Semiconductor device, reading method, and program

Abstract

The invention relates to a semiconductor device, a reading method, and a program. A semiconductor device includes a non-volatile memory (NVM) capable of data writing even after the semiconductor device is pushed out. When a read request is issued, a semiconductor reads and outputs the content stored in the region of the NVM in place of the replacement target data in the instruction code stored in the read-only memory. Thus, after the semiconductor device is presented, replacement data may be obtained in place of data to be replaced even if a defect, such as vulnerability, is found in the code used at the time of startup of the semiconductor device. That is to say, the semiconductor device enables a replacement process of a modification patch using a boot ROM code.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] The contents disclosed in Japanese Patent Application No. 2023-183399 filed on October 25, 2023 including the specification, drawings and abstract are incorporated herein by reference in their entirety. Background Art

[0003] The present disclosure relates to a semiconductor device, a method, and a program, and, for example, to a semiconductor device, a method, and a program that allow replacement of data stored in a ROM.

[0004] The disclosed techniques are listed below.

[0005] [Patent Document 1] Japanese Patent Application Publication No. 2002-149431

[0006] Patent Document 1 discloses a microcomputer that allows patch correction by storing a patch loading program and providing a patch loading ROM (Read Only Memory) selected by an activation selection signal from an activation selection circuit. Summary of the invention

[0007] Not limited to the microcomputer disclosed in Patent Document 1, in semiconductor devices, it is required to be able to replace data stored in ROM.

[0008] Other objects and novel features will become apparent from the description of this specification and the accompanying drawings.

[0009] A semiconductor device according to one aspect of the present disclosure includes: a read-only memory (ROM) in which data is stored; a non-volatile memory (NVM) in which replacement data of at least a portion of the data is stored; and a controller that executes reading of data from the ROM or reading of the replacement data from the non-volatile memory in response to a request to read data from a processor.

[0010] According to a reading method of one aspect of the present disclosure, a semiconductor device receives a read request for data stored in a ROM, and in response to the read request, reads data from the ROM or reads replacement data from an NVM in which replacement data of at least a portion of the data is stored.

[0011] A program according to one aspect of the present disclosure accepts a request to read data stored in a ROM, and in response to the read request, performs reading of data from the ROM or reading replacement data from a nonvolatile memory in which replacement data of at least a portion of the data is stored.

[0012] The present disclosure can provide a semiconductor device, a method, and a program that allow replacement of data stored in a ROM. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 is a block diagram showing a configuration example of a semiconductor device that has been studied in advance.

[0014] Figure 2 is a block diagram showing a configuration example of a semiconductor device according to a first embodiment.

[0015] Figure 3A is a flowchart showing an example of a typical process of the semiconductor device according to the first embodiment.

[0016] Figure 3B is a flowchart showing an example of a typical process of the semiconductor device according to the first embodiment.

[0017] Figure 4 is a block diagram showing a configuration example of a semiconductor device according to a second embodiment.

[0018] Figure 5A is a flowchart showing an example of a typical process of the semiconductor device according to the second embodiment.

[0019] Figure 5B is a flowchart showing an example of a typical process of the semiconductor device according to the second embodiment.

[0020] Figure 5C is a flowchart showing an example of a typical process of the semiconductor device according to the second embodiment.

[0021] Figure 5D is a flowchart showing an example of a typical process of the semiconductor device according to the second embodiment. DETAILED DESCRIPTION

[0022] Hereinafter, the embodiments will be described with reference to the accompanying drawings. Since the accompanying drawings are simplified, the technical scope of the embodiments should not be narrowly interpreted based on the description of the accompanying drawings. Further, the same elements are represented by the same reference numerals without redundant description.

[0023] In the following embodiments, for convenience, they are described by being divided into a plurality of parts or embodiments. However, unless otherwise specified, they are not mutually related, and in the relationship of partial or complete modification of another, one is an application example, a detailed description, a supplementary description, etc. In the following embodiments, the number of elements, etc. (including the number of elements, numerical values, quantities, ranges, etc.) is not limited to a specific number, but may be not less than or equal to a specific number, except where the number is specifically indicated and is clearly limited to a specific number in principle.

