JP2011145841A - Method for detecting memory overwrite by dma transfer - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To allow an abnormality in DMA to be detected and memory overwrite to be minimized, when a transfer destination address error occurs in a DMA transfer operation, and unauthorized DMA accesses are made to an unforeseen memory area. <P>SOLUTION: A controller having a DMA (direct memory access) function includes a memory area A121 which is a transfer destination for a DMA device A13a; a memory area B121a in which an initial value of a timer A14a is stored; a timer A14a which causes time-out at a predetermined time; a timer B14b, which generates a start request signal for a DMA device B13b, at a predetermined time interval that is shorter than the time-out time of the timer A14a; and a DMA device B13b, which transfers the value of the memory area B121a to a counter of the timer A14a and initializes the timer. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to a control device that performs data transfer using a DMA device.

  DMA is the direct transfer of data between memory and memory or memory and I / O devices, regardless of the method via the CPU or the like by executing programmed machine language instructions. However, since the memory is accessed independently without going through the CPU, if an incorrect transfer destination address is set in the DMA, the memory may be overwritten. In the prior art, memory overwriting has been prevented by installing a program for monitoring a DMA transfer destination address by a scheduled task and an external device for monitoring a bus. There is also an example in which a microprocessor such as memory protect is installed that checks the transfer destination address before the DMA writes to the memory and permits / inhibits the memory access (see, for example, Patent Document 1).

Japanese Patent Laid-Open No. 61-121146

  An object of the present invention is to monitor a failure mode in which a DMA transfer destination continues to operate without stopping at an intended address.

  In the case of using the prior art, in a program for monitoring the DMA transfer destination address with a scheduled task, if the monitoring cycle is shortened, the CPU is heavily loaded, and if it is lengthened, the memory is overwritten in a large area when unauthorized access is made. Become. Further, the external device that monitors the bus is disadvantageous in terms of cost, and there is a problem that there are many microprocessors that are not equipped with the memory protection function.

  An object of the present invention is to provide means for detecting overwriting of a memory by DMA without using a CPU by using a DMA device and a timer function which are normally mounted on a microprocessor.

  In the present invention, an initial value of the timer A is stored in an area adjacent to the transfer destination area of the DMA device A used by the control application, and this value is transferred to the timer A and initialized at a predetermined period. The timer A is a timer that detects a timeout, and if it is not initialized again before the time corresponding to the initial value has elapsed, it times out and notifies the CPU of an event. The CPU can recognize that the initial value of the DMA has been overwritten by the event. The initial value transfer of the timer A is executed at a predetermined cycle by the DMA device B different from the DMA. The transfer cycle by the DMA device B is generated by a timer B different from the timer A, but the timeout of the timer A is set longer than the predetermined cycle event of the timer B. In normal operation, the timer A does not time out, but the area storing the initial value of the timer A is overwritten and the initial value becomes small, so that the timer A times out and the DMA device A runs out of control. Can be detected. The initial value of the timer A is characterized in that the closer the value is to the maximum value of the memory area, the higher the detection rate when overwritten, and the longer the value, the faster the timeout. .

  By using the above-described means, it becomes possible to detect overwriting of the memory by DMA without using the CPU in the control device not equipped with the function of the prior art.

It is a figure which shows the system configuration example of the embedded control apparatus of this invention. It is a figure which shows the system structural example of the engine control unit by one embodiment of this invention. It is the figure which showed the processing flow in case the DMA apparatus of the engine control unit by one Embodiment of this invention is operating normally. It is the figure which showed the timing chart of the timer when the DMA apparatus of the engine control unit by one embodiment of this invention is operating normally. It is the figure which showed the processing flow when the DMA apparatus of the engine control unit by one Embodiment of this invention operate | moves abnormally. It is the figure which showed the timing chart of the timer when the DMA apparatus of the engine control unit by one embodiment of this invention carries out abnormal operation.

  Hereinafter, an embedded control device according to an embodiment of the present invention will be described with reference to the drawings. FIG. 2 is a diagram showing a configuration example of a microprocessor mounted on the automobile engine control unit according to the first embodiment of the present invention. As shown in FIG. 2, the microprocessor 1 of the engine control unit 2 has a CPU 15, a built-in RAM 31 (Random Access Memory), a DMAC 32 (Direct Memory Access Controller), a downcount timer 33b, and a compare match timer 33a. ing.

  The DMAC 32 has a DMA channel A 32a and a DMA channel B 32b. The built-in RAM 31 has a DMAC memory area 311. The DMAC memory area 311 is divided into a DMA channel A memory area 311a and a DMA channel B memory area 311b. The DMA channel B memory area 311b is placed adjacent to the DMA channel A memory area 311a.

