Semiconductor device, reading method and program

Abstract

A semiconductor device contains non-volatile memory (NVM) capable of writing data even after the device has been shipped. When a read request is made, the semiconductor reads and outputs the contents stored in the NVM area instead of the backup target data in the instruction code stored in read-only memory. Therefore, even if a defect, such as a vulnerability in the code used at the start of the device, is discovered after the semiconductor device has been shipped, backup data can be obtained instead of the data that was intended to be replaced. In other words, the semiconductor device enables a backup process using the modified patches of the boot ROM cable.

Description

CROSS-REFERENCE TO RELATED APPLICATIONS

[0001] The disclosure of Japanese Patent Application No. 2023-183399, filed on October 25, 2023, including the specification, drawings, and abstract, is incorporated herein by reference in its entirety. BACKGROUND

[0002] The present disclosure relates to semiconductor devices, methods and programs, and for example to semiconductor devices, methods and programs that enable the exchange of data stored in a ROM.

[0003] Techniques are revealed which are listed below.

[0004] [Patent Document 1] Japanese Patent Application Laid-Open No. 2002-149431

[0005] By storing the patch load program provided with a patch load ROM (read only memory) selected by the enable selection signal from the enable selection circuit, a microcomputer enabling patch correction is disclosed. SUMMARY

[0006] Not limited to the microcomputer disclosed in Patent Document 1, in the semiconductor device, it is required to be able to replace the data stored in the ROM.

[0007] Other objects and novel features will become apparent from the description of this application and the accompanying drawings.

[0008] A semiconductor device according to one aspect of the present disclosure includes a read-only memory (ROM) in which data is stored, a non-volatile memory (NVM) in which replacement data of at least a part of the data is stored, and a control device that performs either reading the data from the ROM or reading the replacement data from the non-volatile memory in response to a request to read the data from a processor.

[0009] A reading method according to an aspect of the present disclosure, wherein the semiconductor device receives a read request of data stored in a ROM and either reads the data from the ROM or reads the replacement data from an NVM in which replacement data of at least a part of the data is stored in response to the read request.

[0010] A program according to one aspect of the present disclosure accepts a request to read data stored in a ROM and, in response to the read request, executes either reading the data from the ROM or reading the replacement data from a non-volatile memory in which replacement data of at least a portion of the data is stored.

[0011] The present disclosure may provide a semiconductor device, a method, and a program that enable the exchange of data stored in a ROM. BRIEF DESCRIPTION OF THE DRAWINGS Fig. 1 is a block diagram showing a configuration example of a semiconductor device studied in advance. Fig. 2 is a block diagram showing a configuration example of a semiconductor device according to a first embodiment. Fig. 3A is a flowchart showing an example of a typical process of the semiconductor device according to the first embodiment. Fig. 3B is a flowchart showing an example of a typical process of the semiconductor device according to the first embodiment. Fig. 4 is a block diagram showing a configuration example of a semiconductor device according to a second embodiment. Fig. 5A is a flowchart showing an example of a typical process of the semiconductor device according to the second embodiment. Fig. 5B is a flowchart showing an example of a typical process of the semiconductor device according to the second embodiment. Fig. 5C is a flowchart showing an example of a typical process of the semiconductor device according to the second embodiment. Fig. 5D is a flowchart showing an example of a typical process of the semiconductor device according to the second embodiment. DETAILED DESCRIPTION

[0012] An embodiment will be described below with reference to the drawings. Since the drawings are simplified, the technical scope of the embodiment should not be narrowly interpreted based on the description of the drawings. Furthermore, the same elements are denoted by the same reference numerals without redundant description.

[0013] In the following embodiments, where necessary for convenience, it will be described by dividing it into several sections or embodiments. However, unless otherwise stated, they are not related to each other; one refers to some or all of the other's modifications, application examples, detailed description, supplementary explanation, etc. In the following embodiments, the number of elements, etc. (including the number of elements, numerical values, quantities, ranges, etc.) is not limited to the specific number, but cannot be less than or equal to the specific number, except for cases where the number is specifically stated and is clearly limited to the specific number in principle.