[0024] Furthermore, in the following embodiments, it goes without saying that constituent elements (including operating steps, etc.) are not necessarily essential except for the case where they are specifically indicated and the case where they are deemed to be obviously essential in principle. Similarly, in the following embodiments, when the shapes, positional relationships, etc. of components, etc. are mentioned, it is assumed that the shapes, etc. are substantially approximate or similar to the shapes, etc. except for the case where they are specifically specified and the case where they are deemed to be essential in principle, etc. The same applies to the above-mentioned numbers, etc., including numbers, values, quantities, ranges, etc.

[0025] The configurations or processes shown in the embodiments may be appropriately combined with the configurations or processes shown in other embodiments.

[0026] (Preliminary study by the inventor)

[0027] Before describing the semiconductor device according to the present embodiment, the present inventors will describe a semiconductor device that has been studied in advance.

[0028] In recent years, the technology of interconnection and ADAS (Advanced Driver Assistance System) has been developed in the automotive field. With the development of this technology, many vehicle-mounted electronic devices (such as vehicle-mounted cameras, driving recorders, and car navigation systems) have been installed in the car and connected to the network. Here, when the vehicle-mounted electronic devices are connected to the network, the risk of the vehicle-mounted electronic devices being exposed to network attacks by hackers and the like increases. Therefore, it is more important to improve the safety of semiconductor devices to be installed on vehicle-mounted electronic devices.

[0029] Generally, among the codes stored in semiconductor devices, the codes in which vulnerabilities are found are updated through technologies such as OTA (Over The Air), and countermeasures against the vulnerabilities are implemented. However, there is a problem that if there are vulnerabilities in the codes in the memory (such as ROM), it is difficult to modify such codes, and the codes cannot be changed after shipment.

[0030] Figure 1 1 is a block diagram showing a configuration example of a semiconductor device S1 that has been studied in advance to solve this problem. The semiconductor device S1 includes a ROM 10 , a ROM controller 20 , a bus 30 , and a CPU (Central Processing Unit) 40 .

[0031] The ROM 10 includes an instruction code D1 executed by the CPU 40. The instruction code D1 stored in the ROM 10 cannot be rewritten or modified. The ROM 10 is connected to an input terminal of a multiplexer 24 of a ROM controller 20. When receiving a command such as a CPU, the ROM 10 outputs data on the ROM 10 corresponding to an address requested by the command to the ROM controller 20.

[0032] The ROM controller 20 includes an address storage register 21, an AND circuit 22, a code storage register 23, and a multiplexer 24. The address storage register 21 stores information of an address AD1 in which a code to be replaced is stored in an instruction code D1 among storage addresses of the ROM 10. The AND circuit 22 receives a read address RA output from the CPU 40 through the bus 30 and an address AD1 output from the address storage register 21. The AND circuit 22 outputs "1" as an output value when the input read address RA and address AD1 are consistent, and outputs "0" as an output value when they are inconsistent.

[0033] The code storage register 23 includes a replacement code CD1, which is used as a substitute for the code to be replaced in the instruction code D1. The replacement code CD1 is replacement data for part or all of the instruction code D1. The multiplexer 24 receives the instruction code D1 output from the ROM 10 and the replacement code CD1 output from the address storage register 21. Further, the output value of the AND circuit 22 is input to the multiplexer 24 as a selection signal. When the selection signal is "0", the multiplexer 24 outputs the instruction code D1 as the read data RD. On the other hand, when the selection signal is "1", the multiplexer 24 outputs the replacement code CD1 as the read data RD.

[0034] The bus 30 connects the ROM controller 20 and the CPU 40. When the CPU 40 reads a predetermined storage address of the instruction code D1, the information of the storage address to be read is output as the read address RA. The CPU 40 obtains the read data RD output from the ROM controller 20 through the bus 30, thereby outputting the read address RA.

