Control device, control method, and control program

Abstract

A simple configuration aims to reduce MCU vulnerabilities. [Solution] The control device 10 includes an MCU 20. The MCU 20 has a CPU 22, a system bus 26, a storage device 28, and an address translation device 24 that translates addresses between the CPU address space of the CPU 22 and the system bus address space of the system bus 26 in accordance with translation rules set in a special function register 24A. The MCU 20 starts up in an unrestricted mode in which all addresses in the CPU address space are available, and after startup, when a predetermined condition is met, it switches to a restricted mode in which only a portion of the addresses in the CPU address space are available. The special function register 24A allows the translation rules to be set and read when in the unrestricted mode, and does not allow the translation rules to be set or read when in the restricted mode.

Description

[Technical Field]

[0001] An embodiment of the present invention relates to a control device, a control method, and a control program. [Background technology]

[0002] Address Space Layout Randomization (ASLR) is known as a mitigation measure against arbitrary code execution attacks that exploit buffer overflow vulnerabilities. This technique utilizes virtual memory management functions to randomly determine the location address of application software pre-built as a position-independent executable each time it is launched, making it difficult for attackers to guess the location address of the instruction that serves as the trigger. ASLR is generally implemented using the virtual memory management function provided by general-purpose operating systems (OSs) using memory management units (MMUs). However, MMUs require large circuitry and large amounts of memory. For this reason, it has been difficult to implement virtual memory management functions in MCUs (Micro Controller Units) in the same way as general-purpose OSs and apply ASLR.

[0003] As a method for realizing a virtual memory management function in an MCU, a method has been disclosed in which invalid addresses are embedded in the application software in advance when it is built, and virtual memory management software that operates independently of and in parallel with the application software converts the invalid addresses into valid addresses as necessary. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] US Patent Application Publication No. 2021 / 0216404 Summary of the Invention [Problem to be solved by the invention]

[0005] However, conventional technology requires a CPU with sufficient performance to run application software and virtual memory management software in parallel. Furthermore, when applying conventional technology to real-time processing, it is necessary to take parallel operations into account when estimating processing time, which can make software design difficult. In other words, it is difficult to reduce MCU vulnerabilities with a simple configuration using conventional technology.

[0006] The problem to be solved by the present invention is to provide a control device, a control method, and a control program that can reduce the vulnerability of an MCU with a simple configuration. [Means for solving the problem]

[0007] The control device of an embodiment is a control device equipped with an MCU, which has a CPU, a system bus, a memory device, and an address conversion device that converts addresses between the CPU address space of the CPU and the system bus address space of the system bus in accordance with conversion rules set in a special function register, and the MCU starts up in an unrestricted mode in which all addresses in the CPU address space are available, and after starting up, when certain conditions are met, it switches to a limited mode in which only some addresses in the CPU address space are available, and the special function register allows the conversion rules to be set and read when in the unrestricted mode, and the conversion rules cannot be set or read when in the limited mode. [Brief explanation of the drawings]

[0008] [Figure 1] Schematic diagram of a control device. [Figure 2] FIG. 2 is a sequence diagram showing the flow of information processing executed by the MCU. [Figure 3] 10 is a flowchart showing the flow of information processing executed by boot firmware. DETAILED DESCRIPTION OF THE INVENTION

[0009] The control device, control method, and control program of the present embodiment will be described in detail below with reference to the accompanying drawings.

[0010] In the following description of each embodiment, parts denoted by the same reference numerals have substantially the same functions, and descriptions of overlapping parts will be omitted where appropriate.

[0011] FIG. 1 is a schematic diagram of an example of a control device 10 according to the present embodiment.

[0012] The control device 10 includes an MCU 20. The MCU 20 includes a CPU (Central Processing Unit) 22, an address translation device 24, a system bus 26, and a storage device 28.

[0013] The CPU 22 and the system bus 26 are communicatively connected via the address translation device 24. The system bus 26 and the storage device 28 are communicatively connected.