  The downcount timer 33b is a timer that counts down the counter at a predetermined interval, and sets and starts an initial value in advance. When the counter reaches 0, an event request signal to the CPU 15 is generated, and the countdown of the counter is stopped. When the CPU 15 detects the event request signal of the downcount timer 33b, an interrupt process is generated. In the DMA channel B memory area 311b, the same value as the initial value of the downcount timer 33b is set.

  The compare match timer 33a is a timer that counts up a counter at a predetermined interval, and starts by setting a value shorter than the initial value of the downcount timer 33b as a threshold value. When the counter value of the compare match timer 33a matches the set threshold value, an event request signal for the DMA channel B 32b is generated. At the same time as generating the event request signal, the counter is automatically cleared to 0 and starts counting again.

  The DMA channel A 32a is activated with an external event as a trigger, and transfers data to the DMA channel A memory area 311a. The DMA channel B 32b is triggered by the event of the compare match timer 33a, and transfers the value in the DMA channel B memory area 311b to the counter of the downcount timer 33b.

  FIG. 3 shows a flowchart from the initial operation to the normal operation when the DMA operates normally. The initial operation to normal operation when the DMA is operating normally will be described with reference to FIGS. Before starting the compare match timer 33a and down count timer 33b, the DMA channel A 32a, DMA channel B 32b, DMA channel B memory area 311b, down count timer 33b, and compare match timer 33a are set. In S101, activation of the DMA channel A 32a is set as an external trigger, and data is transferred to the DMA channel A memory area 311a. The DMA channel B 32b is triggered by an event request signal from the compare match timer 33a, and the DMA channel B memory area 311b. DMA channels A32a and B32b are activated as a setting for transferring the value of 1 to the counter of the downcount timer 33b. In S102, initial values are set in the threshold values of the compare match timer 33a, and in S103, the counters of the downcount timer 33b and the compare match timer 33a are set. However, the initial value set in the counter of the downcount timer 33b is larger than the threshold value of the compare match timer 33a, and the value set in the counter of the compare match timer 33a is 0. In S104, an initial value is set in the DMA channel B memory area 311b. The initial value to be set is the same as the initial value of the downcount timer 33b. In S105, the downcount timer 33b and the compare match timer 33a are activated simultaneously, the downcount timer 33b counts down the counter, and the compare match timer 33a starts counting up the counter. When a predetermined time elapses after starting the timer in S105, the counter value of the compare match timer 33a matches the set threshold before the downcount timer 33b times out in S106. In S107, the compare match timer 33a generates an event request signal for the DMA channel B 32b, and simultaneously clears the counter to 0 and restarts the count. In S108, when the DMA channel B 32b detects the event request signal, the value of the DMA channel B memory area 311b is written to the downcount timer 33b. In S109, the initial value is reset before the downcount timer 33b times out. Further, it is assumed that the clear of the counter of the compare match timer 33a and the write of the downcount timer 33b by the DMA channel B 32b are processed at the same timing. Thereafter, when the DMA is operating normally, the operations of S106 to S109 are repeated. Further, FIG. 4 shows a timing chart of the counter after the downcount timer 33b and the compare match timer 33a are started at this time. As shown in FIG. 4, after the downcount timer 33b and the compare match timer 33a are activated, before the downcount timer 33b reaches 0 (timeout), the counter of the compare match timer 33a matches the threshold, and the counter is 0. The operation is cleared. The compare match timer 33a clears the counter to 0, and simultaneously sends an event request signal to the DMA channel B 32b to the DMA channel B 32b, writes the value of the DMA channel B memory area 311b into the down count timer 33b counter, and initializes it. Therefore, the downcount timer 33b does not time out.

  FIG. 5 shows an abnormality detection method when the DMA channel A 32a illegally accesses the DMA channel B area 311b outside the DMA channel A memory area 311a during the operations of S106 to S109 shown in FIG. Referring to FIG. 5, in S201, the DMA channel A 32a illegally accesses the DMA channel B memory area 311b, and the set initial value is updated. However, the updated value is smaller than the threshold value of the compare match timer 33a. When the value of the DMA channel B memory area 311b is updated, the value set in the counter of the downcount timer 33b in S109 becomes smaller than the threshold value of the compare match timer 33a, so that the downcount timer 33b times out in S202. . Due to the timeout of the downcount timer 33b, an event request signal to the CPU 15 is generated in S203. When the CPU 15 detects an event request signal in S204, it generates an interrupt process, detects an abnormality in the DMA channel A 32a, and stops the DMA channel A 32a. FIG. 6 shows a timing chart of the counter from the time when the downcount timer 33b and the compare match timer 33a are activated until the detection of the abnormality of the DMA channel A32a. As shown in FIG. 6, the value of the downcount timer 33b is updated by the DMA channel B32b after the abnormality of the DMA channel A32a occurs, but becomes a value smaller than the threshold value of the compare match timer 33a, and the event of the next compare match timer 33a Before the request signal is generated, the down count timer 33b times out and an event request signal to the CPU 15 is generated.

