of the host violation information and the guest violation information are both 0, the processing circuit 11 does not generate an exception. Fig.14 In the example shown, the following example is shown: the exception is preferentially generated in the virtual machine, but the exception can be generated in both the virtual machine and the virtual machine monitor. In addition, the exception can be preferentially generated in the virtual machine monitor. That is, no matter which management entry condition is not satisfied, the exception can be generated in the virtual machine monitor. The data processing device 20 may include a control mechanism for setting or changing the correspondence between the host violation information and the guest violation information received by the processing circuit 11 and the machine generating the exception.

[0106] As described above, in the data processing device 20 according to the second embodiment, information about the determination is notified from the final access determination unit 21 to the processing circuit 11. Therefore, when access is not permitted, the processing circuit 11 can perform various controls such as the occurrence of an abnormality and the recording of the abnormality. Therefore, when access is not permitted, the system can be appropriately controlled.

[0107] In addition, the processing circuit 11 may control a machine for processing an exception or a priority order of exception processing based on the information notified from the final access determination unit 21. For example, as described above, when the values ​​of the host violation information and the guest violation information are both 1, an access error according to the setting of the guest management entry may be recorded, and the exception occurrence machine may be a virtual machine. In this case, a system may be configured in which an exception caused by a low reliability task in a virtual machine (e.g., application software running on the virtual machine) is first processed by a high reliability task in the virtual machine (e.g., an OS running on the virtual machine).

[0108] It should be noted that a switch for fixing the exception occurrence machine to the virtual machine monitor may be prepared, and the exception handling may be performed only by the virtual machine monitor. In the above description, the final access determination unit 21 outputs three pieces of information, namely, the exception determination information, the host violation information, and the guest violation information, but one or two pieces of information may be output. That is, the final access determination unit 21 may notify the processing circuit 11 of the first determination result (the output of the OR circuit 164A), the second determination result (the output of the OR circuit 164B), or the final determination result.

[0109] Third embodiment

[0110] When the virtual machine monitor switches the virtual machine to be operated, or when the virtual machine switches the application software to be executed, it is necessary to switch the setting information of each entry 140 of the MPU entry unit 14. The switching of the setting information of each entry 140 is performed by saving the setting information to the memory 12 and restoring the setting information from the memory 12. This embodiment is different from the above-described embodiment in that a sequencer for saving and restoring the setting information is provided in the processing circuit.

[0111] Fig.15 1 is a block diagram showing a configuration example of a data processing device 30 according to the third embodiment. Fig.15 As shown, the data processing device 30 according to the third embodiment is different from the data processing device 10 according to the first embodiment in that the processing circuit 11 is replaced by the processing circuit 19 including the save / restore sequencer 190. In the following description, repeated descriptions are omitted, and points different from the first embodiment will be specifically described.

[0112] The save / restore sequencer 190 is a control circuit that saves all or part of the setting information stored in each entry 140 of the MPU entry unit 14 to the memory 12 and restores all or part of the setting information from the memory 12 to each entry 140. The save / restore sequencer 190 moves the setting information stored in the address range specified by the virtual machine monitor or the virtual machine between the MPU entry unit 14 and the memory 12.

[0113] In the switching of the setting information executed by the instruction of the virtual machine monitor, for example, Fig.16 As shown, the setting information of the entry 140 including the host management entry and the guest management entry is saved in the memory 12, and the new setting information is returned from the memory 12 to the entry 140 including the host management entry and the guest management entry. Therefore, when the setting information is switched by the instruction of the virtual machine monitor, the setting information is allowed to be returned from the memory 12 to the MPU entry unit 14 for all entries 140.

[0114] On the other hand, in the switching of setting information executed by the instruction of the virtual machine, it is necessary to allow only the switching of the guest management entry and restrict the switching of the host management entry. Fig.17 Only allows return to the guest management entry, but if Fig.18 The return to the host management entry needs to be prohibited. Therefore, the save / restore sequencer 190 has the same control mechanism as the above-mentioned entry register access right determination unit 17, and controls the return of the setting information from the memory 12 to the entry 140 based on the address of the write target specified in the storage area of ​​the MPU entry unit 14, the entry boundary information, and the VM flag. Specifically, when the entry 140 of the return destination (write target) determined based on the entry boundary information and the address of the specified write target includes the host management entry and the value of the VM flag is 1, the save / restore sequencer 190 prohibits returning the setting information to the entry 140.