[0014] The CPU 22 includes an MPU (Memory Protection Unit) 22A.

[0015] Address translation device 24 includes special function register 24A. Address translation device 24 translates addresses between the CPU address space of CPU 22 and the system bus address space of system bus 26 in accordance with translation rules set in special function register 24A.

[0016] The CPU address space is a virtual address space of a memory area available to the CPU 22. The system bus address space is a physical address space of a memory area available to the system bus 26.

[0017] Special function register 24A is a storage element provided in address translation device 24, and stores translation rules. Details of the translation rules will be described later.

[0018] The system bus 26 is a bus (transmission path) that connects the CPU 22 and the address translation device 24 with other devices such as the storage device 28.

[0019] The storage device 28 is a storage device provided in the MCU 20, and stores various types of data. Specifically, the storage device 28 is a storage device that cannot be rewritten by the CPU 22, and from which the CPU 22 can directly execute instructions.

[0020] The storage device 28 has boot firmware 28A and one or more applications 28B pre-stored therein.

[0021] The boot firmware 28A is a computer program for reading and writing the operating system when the MCU 20 starts up and for executing basic input / output control for various connected devices. The boot firmware 28A is also sometimes called a BIOS (Basic Input / Output System).

[0022] Application 28B is application software. In this embodiment, application software may be simply referred to as an application. Application software may also be referred to as an application program. In this embodiment, it is assumed that one application 28B is stored in storage device 28.

[0023] In this embodiment, the MCU 20 starts up in the unrestricted mode. After the start-up, the MCU 20 switches to the restricted mode when a predetermined condition is met. For example, the MCU 20 switches to the restricted mode one-way when a predetermined condition is met.

[0024] The unrestricted mode is a mode in which all functional units included in the MCU 20 (CPU 22, address translation device 24, system bus 26, and boot firmware 28A and application 28B included in the memory device 28) can use all addresses in the CPU address space.

[0025] The limited mode is a mode in which each of all functional units included in the MCU 20 (CPU 22, address translation device 24, system bus 26, and boot firmware 28A and application 28B included in the memory device 28) can use only a portion of the addresses in the CPU address space.

[0026] In the unrestricted mode, special function register 24A allows translation rules to be set and read by all of the functional units included in MCU 20 (CPU 22, address translation unit 24, system bus 26, and boot firmware 28A and application 28B included in storage device 28). In the restricted mode, special function register 24A is configured so that translation rules cannot be set and read by all of the functional units included in MCU 20 (CPU 22, address translation unit 24, system bus 26, and boot firmware 28A and application 28B included in storage device 28).

[0027] As described above, in the MCU 20 of this embodiment, reading and writing to the special function register 24A in which the conversion rule is set is possible only in the unrestricted mode. Therefore, the MCU 20 of this embodiment does not require special software that runs independently of and in parallel with the application 28B, and can achieve ASLR even if some kind of problem occurs in the application 28B due to a vulnerability. Therefore, the MCU 20 of this embodiment can reduce the vulnerability of the MCU 20 with a simple configuration.

[0028] The MCU 20 of this embodiment will be described in detail below.

[0029] FIG. 2 is a sequence diagram showing an example of the flow of information processing executed by the MCU 20 of this embodiment.

[0030] In this embodiment, the MCU 20 starts up in the restriction release mode (step S100).

[0031] When the MCU 20 starts up in the restriction-removed mode, the CPU 22 directly executes the boot firmware 28A (steps S102 and S104). That is, the boot firmware 28A is directly executed by the CPU 22 in the restriction-removed mode.

[0032] Direct execution by the MCU 20 means that the MCU 20 executes the instructions without loading them into a primary storage device such as a RAM.