  As described above, according to the control device according to the first embodiment of the present invention, when the DMA device illegally accesses the memory area that is not intended, the down count timer, the compare match timer, and the DMA device are used for monitoring. Memory overwriting by the DMA device can be detected.

  Further, by placing a stack area under the DMA channel B memory area described with reference to FIG. 2, it is possible to reduce the damage of memory overwriting by DMA. Further, by devising the form of the DMA channel B memory area, it is possible to increase the detection probability of memory overwrite by DMA. For example, when a plurality of DMA channel B memory area values are continuously placed and a DMA channel B transfer source is sequentially changed for each compare match timer event or a plurality of DMA devices are provided, a fixed interval is used. By providing a memory area for DMA channel B and sequentially changing the transfer source of DMA channel B for each event of the compare match timer, it is possible to increase the probability of memory overwriting by DMA.

  Next, a control device according to a second embodiment of the present invention will be described.

  In the first embodiment of the present invention, the example using the DMAC, the compare match timer, the downcount timer, the built-in RAM, and the CPU in the microprocessor has been shown. However, like the control device according to the present embodiment, the compare is used. If there is no match timer or down-count timer and the task is a stationary task that starts instead at a predetermined time, DMA memory overwrite can be detected by software. As a method, first, the value of the memory area for DMA channel B is checked for each stationary task. When the DMA channel B memory area is overwritten, it is detected that the DMA channel A transfer destination is outside the transfer destination area by changing the stored initial value. Further, by devising the form of the memory area for DMA channel B described in the first embodiment of the present invention in the same way, it is possible to increase the detection probability of memory overwrite by DMA.

  The present invention can be applied to a control device including two or more DMA devices.

1 Microprocessor 2 Engine control unit 13a DMA device A
13b DMA device B
14a Timer A
14b Timer B
15 CPU
31 Built-in RAM
32 DMAC
32a DMA channel A
32b DMA channel B
33a Compare match timer 33b Down count timer 121 Memory area A
121a Memory area B
311 Memory area for DMAC 311a Memory area for DMA channel A 311b Memory area for DMA channel B

Claims (8)

A memory area A that is a transfer destination of the DMA device A, a timer A that times out in a predetermined time, a memory area B that is adjacent to the memory area A and stores an initial value of the timer A, and a value of the memory area B A controller having a DMA device B that transfers and initializes the timer A and a timer B that generates a transfer request signal of the DMA device B at a predetermined interval shorter than the timeout of the timer A;
When the memory area B storing the initial value of the timer A is overwritten, the initial value of the timer A transferred by the DMA device B is reduced, so that the initialization of the timer A by the timer B is performed. Means for detecting that the transfer destination of the DMA device A is outside the transfer destination area by timing out of the timer A before timing;   2. An abnormality detecting means for a DMA apparatus according to claim 1, wherein said memory area B is placed between said memory area A and a stack area, and damage caused when the outside of said memory area A is overwritten is reduced.   2. The memory area B according to claim 1, wherein a plurality of the memory areas B are provided in a continuous area, and the outside of the memory area A is overwritten by sequentially changing the transfer source area of the DMA device B for each event of the timer B. An abnormality detection means for a DMA device, characterized in that the detection probability in the case is increased.   2. The control device according to claim 1, wherein when the control device has a plurality of DMA devices, a plurality of the memory areas B are provided at regular intervals, and the transfer source of the DMA device B is sequentially set for each event of the timer B. Means for detecting abnormality of the DMA device by changing.   The control program according to claim 1, further comprising: a processing program for checking a value of the memory area B for each stationary task in the case of a control device having a stationary task that starts at a predetermined time instead of the timers A and B, Means for detecting that when the memory area B is overwritten, the stored initial value is changed, so that the transfer destination of the DMA device A is outside the transfer destination area.   6. The abnormality detection means for a DMA device according to claim 5, wherein a damage is caused when the outside of the memory area A is overwritten by placing a stack area under the memory area B.   6. The method according to claim 5, wherein a plurality of the memory areas B are provided in a continuous area, and the detection probability when the outside of the memory area A is overwritten is increased by checking each of the stationary tasks. Means for detecting abnormality of DMA device.   6. The control device according to claim 5, wherein when the control device has a plurality of DMA devices and the memory region A, a plurality of memory regions B are provided at regular intervals, and the memory region B is checked for each regular task. Thus, a means for detecting an abnormality of the DMA device.

Images