[0035] After the semiconductor device S1 is launched, it is found that there is a vulnerability problem in the instruction code D1 of the ROM 10, and some instruction codes D1 may need to be replaced. At this time, after the semiconductor device S1 is activated, the replacement code CD1 to be replaced is written into the code storage register 23, and the address AD1 of the replacement code CD1 is written into the address storage register 21. When the CPU 40 reads the address AD1, this operation changes the read destination of the ROM controller 20 from the ROM 10 to the code storage register 23. Therefore, the CPU 40 reads the replacement code CD1 of the address AD1. Therefore, the vulnerability problem can be solved.

[0036] However, in Figure 1 The technology shown has the following problems.

[0037] (1) After the semiconductor device S1 is started once, the semiconductor device S1 needs to perform writing in the address storage register 21 and the code storage register 23. Therefore, the semiconductor device S1 cannot replace the code read by the CPU 40 at the time of startup.

[0038] As a general security measure, it is conceivable to introduce a secure boot function that checks the accuracy of software executed on a semiconductor device before executing the software into the semiconductor device. The secure boot function is performed by code pre-installed on a ROM in the semiconductor device (hereinafter also referred to as boot ROM code). However, in Figure 1 In the technology shown, when part of the boot ROM code needs to be replaced, it is considered difficult to implement the replacement.

[0039] Further, Figure 1 The technique shown also raises the following problems.

[0040] (2) Generally, the register area is small, so the amount of data that can be stored in the code storage register 23 is small. Therefore, the size of the code that can be replaced in the instruction code D1 is reduced.

[0041] The semiconductor devices shown in the following embodiments can solve the above-mentioned problems.

[0042] (First embodiment)

[0043] (Configuration description)

[0044] Figure 2 1 is a block diagram showing a configuration example of a semiconductor device S10 according to the first embodiment. The device S10 includes a ROM 110 , an NVM 120 , a ROM controller 130 , a bus 140 , a CPU 150 , and a PLC (Programmable Logic Controller) 160 .

[0045] ROM 110 includes instruction code D11 executed by CPU 150. The instruction code D11 stored in ROM 110 cannot be rewritten or modified. For example, instruction code D11 may be a boot ROM code. When receiving a command from CPU 150, ROM 110 outputs data on ROM 110 corresponding to the address requested by the command to ROM controller 130. Hereinafter, the area storing instruction code D11 is also described as area D11. Area D11 of ROM 110 is connected to a first input terminal of multiplexer 132.

[0046] The NVM 120 is a nonvolatile memory that maintains a state even when not powered. The NVM 120 stores replacement codes CD1, which are used as substitutes for the code to be replaced in the instruction code D11. The replacement code RC1 is replacement data for part or all of the instruction code D11. Further, the NVM 120 stores information (first address information) of a replacement address RA1 as the address of the storage address of the ROM 110, where the code to be replaced is stored in the instruction code D11.

[0047] In the following, the region storing the replacement code RC1 is described as region RC1, and the region storing the replacement address RA1 is also described as region RA1. Region RC1 and region RA1 are also collectively referred to as a patch region. Region RC1 of NVM 120 is connected to the second input terminal of multiplexer 132, and region RA1 is connected to the first input terminal of AND circuit 131.

[0048] The semiconductor device S10 may rewrite the data stored in the NVM 120 using the PLC 160 after manufacturing. For example, the NVM 120 may be a one-time rewritable OTP (One Time Programmable) memory. However, the specific embodiment of the NVM 120 is not limited thereto.

[0049] The ROM controller 130 includes a circuit having an AND circuit 131 and a multiplexer 132. A first input terminal of the AND circuit 131 is connected to the area RA1, and a second input terminal of the AND circuit 131 is connected to the bus 140. Therefore, the read address RA output from the CPU 150 through the bus 140 and the replacement address RA1 read from the area RA1 are input to the AND circuit 131. The AND circuit 131 outputs "1" as an output value when the input read address RA and the replacement address RA1 coincide, and outputs "0" as an output value when they do not coincide.