[0033] Boot firmware 28A is executed by CPU 22 to obtain size information indicating the size of each of multiple types of memory areas used by application 28B from the additional information of application 28B stored in storage device 28 (steps S106 and S108). The multiple types of memory areas used by application 28B specifically include a code area, a data area, a stack area, and the like.

[0034] Then, based on the size information acquired in step S108, the boot firmware 28A randomly determines the allocation addresses, which are addresses in the CPU address space, of each of the multiple types of memory areas of the application 28B so that the multiple types of memory areas do not overlap with each other (step S110). That is, the boot firmware 28A randomly determines the addresses of each of the multiple types of memory areas in the CPU address space so that the multiple types of memory areas used by the application 28B are allocated without overlapping with each other. The boot firmware 28A then uses the determined addresses as the allocation addresses. Note that the boot firmware 28A sets the allocation addresses in areas in the CPU address space that are accessible in the restriction release mode.

[0035] Next, when the MCU 20 is in the restriction release mode, the boot firmware 28A sets a non-target address area in the CPU address space (step S112). Note that the boot firmware 28A sets the non-target address area in an area in the CPU address space that is accessible in the restriction release mode and does not overlap with the allocation address.

[0036] The non-target address area is an area in the CPU address space that is not accessible by the CPU 22. The non-target address area is also an area protected by the MPU 22A.

[0037] Therefore, after the protection function by the MPU 22A is enabled by the process described below, if the CPU 22 or the application 28B executed by the CPU 22 accesses the non-target address area, the MPU 22A will issue a memory access exception signal. Note that at the stage of step S112, the protection function by the MPU 22A is not enabled and is in a disabled state.

[0038] Next, boot firmware 28A sets the conversion rule, determined in step S110, that associates the location addresses in the CPU address space of each of the multiple types of memory areas of application 28B with the addresses and sizes in the system bus address space of each of the multiple types of memory areas, in special function register 24A of address conversion device 24 (steps S114 and S116). Boot firmware 28A may use the additional information of application 28B acquired during the processing of steps S106 and S108 to identify the addresses and sizes in the system bus address space of each of the multiple types of memory areas of application 28B, and use them to generate the conversion rule.

[0039] By setting the conversion rule in special function register 24A, address translation device 24 can convert addresses in the CPU address space and addresses in the system bus address space for each of the multiple types of memory areas of application 28B in accordance with the conversion rule. That is, address translation device 24 is enabled by a process described below, and is thus ready to perform the conversion. Note that, at step S116, address translation device 24 is not enabled and is in an inactive state.

[0040] Next, the boot firmware 28A reads the additional information of the application 28B (steps S118 and S120). Then, the boot firmware 28A identifies a first execution start address, which is the execution start address of the application 28B in the system bus address space, from the additional information read in step S120 (step S122).

[0041] Then, the boot firmware 28A derives a second execution start address using the setting address of the memory area in the CPU address space randomly determined in step S110 (step S124). The second execution start address is an execution start address in the CPU address space that corresponds to the first execution start address in the system bus address space identified in step S122. Note that the boot firmware 28A derives the second execution start address within an area in the CPU address space that is accessible in the restriction release mode.

[0042] Next, boot firmware 28A transmits an activation instruction to address translation device 24 (step S126). Upon receiving the activation instruction, address translation device 24 enters an activated state (step S128). That is, address translation device 24 enters a state in which it can convert addresses in the CPU address space and addresses in the system bus address space of each of the multiple types of memory areas of application 28B mutually in accordance with the conversion rules set in special function register 24A.

[0043] Next, the boot firmware 28A transmits an enable instruction to enable the protection function of the MPU 22A (step S130). The CPU 22, which has received the enable instruction, enables the protection function of the MPU 22A (step S132). Therefore, after the protection function of the MPU 22A is enabled, if the CPU 22 or the application 28B executed by the CPU 22 accesses an address area not covered by the MPU 22A address space, the MPU 22A issues a memory access exception signal.