[0115] As described above, the data processing device 30 includes the save / restore sequencer 190 for saving the information stored in the MPU entry unit 14 to the memory 12 and restoring the information stored in the memory 12 to the MPU entry unit 14. As described above, in the present embodiment, since there is dedicated hardware for switching the MPU entry unit 14, it is expected that the switching process is completed at a higher speed than the case where the switching is performed by software processing. In addition, since the same control as that of the entry register access right determination unit 17 is performed when switching the content of the entry 140, it is possible to inhibit the virtual machine from incorrectly writing the host management entry.

[0116] Fourth embodiment

[0117] In the first embodiment, access to the memory 12 is prohibited by default. Therefore, in the first embodiment, the entry 140 stores a lower limit address and an upper limit address, which define an address portion to which access can be permitted. The fourth embodiment shows an embodiment in which access to the memory 12 is permitted by default. That is, a configuration example will be described in which a lower limit address and an upper limit address defining an address portion in which access is prohibited are stored as setting information in each entry 140.

[0118] The data processing apparatus according to the fourth embodiment is the same as the data processing apparatus 10 according to the first embodiment except that the final access determination unit 16 is replaced by the final access determination unit 31. In the following description, duplicate descriptions are omitted, and points different from the first embodiment will be specifically described.

[0119] Fig.19 : is a block diagram showing a configuration example of the final access determination unit 31 according to the fourth embodiment. Fig.19 As shown in , the final access determination section 31 is different from the final access determination section 16 in that it has inversion circuits (NOT circuits) 310 and 311 .

[0120] The inversion circuit 310 is provided between the OR circuit 164A and the OR circuit 165, and inverts the determination result signal “ghit” output from the OR circuit 164A and inputs the inversion signal to the OR circuit 165. The inversion circuit 311 is provided between the OR circuit 164B and the AND circuit 166, and inverts the determination result signal “hhit” output from the OR circuit 164B and inputs the inversion signal to the AND circuit 166.

[0121] When the access request from the processor 11 satisfies the condition defined by the setting information of one of the guest management entries, the determination result signal "ghit" is a signal having a value of 1. When the access request from the processor 11 satisfies the condition defined by the setting information of any host management entry, the determination result signal "hhit" is a signal having a value of 1. In the present embodiment, the guest management entry and the host management entry store the lower limit address and the upper limit address as setting information, and the lower limit address and the upper limit address define the address portion where access is prohibited. Therefore, when the value of the determination result signal "ghit" is 1, it means that the condition for prohibiting access is satisfied. Therefore, in the present embodiment, as described above, the inversion circuit 310 inverts the determination result signal "ghit" so that the signal input to the OR circuit 165 becomes a signal equivalent to the signal input to the OR circuit 165 in the final access determination unit 16 according to the first embodiment. Similarly, by inverting the determination result signal "hhit" in the inversion circuit 311, the signal input to the AND circuit 166 becomes a signal equivalent to the signal input to the AND circuit 166 in the final access determination unit 16 according to the first embodiment.

[0122] As described above, also in this embodiment, the signal input to the OR circuit 165 and the signal input to the AND circuit 166 are the same as in the first embodiment. Therefore, the OR circuit 165 and the AND circuit 166 can realize the same access control as in the first embodiment.

[0123] As described above, the address portion represented by the setting information stored in the MPU entry unit 14 may indicate an address portion to which access may be permitted, or may indicate an address portion to which access is prohibited. As in the first embodiment, when the address portion to which access may be permitted is set, in a system in which access to the memory 12 is prohibited by default, the memory protection function set by the virtual machine monitor and the memory protection function set by the virtual machine can be implemented while suppressing an increase in circuit scale. In addition, as in the fourth embodiment, when the address portion to which access is prohibited is set, in a system in which access to the memory 12 is permitted by default, the memory protection function set by the virtual machine monitor and the memory protection function set by the virtual machine can be implemented while suppressing an increase in circuit scale.