[0050] The region D11 is connected to a first input terminal of the multiplexer 132, and the region RC1 is connected to a second input terminal of the multiplexer 132. Therefore, the instruction code D11 output from the ROM 110 and the replacement code RC1 output from the NVM 120 are input to the multiplexer 132. Further, the output of the multiplexer 132 and the AND circuit 131 are input as a selection signal. When the selection signal is "0", the multiplexer 132 outputs the instruction code D11 as the read data RD. On the other hand, when the selection signal is "1", the multiplexer 132 outputs the replacement code RC1 as the read data RD.

[0051] The bus 140 connects the ROM controller 130, the CPU 150, and the PLC 160 to each other. When the CPU 150 performs reading on a predetermined storage address of the ROM 110, information of the storage address to be read is output as a read address RA. Then, the CPU 150 outputs the read address RA to obtain the read data RD output from the ROM controller 130 through the bus 140.

[0052] The PLC 160 is a write sequencer that rewrites any data stored in the NVM 120 upon receiving a command such as the CPU 150 .

[0053] (Description of process flow)

[0054] Figure 3A and Figure 3B 1 and 2 are flowcharts showing an example of the process of the semiconductor device S10, and with reference to these flowcharts, an outline of the process of the semiconductor device S10 is described. Incidentally, for a portion that has been described for each process, the description thereof is omitted as appropriate.

[0055] First, as Figure 3A As shown, the PLC 160 writes the replacement address RA1 into the area RA1 of the NVM 120. The PLC 160 also writes the replacement code RC1 used as a substitute for the code to be replaced into the area RC1 of the NVM 120 (in step S11). The PLC 160, for example, executes the process of the correction operation described in step S11 in response to the command of the CPU 150 when or after the semiconductor device S10 is ejected.

[0056] Next, after step S11, refer to Figure 3B The process performed after the semiconductor device S10 is activated is described. When reading data of the ROM 110, the CPU 150 outputs information of an address to be read to the bus 140 as a read address RA, and outputs a read request to the ROM controller 130 (in step S12).

[0057] The ROM controller 130 changes the operation depending on whether the read address RA for which the read request has been issued matches the replacement address RA1 (in step S13). If the read address RA matches the replacement address RA1 ("Yes" in step S13), the ROM controller 130 reads from the area RC1 of the NVM 120 instead of reading from the ROM 110. The ROM controller 130 outputs the read replacement code RC1 as read data RD to the bus 140 (in step S14).

[0058] On the other hand, if the read address RA does not correspond to the replacement address RA1 (No in step S13), the ROM controller 130 reads data from the ROM 110. The ROM controller 130 outputs the read instruction D11 as read data RD to the bus 140 (in step S15).

[0059] As described above, the semiconductor device S10 includes the NVM 120 that can write data even after the semiconductor device is launched. When a read request is issued, the ROM controller 130 reads and outputs the content stored in the area RC1 of the NVM 120, replacing the replacement target data in the instruction code D11 stored in the ROM 110. Therefore, after the semiconductor device S10 is launched, even if a defect (such as vulnerability) is found in the code used when the semiconductor device S10 is started, the CPU 150 can obtain replacement data to replace the data to be replaced. That is, the semiconductor device S10 enables the replacement process using the modified patch of the boot ROM code, which can solve the problem of (1).

[0060] (Description of changes)

[0061] In the first embodiment, the PLC 160 can also perform the following process: For the PLC 160, the CPU 150, etc., a normal mode (first mode) or a special mode for testing (second mode) from outside the PLC 160 can be designated.