[0044] Next, the MCU 20 one-way switches the MCU 20 to the restricted mode (step S134). Switching one-way means that the MCU 20 remains in the restricted mode until the MCU 20 is shut down or powered off.

[0045] That is, when a translation rule is set in special function register 24A, address translation device 24 is enabled, and the protection function of MPU 22A is enabled as a predetermined condition, MCU 20 is switched unidirectionally from unrestricted mode to restricted mode.

[0046] Note that, before switching to the limited mode, the MCU 20 may execute at least one of an activation process (step S128) for enabling the address translation device 24 to perform address translation processing, and an activation process (step S132) for enabling the protection function of the MPU 22A for the non-target address area. "Before switching to the limited mode" means both the time of switching to the limited mode and before the switching to the limited mode.

[0047] 2 shows an example in which the MPU 22A executes the protection function activation process (step S132) after the activation process (step S128) for enabling the address translation device 24. However, the address translation device 24 may be activated after the protection function activation process by the MPU 22A or simultaneously with the activation process.

[0048] When the MCU 20 is switched to the restricted mode, the boot firmware 28A executes the second execution start address in the CPU address space of the application 28B, which was derived in step S124 (step S136). The processing of step S136 starts the application 28B (steps S138 and S140), and processing by the application 28B is executed. Then, this sequence ends.

[0049] The boot firmware 28A may start the application 28B by executing the second execution start address after switching to the limited mode in a one-way manner. "After switching to the limited mode" means both when switching to the limited mode and after switching to the limited mode.

[0050] 2 has been described assuming that one application 28B is stored in storage device 28. However, as described above, multiple applications 28B may be stored in storage device 28. When multiple applications 28B are stored in storage device 28, MCU 20 may execute the processes of steps S106 to S124 for each of the multiple applications 28B, and then execute the processes of step S126 and onward.

[0051] Next, the flow of information processing executed by the boot firmware 28A of this embodiment will be described.

[0052] FIG. 3 is a flowchart showing an example of the flow of information processing executed by the boot firmware 28A of this embodiment.

[0053] When the MCU 20 is started in the unrestricted mode, the boot firmware 28A is executed directly by the CPU 22 and determines the location address of the boot firmware 28A stored in the storage device 28 (step S200). The boot firmware 28A acquires size information indicating the size of each of the multiple types of memory areas used by the application 28B from the additional information of the application 28B stored in the storage device 28. Then, based on the acquired size information, the boot firmware 28A randomly determines the location address, which is an address in the CPU address space, of each of the multiple types of memory areas of the application 28B so that the multiple types of memory areas do not overlap with each other.

[0054] Next, the boot firmware 28A sets a non-target address area in the CPU address space (step S202). By the processing of step S202, a protected area by the MPU 22A is set.

[0055] Next, the boot firmware 28A sets a conversion rule that associates the location addresses in the CPU address space of each of the multiple types of memory areas of the application 28B, determined in step S200, with the addresses and sizes in the system bus address space of each of the multiple types of memory areas, in the special function register 24A of the address conversion device 24 (step S204).

[0056] Next, the boot firmware 28A identifies a first execution start address of the application 28B in the system bus address space from the additional information of the application 28B (step S206).Then, the boot firmware 28A uses the setting address randomly determined in step S200 to derive a second execution start address corresponding to the first execution start address identified in step S206 (step S208).

[0057] Next, the boot firmware 28A executes an activation process to activate the address translation device 24 (step S210). By the process of step S210, the address translation device 24 is activated.

[0058] Next, the boot firmware 28A executes an enabling process to enable the protection function of the MPU 22A (step S212).

[0059] Then, the boot firmware 28A determines whether the MCU 20 has switched from the unrestricted mode to the restricted mode (step S214). The boot firmware 28A repeats a negative determination (step S214: No) until a positive determination is made in step S214 (step S214: Yes). If the boot firmware 28A determines a positive determination in step S214 (step S214: Yes), the process proceeds to step S216.