[0014] Furthermore, in the following embodiments, the constituent elements (including the working steps and the like) are not necessarily essential except for the case where they are specifically stated and the case where they are considered to be essential in principle. Similarly, in the following embodiments, with reference to the shapes, positional relationships, and the like of components and the like, the shapes and the like are assumed to be substantially approximate or similar to the shapes and the like except for the case where they are specifically stated and the case where they are considered to be obvious in principle, and the like. The same applies to the above-mentioned numbers and the like, including the number, numerical value, amount, range, and the like.

[0015] The configuration or process shown in the embodiments may be appropriately combined with the configuration or process shown in other embodiments. (Preliminary investigation by the inventors)

[0016] Before describing the semiconductor device according to the present embodiment, the present inventors will first describe a semiconductor device that has been investigated.

[0017] Recently, the technology of connected and ADAS (Advanced Driver Assistance Systems) has been developed in the automotive field. With the development of such technology, many in-vehicle electronic devices, such as in-vehicle cameras, tachographs, and car navigation systems, have been installed in vehicles and connected to a network. When in-vehicle electronic devices are connected to the network, the risk of being exposed to cyberattacks by hackers or the like increases. Therefore, it is important to improve the security of the semiconductor devices to be mounted on the in-vehicle electronic devices.

[0018] Generally, among the codes stored in a semiconductor device, codes for which vulnerabilities are discovered are updated using techniques such as OTA (Over The Air), and countermeasures for the vulnerabilities are implemented. However, there is a problem that it is difficult to modify such code if a vulnerability, etc., exists in the code in memory that cannot be modified after shipment, such as ROM.

[0019] Fig. Figure 1 is a block diagram showing a configuration example of a semiconductor device S1 studied in advance to solve such a problem. The semiconductor device S1 includes a ROM 10, a ROM controller 20, a bus 30, and a CPU (Central Processing Unit) 40.

[0020] The ROM 10 contains instruction codes D1 that are executed by the CPU 40. The instruction codes D1 stored in the ROM 10 cannot be overwritten or modified. The ROM 10 is connected to the input terminals of a multiplexer 24 of the ROM controller 20. Upon receiving an instruction, such as from the CPU 40, the ROM 10 outputs the data on the ROM 10 corresponding to the address requested by the instruction to the ROM controller 20.

[0021] The ROM controller 20 includes address storage registers 21, an AND circuit 22, code storage registers 23, and the multiplexer 24. The address storage registers 21 store information of an address AD1, in which the code to be replaced in the instruction codes D1 is stored, among the memory addresses of the ROM 10. The AND circuit 22 receives a read address RA output from the CPU 40 via the bus 30 and the address AD1 output from the address storage registers 21. The AND circuit 22 outputs "1" as an output value when the input read address RA and the address AD1 match, and outputs "0" as an output value when they do not match.

[0022] The code storage registers 23 contain replacement codes CD1 used as alternatives to codes to be replaced in the instruction codes D1. The replacement codes CD1 are the replacement data of part or all of the instruction codes D1. The multiplexer 24 receives the instruction codes D1 output from the ROM 10 and the replacement codes CD1 output from the address storage registers 21. Furthermore, the output value of the AND circuit 22 is input to the multiplexer 24 as a selection signal. The multiplexer 24 outputs the instruction codes D1 as read data RD when the selection signal is "0." On the other hand, the multiplexer 24 outputs the replacement codes CD1 as read data RD when the selection signal is "1."

[0023] Bus 30 connects ROM controller 20 and CPU 40. When CPU 40 executes a read operation for a predetermined memory address of instruction codes D1, it outputs the information of the memory address to be read as a read address RA. CPU 40 receives a read data output RD from ROM controller 20 via bus 30 as a result of outputting the read address RA.