[0124] In all the above embodiments, each element described in the drawings as a functional block for performing various processes can be configured by a CPU, a memory, and other hardware circuits, and implemented by a program loaded into the memory in software. Therefore, it can be understood by those skilled in the art that these functional blocks can be implemented in various forms by separate hardware, separate software, or a combination thereof, and the present invention is not limited to any of them.

[0125] Various types of non-transitory computer-readable media may also be used to store the program and provide it to the computer. Non-transitory computer-readable media include various types of tangible storage media. Examples of non-transitory computer-readable media include magnetic recording media (e.g., floppy disks, magnetic tapes, hard disk drives), magneto-optical recording media (e.g., magneto-optical disks), CD-ROMs (read-only memory, CD-R, CD-R / W, solid-state memory (e.g., mask ROM, PROM (programmable ROM), EPROM (erasable PROM, flash ROM, RAM (random access memory)). The program may also be provided to the computer via various types of temporary computer-readable media. Examples of temporary computer-readable media include electrical signals, optical signals, and electromagnetic waves. Temporary computer-readable media may provide the program to the computer via wired or wireless communication paths, such as wires and optical fibers.

[0126] Although the invention made by the inventor has been specifically described based on the embodiment, the present invention is not limited to the embodiment that has been described, and it goes without saying that various modifications can be made without departing from the gist thereof. For example, the second embodiment and the third embodiment can be combined. Either or both of the features of the second embodiment and the features of the third embodiment can be applied to the fourth embodiment.

Claims

1. A data processing device, comprising: a memory protection setting storage unit storing a plurality of entries, each entry defining an address portion and used for memory protection set by a virtual machine monitor or for memory protection set by a virtual machine, wherein the number of entries for memory protection set by the virtual machine monitor and the number of entries for memory protection set by the virtual machine are configured to be dynamically changeable; a plurality of first determination circuits, each of which is provided for each of the entries and temporarily determines whether to permit the access request based on whether an access destination address of the access request corresponds to the entry; and a second determination circuit for determining, based on i) a temporary determination result of each of the first determination circuits; ii) entry boundary information and iii) access source information to determine whether to allow the access request, the entry boundary information dynamically defining which entry among the plurality of entries is the entry for memory protection set by the virtual machine monitor and which entry is the entry for memory protection set by the virtual machine, the access source information indicating whether the access request is access performed by the virtual machine monitor or access performed by the virtual machine; wherein, for the access source information indicating that the access request is an access performed by the virtual machine monitor, the second determination circuit is configured to: allow the access request when any temporary determination result indicates that the access destination address of the access request corresponds to the entry for memory protection set by the virtual machine monitor, and Wherein, for the access source information indicating that the access request is an access made by the virtual machine, the second determination circuit is configured to: allow the access request when any temporary determination result indicates that the access destination address of the access request corresponds to the entry for memory protection set by the virtual machine, and when any temporary determination result indicates that the access destination address of the access request corresponds to the entry for memory protection set by the virtual machine monitor.

2. The data processing device according to claim 1, in, The memory protection setting storage section further stores attribute information, the attribute information being information on an attribute of the access request associated with the entry, and Each of the plurality of first determination circuits temporarily determines whether to permit the access request based on whether the access destination address of the access request corresponds to the entry and whether an attribute of the access request matches the attribute information.

3. The data processing device according to claim 1 further includes a memory protection setting write control circuit, which controls the writing to the memory protection setting storage unit based on the address of the write target of the memory protection setting storage unit, the entry boundary information and the write source information, and the write source information indicates whether the writing is performed through the virtual machine monitor.

4. The data processing device according to claim 1, further comprising: An entry boundary information storage unit, storing the entry boundary information; and An entry boundary information write control circuit controls writing to the entry boundary information storage section based on an address specifying a write destination of the entry boundary information storage section and write source information indicating whether the writing is performed through the virtual machine monitor.