[0060] In step S216, boot firmware 28A executes application 28B at the second execution start address in the CPU address space derived in step S208 (step S216). Application 28B is started by the processing of step S216, and processing by application 28B is executed. After the processing of step S216, boot firmware 28A is not activated, and only application 28B operates. Furthermore, since MCU 20 has been switched to the restricted mode, reading and writing from CPU 22 to special function register 24A is prohibited. Then, this routine ends.

[0061] As described above, the control device 10 of this embodiment includes an MCU 20. The MCU 20 includes a CPU 22, a system bus 26, a storage device 28, and an address conversion device 24 that converts addresses between the CPU address space of the CPU 22 and the system bus address space of the system bus 26 in accordance with conversion rules set in a special function register 24A. The MCU 20 starts up in an unrestricted mode in which all addresses in the CPU address space are available, and after starting up, when a predetermined condition is met, it switches to a restricted mode in which only some addresses in the CPU address space are available. The special function register 24A allows the conversion rules to be set and read in the unrestricted mode, and does not allow the conversion rules to be set or read in the restricted mode.

[0062] As described above, in MCU 20 of this embodiment, address translation device 24 translates addresses between the CPU address space and the system bus address space. Special function register 24A, which is provided in address translation device 24 and has a protection function for an address area in the CPU address space that is not accessible by CPU 22, can set and read change rules in the unrestricted mode. Special function register 24A cannot set or read conversion rules in the restricted mode.

[0063] Therefore, in the MCU 20 of this embodiment, even if the application 28B contains a vulnerability such as a buffer overflow, it is possible to make it difficult to execute arbitrary code that originates from the vulnerability.

[0064] Furthermore, the MCU 20 of this embodiment does not require specific software that operates independently of and in parallel with application 28B, and even if some kind of malfunction occurs in application 28B due to a vulnerability, it is possible to achieve ASLR, which prevents randomly determined location addresses in the CPU address space from being read.

[0065] Therefore, the MCU 20 of this embodiment does not need to operate specific software such as virtual memory management software in parallel with the application 28B for real-time processing, etc. Furthermore, the MCU 20 of this embodiment does not need to provide a CPU with sufficient performance for the parallel operation.

[0066] Therefore, the MCU 20 of this embodiment can reduce the vulnerability of the MCU 20 with a simple configuration.

[0067] Therefore, the control device 10 including the MCU 20 of this embodiment can reduce the vulnerability of the MCU 20 with a simple configuration.

[0068] One possible technique for applying ASLR without requiring software that runs independently and in parallel with application software is to use the segment registers provided by the CPU. Specifically, ASLR can be achieved by assigning randomly determined addresses to segment registers when launching application software. However, when this technique is applied to directly executable storage devices provided by typical MCUs, the addresses assigned to segment registers are limited to addresses within a segment range that contains the application software storage area. This means that the randomly determined addresses are limited to at most one segment range, limiting the effectiveness of ASLR in preventing attackers from easily estimating the location addresses of key instructions. Furthermore, because application software generally has the ability to read and write segment registers, which are CPU registers, an attacker could exploit some kind of bug to read randomly determined addresses from a segment register, thereby estimating the location addresses of the instructions.

[0069] On the other hand, in the control device 10 equipped with the MCU 20 of this embodiment, the address translation device 24 translates addresses between the CPU address space and the system bus address space. Also, the special function register 24A provided in the address translation device 24 and having a protection function for an address area in the CPU address space that is not accessible by the CPU 22 can set and read change rules in the unrestricted mode. Also, the special function register 24A cannot set or read conversion rules in the restricted mode.

[0070] Therefore, the control device 10 equipped with the MCU 20 of this embodiment can realize ASLR, which prevents randomly determined placement addresses in the CPU address space from being read, even if some kind of malfunction occurs in the application 28B due to a vulnerability.