[0024] After the semiconductor device S1 is shipped, a vulnerability problem is discovered in the instruction codes D1 of the ROM 10, and some of them may need to be replaced. At this time, after the semiconductor device S1 is activated, the replacement codes CD1 to be replaced are written to the code storage registers 23, and the address AD1 of the replacement codes CD1 is written to the address storage registers 21. This process changes the read destination of the ROM controller 20 from the ROM 10 to the code storage registers 23 when the CPU 40 reads the address AD1. Therefore, the CPU 40 reads the replacement codes CD1 for the address AD1. Therefore, it is possible to solve the vulnerability problem.

[0025] At the Fig. However, the technique shown in Figure 1 has the following problems.

[0026] After the semiconductor device S1 is started once, the semiconductor device S1 must perform writing to the address storage registers 21 and the code storage registers 23. Therefore, the semiconductor device S1 cannot replace the code read from the CPU 40 during the startup process.

[0027] As a general security measure, it is conceivable to introduce the secure boot function, which verifies the accuracy of the software running on the semiconductor device before the software is executed in the semiconductor device. The secure boot functions are executed by codes on a ROM pre-mounted on the semiconductor device (hereinafter also referred to as boot ROM codes). Fig. However, with the technique shown in Figure 1, it is considered difficult to implement the replacement when the need arises to replace part of the boot ROM codes.

[0028] Furthermore, the Fig. 1 also has the following problems.

[0029] Generally, the register area is small, so the amount of data that can be stored in the code storage registers 23 is small. Therefore, the code size to be replaced in the instruction codes D1 is reduced.

[0030] In the semiconductor device shown in the following embodiments, it is possible to solve the problems described above. (First Embodiment)(Configuration Description)

[0031] Fig. 2 is a block diagram showing a configuration example of a semiconductor device S10 according to the first embodiment. The device S10 includes a ROM 110, an NVM 120, a ROM controller 130, a bus 140, a CPU 150, and a PLC (Programmable Logic Controller) 160.

[0032] The ROM 110 contains instruction codes D11 that are executed by the CPU 150. The instruction codes D11 stored in the ROM 110 cannot be overwritten or modified. For example, the instruction codes D11 may be boot ROM codes. Upon receiving instructions from the CPU 150, the ROM 110 outputs the data on the ROM 110 corresponding to the address requested by the instruction to the ROM controller 130. Hereinafter, an area in which the instruction codes D11 are stored is also referred to as an area D11. The area D11 of the ROM 110 is connected to a first input terminal of a multiplexer 132.

[0033] The NVM 120 is a non-volatile memory that retains its state even when no power is applied. The NVM 120 stores replacement codes RC1, which are used as alternatives to the code to be replaced in the instruction codes D11. The replacement codes RC1 are the replacement data of part or all of the instruction codes D11. Furthermore, the NVM 120 stores the information (first address information) of the replacement address RA1 as an address of the memory address of the ROM 110 in which the code to be replaced in the instruction codes D11 is stored.

[0034] Hereinafter, the area where the replacement codes RC1 are stored is referred to as the RC1 area, and the area where the replacement address RA1 is stored is also referred to as the RA1 area. The RC1 area and the RA1 area are also collectively referred to as patch areas. The RC1 area of ​​the NVM 120 is connected to a second input terminal of the multiplexer 132, and the RA1 area is connected to the first input terminal of an AND circuit 131.

[0035] The semiconductor device S10 can rewrite the data stored in the NVM 120 using the PLC 160 after manufacturing. For example, the NVM 120 can be a one-time rewritable OTP (One Time Programmable) memory. However, a specific embodiment of the NVM 120 is not limited thereto.

[0036] The ROM controller 130 includes circuits including the AND circuit 131 and the multiplexer 132. The first input terminal of the AND circuit 131 is connected to the area RA1, and the second input terminal of the AND circuit 131 is connected to the bus 140. Therefore, the read address RA output from the CPU 150 via the bus 140 and the replacement address RA1 read from the area RA1 are input to the AND circuit 131. The AND circuit 131 outputs "1" as an output value when the input read address RA and the replacement address RA1 match, and outputs "0" as an output value when they do not match.