[0062] When the normal mode is designated, the PLC 160 does not perform an operation of writing information of the replacement address RA1 or the replacement code RC1 or information of the replacement address RA1 and the replacement code RC1 to the patch area of ​​the NVM 120. In the normal mode, even if a command to write to the patch area is sent to the PLC 160, the command is not executed and fails.

[0063] On the other hand, when the special mode is specified, the PLC 160 performs an operation of writing information of the replacement address RA1 or the replacement code RC1 or information of the replacement address RA1 and the replacement code RC1 to the patch area of ​​the NVM 120. The special mode is specified, for example, when a vulnerability is found in the semiconductor device S10, and the CPU 150 performs writing of replacement data.

[0064] In the variation shown above, the normal mode restricts writing to the patch area. Therefore, even if writing to the patch area is not necessary, it is possible to suppress the illegal replacement of the instruction code by writing to the patch area. In other words, there is a possibility of misusing the writing function to the patch area.

[0065] (Second embodiment)

[0066] (Configuration description)

[0067] Figure 42 is a block diagram showing a configuration example of a semiconductor device S20 according to the second embodiment. The semiconductor device S20 includes a ROM 210, an NVM 220, a ROM controller 230, a bus 240, a CPU 250, and a PLC 260. In the following description of the semiconductor device S20, the points previously described in the description of the semiconductor device S10 are omitted as appropriate.

[0068] ROM 210 stores instruction code D21 executed by CPU 250 and entry table E1 (first jump destination information) for making CPU 250 jump to additional coding area on NVM 220. For example, instruction code D21 may be, but is not limited to, boot ROM code. Entry table E1 includes code for CPU 250 to read out. When CPU 250 reads the code, CPU 250 reads the address indicated in jump destination table JT (second address information) stored in NVM 220 and jumps to the read address. When receiving a command from, for example, CPU 250, ROM 210 outputs data on ROM 210 corresponding to the address requested by the command to ROM controller 230. In the following, the area storing instruction code D21 is also described as area D21. Area D21 of ROM 210 is connected to the first input terminal of multiplexer 232.

[0069] NVM 220 is a non-volatile memory that maintains storage even when not powered. NVM 220 stores replacement codes RC2, which are used as substitutes for the code to be replaced in the instruction code D21. The replacement code RC2 is a code (second jump destination information) for the relative jump instruction of the entry table E1 stored in ROM 210. Further, NVM 220 stores information (first address information) of the replacement address RA2 as the address of the storage address of ROM 210, wherein the code to be replaced is stored in the instruction code D21 read by the CPU 250. In the following, the area storing the replacement code RC2 is described as area RC2, and the area storing the replacement address RA2 is also described as area RA2. Area RC2 and area RA2 are also collectively described as a patch area (second area). Area RC2 of NVM 120 is connected to the second input terminal of the multiplexer 132, and area RA2 is connected to the first input terminal of the AND circuit 131.

[0070] Additionally, when the instruction code D21 is executed, the NVM 220 stores the additional code AC to be executed, replacing the code to be replaced in the instruction code D21. The additional code AC is a permutation of part or all of the instruction code D21. In the NVM 220, the entry address of the additional code AC is stored in the jump destination table JT. In the following, the area where the NVM 220 stores the jump destination table JT is described as the area JT, and the area where the NVM 220 stores the additional code AC is also described as the area AC. The area JT and the area AC are also collectively referred to as the additional code area (first area).

[0071] The semiconductor device S20 may rewrite data stored in the NVM 220 after manufacturing using the PLC 260. For example, the NVM 220 may be an OTP memory, but embodiments of the NVM 220 are not limited thereto.

[0072] The ROM controller 230 includes a circuit having an AND circuit 231 and a multiplexer 232. Since the configuration and operation of the AND circuit 231 and the multiplexer 232 are similar to those of the AND circuit 131 and the multiplexer 132 shown in the first embodiment, detailed description thereof will be omitted.

[0073] Since the configuration and operation of the bus 240 , the CPU 250 , and the PLC 260 are the same as those of the bus 140 , the CPU 150 , and the PLC 160 , a detailed description thereof will be omitted.