[0071] Furthermore, as described above, the MCU 20 of this embodiment does not need to operate specific software, such as virtual memory management software, in parallel with the application 28B for real-time processing, etc. Therefore, in addition to the above-mentioned effects, the control device 10 equipped with the MCU 20 of this embodiment can reduce the cost of the MCU 20. In addition to the above-mentioned effects, the control device 10 equipped with the MCU 20 of this embodiment can reduce the difficulty of software design by taking into account the parallel operation.

[0072] Furthermore, the MCU 20 of this embodiment includes boot firmware 28A. The boot firmware 28A starts up an application 28B stored in the storage device 28 after switching to the restricted mode.

[0073] In this way, in MCU 20 of this embodiment, application 28B is started after switching to the restricted mode, so even if some kind of malfunction occurs due to an attack or the like while application 28B is running, setting and reading of the conversion rule of special function register 24A is impossible in the restricted mode. Therefore, in addition to the above effects, control device 10 equipped with MCU 20 of this embodiment can prevent the location address from being read by an attack or the like, thereby reducing vulnerability.

[0074] In this embodiment, boot firmware 28A is directly executed by CPU 22 in the restriction-removed mode. Boot firmware 28A randomly determines the location addresses, which are addresses in the CPU address space of each of the multiple types of memory areas used by application 28B, so that the multiple types of memory areas do not overlap. Boot firmware 28A then sets, in special function register 24A, a conversion rule that associates the location addresses in the CPU address space with addresses in the system bus address space.

[0075] Therefore, in addition to the above-mentioned effects, the control device 10 including the MCU 20 of this embodiment can effectively execute ASLR using the MCU 20.

[0076] Furthermore, in the control device 10 of this embodiment, the boot firmware 28A derives a second execution start address in the CPU address space corresponding to the first execution start address in the system bus address space of the application 28B, and starts the application 28B by executing the second execution start address after switching one-way to the limited mode.

[0077] Therefore, in addition to the above-mentioned effects, the control device 10 of this embodiment can prevent the placement address from being read due to a malfunction of the application 28B caused by an attack or the like, thereby reducing vulnerability.

[0078] The storage device 28 is not rewritable by the CPU 22 and is a storage device in which the CPU 22 can directly execute instructions.

[0079] That is, the storage device 28 is a storage device provided in the MCU 20. Therefore, in the control device 10 of this embodiment, by applying the MCU 20 of this embodiment to an MCU equipped with the storage device 28, it is possible to reduce the vulnerability of the MCU 20 to attacks.

[0080] Furthermore, the boot firmware 28A of the control device 10 of this embodiment sets an excluded address area in the CPU address space that is not to be accessed by the CPU 22 when in the restriction release mode.

[0081] Therefore, if the CPU 22, application 28B, or the like accesses the target address area after switching to the limited mode, the MPU 22A can detect the access as an error such as an attack.

[0082] In addition, before switching to the limited mode, the MCU 20 of the control device 10 of this embodiment executes at least one of an activation process to activate the address conversion device 24 so that it can perform address conversion processing, and an activation process to activate the protection function by the MPU 22A of the non-target address area.

[0083] Therefore, after switching from the unrestricted mode to the restricted mode, even if some kind of malfunction occurs in application 28B, ASLR can be achieved, which prevents the randomly determined location address from being read.

[0084] Next, an example of the hardware configuration of the control device 10 of the above embodiment will be described.

[0085] The control device 10 of the above embodiment includes a control device such as a CPU 22 including an MPU 22A, a storage device 28, and a bus connecting each unit, and has a hardware configuration using a normal computer.

[0086] The program for executing each of the above processes executed by the control device 10 of the above embodiment may be stored in the storage device 28.