[0037] The area D11 is connected to the first input terminal of the multiplexer 132, and the area RC1 is connected to the second input terminal of the multiplexer 132. Therefore, instruction codes D11 output from the ROM 110 and replacement codes RC1 output from the NVM 120 are input to the multiplexer 132. Further, the output of the AND circuit 131 is input to the multiplexer 132 as a selection signal. The multiplexer 132 outputs the instruction codes D11 as the read data RD when the selection signal is "0." On the other hand, the multiplexer 132 outputs the replacement codes RC1 as the read data RD when the selection signal is "1."

[0038] Bus 140 connects ROM controller 130, CPU 150, and PLC 160. When CPU 150 performs a read operation for a predetermined memory address of ROM 110, it outputs the information of the memory address to be read as read address RA. Then, CPU 150 outputs read address RA to receive read data output RD from ROM controller 130 via bus 140.

[0039] The PLC 160 is a write sequencer that rewrites all data stored in the NVM 120 when it receives an instruction, such as from the CPU 150. (Description of the process flow)

[0040] Fig. 3A and Fig. 3B are flowcharts showing process examples of a semiconductor device S10, and with reference to these flowcharts, an outline of the process of the semiconductor device S10 will be described. Otherwise, for the already described part of each process, the description will be omitted as appropriate.

[0041] First, the PLC writes 160, as in Fig. 3A, the replacement address RA1 is written to the area RA1 of the NVM 120. The PLC 160 also writes the replacement codes RC1, which are used as an alternative to the code to be replaced, to the area RC1 of the NVM 120 (in step S11). For example, at the time of shipment of the semiconductor device S10 or after shipment, the PLC 160 executes the correction operation process described in step S11 in response to the instruction of the CPU 150.

[0042] Next, after step S11, the process performed after the activation of the semiconductor device S10 will be described with reference to Fig. 3B. When reading the data of the ROM 110, the CPU 150 outputs the information of the address to be read to the bus 140 as a read address RA and issues a read request to the ROM controller 130 (in step S12).

[0043] The ROM controller 130 changes the process depending on whether the read address RA for which a read request was made matches the replacement address RA1 (in step S13). If the read address RA matches the replacement address RA1 ("Yes" in step S13), the ROM controller 130 reads from the area RC1 of the NVM 120 instead of from the ROM 110. The ROM controller 130 outputs the read replacement codes RC1 as a read data output RD to the bus 140 (in step S14).

[0044] On the other hand, when the read address RA does not match the replacement address RA1 (in "No" of step S13), the ROM controller 130 reads the data from the ROM 110. The ROM controller 130 outputs the read instruction codes D11 as a read data output RD to the bus 140 (in step S15).

[0045] As described above, the semiconductor device S10 includes the NVM 120, which can write data even after the semiconductor device is shipped. When a read request is made, the ROM controller 130 reads and outputs the contents stored in the area RC1 of the NVM 120 instead of the replacement target data in the instruction codes D11 stored in the ROM 110. Therefore, after the semiconductor device S10 is shipped, replacement data can be obtained from the CPU 150 instead of the data to be replaced, even if a defect such as a vulnerability is found in the code used at the start of the semiconductor device S10. That is, by enabling a replacement process in the semiconductor device S10 using the modified patches of the boot ROM cable, it is possible to solve the problems of (1). (Description of the variation)

[0046] In the first embodiment, the PLC 160 can also perform the following processes. For the PLC 160, the CPU 150, or the like, either the normal mode from outside the PLC 160 (a first mode) or a special mode for testing (a second mode) can be specified.

[0047] When the normal mode is specified, the PLC 160 does not perform any operation of writing the information of the replacement address RA1 or the replacement codes RC1, or the information of the replacement address RA1 and the replacement codes RC1, to the patched area of ​​the NVM 120. In the normal mode, even if the instruction to write to the patch area is sent to the PLC 160, the instruction is not executed and becomes invalid.