[0074] (Description of process flow)

[0075] Figure 5A and Figure 5D 1 and 2 are flowcharts showing exemplary processes of the semiconductor device S20, and an outline of the processes of the semiconductor device S20 is described with reference to these flowcharts. Incidentally, for a portion that has been described for each process, a description thereof is omitted as appropriate.

[0076] First, as Figure 5A As shown, in the manufacturing stage of the semiconductor device S20, the entry table E1 is stored in the ROM 210 (in step S21).

[0077] Now refer to Figure 5B The process completed after step S11 is described. The PLC 260 writes the replacement address RA1 into the area RA2 of the NVM 220. The PLC 260 also writes the code of the relative jump instruction as the replacement code RC2 into the area RC2 of the NVM 220 (in step S22).

[0078] The PLC 260 writes the additional code AC into the area AC by writing the jump destination table JT including the entry address of the additional code AC into the area JT (in step S23). At this time, the PLC 260 writes the return command into the area AC so that after the additional code AC has been read, the CPU 250 jumps to the predetermined position on the ROM 210, and the data of the jump destination is read. For example, the predetermined position may be the following instruction of the code replaced by the replacement code RC2 in the instruction code D21. Alternatively, the predetermined position may be the suffix of the function of the code replaced by the replacement code RC2. The PLC 260, for example, when or after the semiconductor device S20 is ejected, executes the process of the correction operation described in steps S22 and S23 in response to the CPU 250 command.

[0079] Next, after step S23, refer to Figure 5C and Figure 5D The process performed after the semiconductor device S20 is activated is described. The CPU 250 outputs a read request to the ROM controller 230 (in step S24). Such details are similar to step S12.

[0080] The ROM controller 230 changes the operation according to whether the read address RA for which the read request has been issued matches the replacement address RA2 (in step S25). If the read address RA matches the replacement address RA2 ("Yes" in step S25), the ROM controller 230 reads the replacement code RC2 from the area RC2 instead of reading the instruction code D21 from the ROM 210. The ROM controller 230 outputs the replacement code RC2 as the read data RD to the bus 240 (in step S26). Such details are similar to steps S13 and S14.

[0081] On the other hand, when the read address RA does not match the replacement address RA2 (No in step S25), the ROM controller 230 reads the instruction code D21 from the ROM 210 and outputs it as the read data RD to the bus 240 (in step S27). This detail is similar to step S15.

[0082] Next, we will refer to Figure 5B The detailed process performed by the CPU 250 when executing step S26 is described below. Figure 5A As shown, if the read address RA matches the replacement address RA2, the replacement code RC2 is output as the read data RD to the bus 240. The CPU 250 reads the replacement code RC2 thereof (in step S31).

[0083] The CPU 250 jumps to the entry table E1 stored in the ROM 210 by reading the replacement code RC2 (in step S32). The CPU 250 reads the code included in the entry table E1, reads the entry address of the additional code AC from the jump destination table JT stored in the NVM 220 (in step S33), and then jumps to the additional code AC indicated by the read entry address (in step S34).

[0084] The CPU 250 reads and executes the additional code AC stored in the jump destination (in step S35). When the additional code AC is executed, a function is added to the instruction code D21, or an error such as a vulnerability is responded to. The CPU 250 jumps to a predetermined position in the ROM 210 by reading the return instruction of the area AC, and performs reading of the data to be jumped (in step S36).

[0085] For the same reason as the semiconductor device S10 of the first embodiment, even when a defect (such as vulnerability) is found in the boot ROM code after the semiconductor device S20 is launched, the CPU 250 can obtain replacement data instead of the data to be replaced. Further, in the semiconductor device S20, the code capacity of the replacement data can be increased compared to when the replacement data is stored in the register. Therefore, the problems (1) and (2) can be solved.