[0087] Furthermore, the program for executing the above-described processes executed by the control device 10 of the above-described embodiment may be stored in an installable or executable file format on a computer-readable storage medium such as a CD-ROM, CD-R, memory card, DVD (Digital Versatile Disc), or flexible disk (FD) and provided as a computer program product. Furthermore, the program for executing the above-described processes executed by the control device 10 of the above-described embodiment may be stored on a computer connected to a network such as the Internet and provided by being downloaded via the network. Furthermore, the program for executing the above-described processes executed by the control device 10 of the above-described embodiment may be provided or distributed via a network such as the Internet.

[0088] Although the embodiments of the present invention have been described above, the above embodiments are presented as examples and are not intended to limit the scope of the invention. This novel embodiment can be embodied in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. This embodiment and its modifications are included within the scope and spirit of the invention, and are also included in the invention and its equivalents as defined in the claims. [Explanation of symbols]

[0089] 10 Control device 20 MCU 22 CPU 22A MPU 24 Address translation device 24A Special Function Register 26 System Bus 28 Storage device 28A Boot Firmware 28B Application

Claims

1. A control device including an MCU, The MCU comprises: a CPU, a system bus, a storage device, and an address conversion device that converts addresses between a CPU address space of the CPU and a system bus address space of the system bus in accordance with a conversion rule set in a special function register; The MCU comprises: The CPU is started in a non-restricted mode in which all addresses in the CPU address space are available, and after the start-up, when a predetermined condition is satisfied, the CPU is switched to a restricted mode in which only a part of the addresses in the CPU address space are available; The special function registers are: The conversion rule can be set and read when in the restriction release mode, the conversion rule cannot be set or read when in the limited mode; Control device.

2. the MCU includes boot firmware; The boot firmware includes: After switching to the limited mode, an application program stored in the storage device is started. The control device according to claim 1 .

3. The boot firmware includes: directly executed by the CPU when in the restriction release mode, randomly determining allocation addresses, which are addresses in the CPU address space, of each of the plurality of types of memory areas used by the application program so that the plurality of types of memory areas do not overlap; the conversion rule associating the location address in the CPU address space with the address in the system bus address space is set in the special function register; The control device according to claim 2 .

4. The boot firmware includes: deriving a second execution start address in the CPU address space corresponding to a first execution start address in the system bus address space of the application program; After switching to the limited mode one way, starting the application program by executing the second execution start address; The control device according to claim 2 .

5. The storage device includes: It cannot be rewritten by the CPU, a storage device capable of directly executing instructions by the CPU; The control device according to claim 1 .

6. The boot firmware includes: When in the limitation release mode, setting an address area in the CPU address space that is not to be accessed by the CPU; The control device according to claim 2 .

7. The MCU comprises: Before switching to limited mode, an activation process for enabling the address translation device to perform address translation; and (b) executing at least one of a process for enabling a protection function of the non-target address area by an MPU provided in the CPU. The control device according to claim 6.

8. A control method executed by a control device having an MCU, The MCU comprises: a CPU, a system bus, a storage device, and an address conversion device that converts addresses between a CPU address space of the CPU and a system bus address space of the system bus in accordance with a conversion rule set in a special function register; The MCU comprises: The CPU is started in a non-restricted mode in which all addresses in the CPU address space are available, and after the start-up, when a predetermined condition is satisfied, the CPU is switched to a restricted mode in which only a part of the addresses in the CPU address space are available; The special function registers are: The conversion rule can be set and read when in the restriction release mode, the conversion rule cannot be set or read when in the limited mode; Control method.

9. an MCU having a CPU, a system bus, a storage device, and an address conversion device for converting addresses between a CPU address space of the CPU and a system bus address space of the system bus according to a conversion rule set in a special function register; activating all addresses in said CPU address space in an available unrestricted mode; A control program that, after startup, switches to a limited mode in which only a portion of addresses in the CPU address space can be used when a predetermined condition is met, The special function registers are: The conversion rule can be set and read when in the restriction release mode, the conversion rule cannot be set or read when in the limited mode; Control program.

Images