[0048] On the other hand, when the special mode is specified, the PLC 160 performs an operation of writing the information of the replacement address RA1 or the replacement codes RC1, or the information of the replacement address RA1 and the replacement codes RC1, into the patched area of ​​the NVM 120. For example, a special mode is specified when a vulnerability is discovered in the semiconductor device S10 and the CPU 150 performs the writing of the replacement data.

[0049] In the variations shown above, normal mode restricts writing to the patch area. Therefore, even though writing to the patch area isn't required, it's possible to suppress the situation where instruction code is illegally replaced by writing to the patch area. In other words, it's possible to suppress abuse of the write function to the patch area. (Second Embodiment)(Configuration Description)

[0050] Fig. 4 is a block diagram showing a configuration example of a semiconductor device S20 according to a second embodiment. The semiconductor device S20 includes a ROM 210, an NVM 220, a ROM controller 230, a bus 240, a CPU 250, and a PLC 260. In the description of the following semiconductor device S20, which was previously described in the description of the semiconductor device S10, the description will be omitted as appropriate.

[0051] The ROM 210 stores instruction codes D21 executed by the CPU 250 and an entry table E1 (first jump destination information) used to jump the CPU 250 to an additional coding area on the NVM 220. For example, the instruction codes D21 may be boot ROM codes, but are not limited to this. The entry table E1 contains codes for the CPU 250 to read. When the CPU 250 reads the codes, the CPU 250 reads the address specified in the jump destination table JT (second address information) stored in the NVM 220 and jumps to the read address. Upon receiving an instruction, such as from the CPU 250, the ROM 210 outputs the data on the ROM 210 corresponding to the address requested by the instruction to the ROM controller 230. Hereinafter, an area in which the instruction codes D21 are stored is also described as an area D21.The area D21 of the ROM 210 is connected to a first input terminal of a multiplexer 232.

[0052] The NVM 220 is a non-volatile memory that retains memory even when no power is supplied. The NVM 220 stores replacement codes RC2 used as an alternative to the code to be replaced in the instruction codes D21. The replacement codes RC2 are the codes (second jump destination information) of the relative jump instruction to the entry table E1 stored in the ROM 210. Further, the NVM 220 stores the information (first address information) of the replacement address RA2 as an address of the memory address of the ROM 210 in which the code to be replaced is stored in the instruction codes D21 read by the CPU 250. Hereinafter, the area in which the replacement codes RC2 are stored is referred to as the RC2 area, and the area in which the replacement address RA2 is stored is also referred to as the RA2 area. The RC2 area and the RA2 area are also collectively described as patched areas (second areas).The region RC2 of the NVM 120 is connected to a second input terminal of the multiplexer 132, and the region RA2 is connected to the first input terminal of an AND circuit 131.

[0053] In addition, the NVM 220 stores additional codes AC to be executed instead of the code to be replaced in the instruction codes D21 when the instruction codes D21 are executed. The additional codes AC are the permutation of part or all of the instruction codes D21. In the NVM 220, the entry address of the additional code AC is stored in the jump destination table JT. Hereinafter, the area JT of the NVM 220 in which the jump destination table JT is stored and the area in the NVM 220 in which the additional codes AC are stored are also referred to as the AC area. The JT area and the AC area are also collectively referred to as additional coding areas (a first area).

[0054] The semiconductor device S20 may rewrite the data stored in the NVM 220 using the PLC 260 after manufacturing. For example, the NVM 220 may be an OTP memory, but the embodiment of the NVM 220 is not limited thereto.

[0055] The ROM controller 230 includes circuits including the AND circuit 231 and the multiplexer 232. Since the configuration and operation of the AND circuit 231 and the multiplexer 232 are similar to those of the AND circuit 131 and the multiplexer 132 shown in the first embodiment, a detailed description thereof is omitted.

[0056] Since the configuration and operation of the bus 240, the CPU 250, and the PLC 260 are the same as those of the bus 140, the CPU 150, and the PLC 160 shown in the first embodiment, a detailed description thereof will be omitted. (Description of the process flow)

[0057] Fig. 5A to Fig. 5D are flowcharts showing an exemplary process of a semiconductor device S20, and an outline of the process of the semiconductor device S20 will be described with reference to these flowcharts. Otherwise, for the already described part of each process, the description will be omitted as appropriate.