5. The data processing device according to claim 1, wherein: The second determination circuit notifies a processor of a determination result of the second determination circuit, and the processor executes the virtual machine monitor and the virtual machine and issues the access request. 6 . The data processing device according to claim 1 , further comprising a sequencer that saves information stored in the memory protection setting storage section to a memory and stores the information saved in the memory back to the memory protection setting storage section.

7. The data processing device according to claim 1, wherein: The entry indicates an entry in which the access request is allowed.

8. The data processing device according to claim 1, wherein: The entry indicates an entry in which an access request is prohibited.

9. A memory protection method, comprising: storing a plurality of entries in a memory protection setting storage unit, each entry defining an address portion and used for memory protection set by a virtual machine monitor or for memory protection set by a virtual machine, wherein the number of entries for memory protection set by the virtual machine monitor and the number of entries for memory protection set by the virtual machine are configured to be dynamically changeable; temporarily determining whether to allow the access request based on whether the access destination address of the access request corresponds to the entry; as well as Based on the results of the provisional determination described in i); ii) entry boundary information and iii) access source information to determine whether to allow the access request, the entry boundary information dynamically defining which entry among the plurality of entries is the entry for memory protection set by the virtual machine monitor and which entry is the entry for memory protection set by the virtual machine, the access source information indicating whether the access request is access performed by the virtual machine monitor or access performed by the virtual machine; wherein, for the access source information indicating that the access request is an access made by the virtual machine monitor, when any provisional determination result indicates that the access destination address of the access request corresponds to the entry for memory protection set by the virtual machine monitor, the access request is allowed, and Among them, for the access source information indicating that the access request is an access made by the virtual machine, when any temporary determination result indicates that the access destination address of the access request corresponds to the entry for memory protection set by the virtual machine, and when any temporary determination result indicates that the access destination address of the access request corresponds to the entry for memory protection set by the virtual machine monitor, the access request is allowed.

10. A data processing device, comprising: a memory protection setting storage unit having a predetermined size and storing a plurality of entries, each entry defining an address portion and used for memory protection set by the first virtual machine or for memory protection set by a virtual machine monitor, wherein the number of entries for memory protection set by the first virtual machine and the number of entries for memory protection set by the virtual machine monitor are configured to be dynamically changeable; a plurality of first determination circuits, each of which is provided for each of the entries and temporarily determines whether to permit the access request based on whether an access destination address of the access request corresponds to the entry; and an entry boundary information storage unit storing entry boundary information to dynamically define an entry corresponding to a first size of the memory protection setting storage unit for the virtual machine monitor among the plurality of entries and an entry corresponding to a second size of the memory protection setting storage unit for the first virtual machine among the plurality of entries, wherein a total size of the first size and the second size is equal to or smaller than the predetermined size; a second determination circuit for determining, based on i) a temporary determination result of each of the first determination circuits; ii) entry boundary information and iii) access source information to determine whether to allow the access request, the access source information indicating whether the access request is a first access request from the virtual machine monitor or a second access request from the first virtual machine; wherein, when an entry stored in the area of ​​the memory protection setting storage section specified by the first size includes the address of the first access request, the second determination circuit determines that the first access request is permitted, and Wherein, when the entry stored in the area of ​​the memory protection setting storage unit specified by the first size and the entry stored in the area of ​​the memory protection setting storage unit specified by the second size both include the address of the second access request, the second determination circuit determines to allow the second access request.

11. The data processing device according to claim 10, in, The entry boundary information storage unit stores the entry boundary information to further set a third size of the memory protection setting storage unit for the virtual machine monitor, and further set a fourth size of the memory protection setting storage unit for the second virtual machine, wherein a total size of the third size and the fourth size is equal to or smaller than the predetermined size, wherein, when the data processing device executes the first virtual machine and the virtual machine monitor, the second determination circuit determines whether to allow an access request from one of the first virtual machine and the virtual machine monitor based on the first size and the second size, and When the data processing device executes the second virtual machine and the virtual machine monitor, the second determination circuit determines whether to allow an access request from one of the second virtual machine and the virtual machine monitor based on the third size and the fourth size.

Images