[0086] Further, in the ROM 210 of the semiconductor device S20, an entry table E1 for jumping to the additional code area of ​​the NVM 220 is stored. The patch area of ​​the NVM 220 stores the replacement code RC2 for jumping to the entry table E1, and the additional code area stores the additional code AC. If the read address RA matches the replacement address RA2, the CPU 250 accesses the entry table E1 by referring to the replacement code RC2, accesses the additional code AC by referring to the entry table E1, and reads the additional code AC. Therefore, by using the entry table E1, as long as the PLC 160 writes a 1-word instruction to the replacement code RC2, the CPU 250 can jump to anywhere in the NVM 220.

[0087] If the additional code AC is a high-capacity code, the PLC 160 may not be able to store the additional code AC in the patch area, and may be forced to store the additional code AC in an additional coding area that is outside the patch area. The additional coding area may be outside the jumpable area, as seen from the ROM 210. Even in such a case, the entry table E1 can be used to make the CPU 250 jump to any position in the additional coding area. Therefore, the semiconductor device S20 is not limited to the patch area, and the additional coding area capable of storing a large-capacity code can be used for storage applications of the additional code. Therefore, since a large-capacity additional code can be introduced in the semiconductor device S20, the semiconductor device S20 can accommodate more flexible instruction code modification or instruction code addition functions.

[0088] Furthermore, in the second embodiment, all data to be replaced can be stored in the ROM 210 and the NVM 220, and no additional memory is required. Therefore, the number of components of the circuit required for the replacement process can be suppressed. That is, the configuration of the semiconductor device S20 can suppress the cost of the semiconductor device.

[0089] Further, by referring to the input table E1 stored in the ROM 210, the CPU 250 reads the entry address of the additional code AC from the jump destination table JT stored in the NVM 220, and then jumps to the additional code AC indicated by the read entry address. Here, even when different additional codes D21 of different contents are required at multiple places of the instruction code D21, by setting the jump destination table AC for each additional code AC, the CPU 250 can read the additional code AC corresponding to the part of the instruction code D21. Therefore, various additional codes AC can be flexibly introduced into the semiconductor device S20.

[0090] The additional code area is not connected to the ROM controller 230, and the patch area is connected to the ROM controller 230. Even in such a case, the CPU 250 can obtain the additional code AC stored in the position where the NVM 220 is not connected to the ROM controller 230. Therefore, the configurations of the NVM 220 and the ROM controller 230 can be freely changed, and the flexibility of the circuit configuration of the semiconductor device S20 can be increased.

[0091] The present disclosure is not limited to the above embodiments, and may be changed as appropriate without departing from the scope.

[0092] For example, in the semiconductor device S10 in the first embodiment, any type of processor may be used instead of the CPU 150. The ROM controller 130 may be provided with any circuit capable of executing the process shown in the above flowchart instead of the AND circuit and the multiplexer. In the semiconductor device S10, for example, at least the bus 140 or the PLC 160 may not be provided. The changes shown above are also applicable to the semiconductor device S20 in the second embodiment.

[0093] The semiconductor devices described in the above embodiments, such as vehicle-mounted cameras and driving recorders, can be installed in vehicle-mounted electronic devices such as car navigation, but the devices in which the semiconductor devices can be installed are not limited thereto.

[0094] Furthermore, part or all of the processes performed by the ROM controller 130 or the ROM controller 230 may be implemented by causing the CPU to execute a computer program.

[0095] The above-mentioned program includes a set of instructions (or software codes) for causing the computer to perform one or more functions described in the embodiment when read into the computer. The program can be stored on a non-transitory computer-readable medium or a tangible storage medium. For example, but not limited to, a computer-readable medium or a tangible storage medium includes: RAM (random access memory), ROM (read-only memory), flash memory, SSD (solid state drive) or other memory technology, CD-ROM, DVD (digital versatile disk), Blu-ray (registered trademark) optical disk or other optical disk storage device, cassette, magnetic tape, magnetic disk storage device or other magnetic storage device. The program can be transmitted on a temporary computer-readable medium or communication medium. For example, but not limited to, a temporary computer-readable medium or communication medium includes electrical, optical, acoustic or other forms of propagation signals.