[0058] First, as in Fig. 5A, in the semiconductor device manufacturing stage S20, the entry table E1 is stored in the ROM 210 (in step S21).

[0059] The process performed after step S11 will now be described with reference to Fig. 5B. The PLC 260 writes the replacement address RA2 into the area RA2 of the NVM 220. The PLC 260 also writes the codes of the relative jump instruction into the area RC2 of the NVM 220 as replacement codes RC2 (in step S22).

[0060] The PLC 260 writes the additional code AC into the area AC by writing the jump destination table JT containing the entry address of the additional code AC into the area JT (in step S23). At this time, the PLC 260 writes a return instruction to the area AC so that the CPU 250 jumps to a predetermined position on the ROM 210 after reading the additional codes AC and reads the jump destination data. The predetermined position may be, for example, the following instruction of the code replaced by the replacement codes RC2 in the instruction codes D21. Alternatively, the predetermined position may be a suffix of a functional of the code replaced by the replacement codes RC2. The PLC 260 executes the corrective operation process described in steps S22 and S23, for example, at the time of shipment of the semiconductor device S20 or after shipment, in response to the instruction of the CPU 250.

[0061] Next, after step S23, the process performed after the activation of the semiconductor device S10 will be described with reference to Fig. 5C and Fig. 5D. The CPU 250 issues a read request to the ROM controller 230 (in step S24). This detail is similar to step S12.

[0062] The ROM controller 230 changes the process depending on whether the read address RA for which a read request was made matches the replacement address RA2 (in step S25). If the read address RA matches the replacement address RA2 ("Yes" in step S25), the ROM controller 230 reads the replacement codes RC2 from the area RC2 instead of reading the instruction codes D21 from the ROM 210. The ROM controller 230 outputs the replacement codes RC2 as a read data output RD to the bus 240 (in step S26). This detail is similar to steps S13 and S14.

[0063] On the other hand, if the read address RA does not match the replacement address RA2 ("No" in step S25), the ROM controller 230 reads the instruction codes D21 from the ROM 210 and outputs them as a read data output RD to the bus 240 (in step S27). This detail is similar to step S15.

[0064] Next, a detailed process performed by the CPU 250 when step S26 is executed will be described with reference to Fig. 5B. As described in Fig. As shown in Figure 5A, when the read address RA matches the replacement address RA2, the replacement codes RC2 are output as the read data output RD to the bus 240. The CPU 250 reads out its replacement codes RC2 (in step S31).

[0065] The CPU 250 jumps to the entry table E1 stored in the ROM 210 by reading the replacement codes RC2 (in step S32). The CPU 250 reads the code contained in the entry table E1, reads the entry address of the additional code AC from the jump destination table JT stored in the NVM 220 (in step S33), and then jumps to the additional codes AC indicated by the read entry address (in step S34).

[0066] The CPU 250 reads and executes additional codes AC stored in the jump destination (in step S35). When the additional codes AC are executed, a function is added to the instruction codes D21 or a response to an error such as a vulnerability is performed. The CPU 250 jumps to a predetermined location in the ROM 210 by reading the return instruction of the area AC and executes the reading of the data to be jumped (in step S36).

[0067] For the same reason as the semiconductor device S10 of the first embodiment, even if a defect such as a vulnerability is found in boot ROM cables after the semiconductor device S20 is shipped, the CPU 250 can obtain replacement data instead of the data to be replaced. Furthermore, in the semiconductor device S20, it is possible to increase the code capacity of the replacement data compared to storing the replacement data in the register. Therefore, it is possible to solve problems (1) and (2).

[0068] Further, in the ROM 210 of the semiconductor device S20, the entry table E1 for jumping to the additional coding area of ​​the NVM 220 is stored. The patch area of ​​the NVM 220 stores the replacement codes RC2 for jumping to the entry table E1, and the additional coding area stores the additional codes AC. When the read address RA matches the replacement address RA2, the CPU 250 accesses the entry table E1 by referring to the replacement codes RC2, accesses the additional codes AC by referring to the entry table E1, and reads the additional codes AC. Thus, by using the entry table E1, the CPU 250 can be jumped anywhere in the NVM 220 simply by the PLC 160 writing a 1-word instruction to the replacement codes RC2.

[0069] If the additional codes AC are large-capacity codes, the PLC 160 may not be able to store the additional codes AC in the patch area and may be forced to store the additional codes AC in the additional coding area outside the patch area. Additional coding areas may be outside the jumpable areas as viewed from the ROM 210. Even in such cases, the entry table E1 can be used to jump the CPU 250 to any location in the additional coding area. Therefore, the semiconductor device S20 is not limited to the patch area; an additional coding area capable of storing large-capacity code can be used for the additional code storage application.Since additional code with a large capacity can be introduced into the semiconductor device S20, the semiconductor device S20 can accommodate more flexible instruction code modification or addition of instruction code functionality.

[0070] Furthermore, in the second embodiment, it is possible to store all the data required for exchange in the ROM 210 and the NVM 220, eliminating the need to provide additional memory. Therefore, it is possible to reduce the number of circuit components required for exchange processing. That is, in the configuration of the semiconductor device S20, it is possible to reduce the cost of the semiconductor device.

[0071] Further, by referring to the entry table E1 stored in the ROM 210, the CPU 250 reads the entry address of the additional codes AC from the jump destination table JT stored in the NVM 220, and then jumps to the additional codes AC indicated by the read entry address. Even if different additional codes D21 with different contents are required at the plurality of locations of the instruction codes D21, the CPU 250 can read the additional codes AC corresponding to the portion of the instruction codes D21 by setting the jump destination table AC for each additional code AC. Therefore, a plurality of additional codes AC can be flexibly introduced into the semiconductor device S20.

[0072] The additional coding area is not connected to the ROM controller 230, and the patching area is connected to the ROM controller 230. Even in such cases, the CPU 250 can obtain additional codes AC stored in a location where the NVM 220 is not connected to the ROM controller 230. Therefore, the configuration of the NVM 220 and the ROM controller 230 can be freely changed, and the flexibility of the circuit configuration of the semiconductor device S20 can be increased.

[0073] The present disclosure is not limited to the above embodiment, it is possible to change it as appropriate without departing from the scope.

[0074] For example, in the semiconductor device S10 in the first embodiment, any type of processor may be used instead of the CPU 150. The ROM controller 130 may be provided with any circuit that can perform the processes shown in the above flowcharts instead of the AND circuit and the multiplexer. For example, in the semiconductor device S10, at least one of the bus 140 and the PLC 160 may not be provided. The variations shown above are similarly applicable to the semiconductor device S20 in the second embodiment.

[0075] The semiconductor device described in the above embodiment, for example, a vehicle-mounted camera, a tachograph, it is possible to mount it on a vehicle-mounted electronic device such as a car navigation, the semiconductor device can be mounted, is not limited to this.

[0076] Furthermore, some or all of the processes performed by the ROM controller 130 or the ROM controller 230 may be implemented by the CPU executing a computer program.

[0077] The program described above includes a set of instructions (or software code) to cause the computer to perform one or more of the functions described in the embodiments when read into the computer. The program may be stored on a non-temporary computer-readable medium or on a tangible storage medium. By way of example, and not as a limitation, computer-readable media or tangible storage media include: RAM (Random-Access Memory), ROM (Read-Only Memory), flash memory, SSD (Solid-State Drive) or other storage technologies, CD-ROM, DVD (Digital Versatile Disc), Blu-ray (registered trademark) disks or other optical disk storage, magnetic cartridges, magnetic tape, magnetic disk storage, or other magnetic storage devices. The program may be transmitted on a temporary computer-readable medium or communications medium.By way of example, and not limitation, temporary computer-readable media or communications media include electrical, optical, acoustic, or other forms of propagating signals.