[0096] Although the present invention invented by the present inventors has been specifically described based on the embodiments, the present invention is not limited to the above-mentioned embodiments, and it goes without saying that various modifications can be made without departing from the spirit thereof.

Claims

1. A semiconductor device comprising: a read-only memory in which data is stored; a non-volatile memory in which replacement data for at least part of the data is stored; as well as The controller reads the data from the read-only memory or reads the replacement data from the nonvolatile memory in response to a data read request from the processor.

2. The semiconductor device according to claim 1, wherein first address information is stored in the non-volatile memory, the first address information indicating a storage address of the at least part of the data stored in the read-only memory, Wherein when the address indicated by the data read request is the same as the storage address indicated by the first address information, the controller reads the replacement data from the nonvolatile memory.

3. The semiconductor device according to claim 1, further comprising: The programmable controller does not write the replacement data in a first mode and writes the replacement data in a second mode with respect to an area in which the replacement data is stored in the nonvolatile memory.

4. The semiconductor device according to claim 1, first jump destination information for jumping to a first area of ​​the nonvolatile memory is stored in the read-only memory, second destination information for jumping to the first jump destination information is stored in a second area of ​​the nonvolatile memory, When the controller reads the replacement data from the nonvolatile memory, the processor accesses the first jump destination information by referring to the second jump destination information, accesses the replacement data by referring to the first jump destination information, and reads the replacement data.

5. The semiconductor device according to claim 4, wherein second address information indicating a storage address of the replacement data is stored in the first area, The processor accesses the second address information by referring to the first jump destination information, and reads the replacement data by referring to the second address information.

6. The semiconductor device according to claim 4, Wherein the first area is not connected to the controller, and the second area is connected to the controller.

7. A method performed by a semiconductor device having a read-only memory storing data and a non-volatile memory storing replacement data for at least part of the data, The method comprises: accepting a request to read data stored in the read-only memory; as well as In response to a data read request from a processor, reading the data from the read-only memory or reading the replacement data from the nonvolatile memory is performed.

8. The method according to claim 7, wherein first address information is stored in the non-volatile memory, the first address information indicating a storage address of the at least part of the data stored in the read-only memory, Wherein when the address indicated by the data read request is the same as the storage address indicated by the first address information, the semiconductor device reads the replacement data from the nonvolatile memory.

9. The method according to claim 7, The semiconductor device does not write the replacement data in a first mode and writes the replacement data in a second mode with respect to a region in which the replacement data is stored in the nonvolatile memory.

10. The method according to claim 7, first jump destination information for jumping to a first area of ​​the nonvolatile memory is stored in the read-only memory, second destination information for jumping to the first jump destination information is stored in a second area of ​​the nonvolatile memory, When the controller reads the replacement data from the nonvolatile memory, the processor accesses the first jump destination information by referring to the second jump destination information, accesses the replacement data by referring to the first jump destination information, and reads the replacement data.

11. The method according to claim 10, wherein second address information indicating a storage address of the replacement data is stored in the first area, wherein the semiconductor accesses the second address information by referring to the first jump destination information, and reads the replacement data by referring to the second address information.

12. A non-transitory memory for non-transitory storage of a computer program for execution by at least one processor, wherein the computer program comprises: code for accepting a request to read data stored in a read-only memory; as well as Code is configured to execute, in response to a data read request, reading the data from the read-only memory or reading the replacement data from the non-volatile memory.

13. The non-transitory memory according to claim 12, wherein first address information is stored in the non-volatile memory, the first address information indicating a storage address of the at least part of the data stored in the read-only memory, The program further includes code for reading the replacement data from the nonvolatile memory when an address indicated by the data read request is identical to the storage address indicated by the first address information.

Images