[0078] Although the invention made by the present inventor has been specifically described based on the embodiment, the present invention is not limited to the above-described embodiment, and needless to say, various modifications can be made without departing from the gist thereof. QUOTES CONTAINED IN THE DESCRIPTION

[0000] This list of documents submitted by the applicant was generated automatically and is included solely for the convenience of the reader. This list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions. Cited patent literature

[0000] JP 2023-183399

[0001] JP 2002-149431

[0004]

Claims

[1] A semiconductor device comprising: a read-only memory in which data is stored; a non-volatile memory in which replacement data for at least part of the data is stored; and a control device that performs either reading the data from the read-only memory or reading the replacement data from the non-volatile memory in response to a data read request from a processor. [2] A semiconductor device according to claim 1, wherein first address information indicating a memory address of at least a portion of the data stored in the read-only memory is stored in the non-volatile memory, wherein the control device reads the replacement data from the non-volatile memory when the address specified by the data read request is the same as the memory address specified by the first address information. [3] The semiconductor device according to claim 1, further comprising: a programmable controller that does not perform the writing of the substitute data in a first mode and performs the writing of the substitute data in a second mode with respect to an area in which the substitute data is stored in the non-volatile memory. [4] A semiconductor device according to claim 1, wherein first jump target information for jumping to a first area of ​​the non-volatile memory is stored in the read-only memory, second target information for jumping to the first jump target information is stored in a second area of ​​the non-volatile memory, when the control device reads the replacement data from the non-volatile memory, the processor accesses the first jump target information by referring to the second jump target information and accesses the replacement data by referring to the first jump target information and reads the replacement data. [5] A semiconductor device according to claim 4, wherein second address information indicating a storage address of the replacement data is stored in the first area, the processor accesses the second address information by referring to the first jump target information and reads the replacement data by referring to the second address information. [6] A semiconductor device according to claim 4, wherein the first area is not connected to the control device and the second area is connected to the control device, [7] A method by a semiconductor device having a read-only memory in which data is stored and a non-volatile memory in which replacement data for at least part of the data is stored, the method comprising: Accepting a request to read data stored in a read-only memory; and Performing either reading the data from the read-only memory or reading the replacement data from the non-volatile memory in response to a data read request from a processor. [8] Method according to claim 7, wherein first address information indicating a memory address of at least a portion of the data stored in the read-only memory is stored in the non-volatile memory, wherein the semiconductor device reads the replacement data from the non-volatile memory when the address specified by the data read request is the same as the memory address specified by the first address information. [9] The method according to claim 7, wherein the semiconductor does not perform the writing of the substitute data in a first mode and performs the writing of the substitute data in a second mode with respect to an area in which the substitute data is stored in the non-volatile memory. [10] Method according to claim 7, wherein first jump destination information for jumping to a first area of ​​the non-volatile memory is stored in the read-only memory, second jump destination information for jumping to the first jump destination information is stored in a second area of ​​the non-volatile memory, when the control device reads the replacement data from the non-volatile memory, the processor accesses the first jump target information by referring to the second jump target information and accesses the replacement data by referring to the first jump target information and reads the replacement data. [11] Method according to claim 10, wherein second address information indicating a storage address of the replacement data is stored in the first area, wherein the semiconductor accesses the second address information by referring to the first jump destination information and reads the replacement data by referring to the second address information. [12] Non-volatile memory storing a computer program executed by at least one processor, the computer program comprising: Codes for accepting a request to read data stored in a read-only memory; and Codes for performing either reading the data from read-only memory or reading the replacement data from non-volatile memory in response to a data read request. [13] Non-volatile memory according to claim 12, wherein first address information indicating a memory address of at least a portion of the data stored in the read-only memory is stored in the non-volatile memory, wherein the program further comprises codes for reading the replacement data from the non-volatile memory when the address specified by the data read request is the same as the memory address specified by the first address information.

Images