JP4611659B2 - Unauthorized access detection device, unauthorized access detection method, program - Google Patents

Description

  The present invention relates to an unauthorized access detection device that detects unauthorized access to a shared memory on a real-time OS on which a plurality of tasks and a plurality of interrupt processes are executed.

  In a user application in which multiple tasks and multiple interrupt processes are executed on a multi-task OS, exclusive control of shared memory used between interrupt processes and tasks and between tasks and other tasks has been required. It becomes. This is because an application malfunction may occur if access to the shared memory is illegally permitted even though there is no access right to the shared memory. Therefore, in order to prevent such unauthorized access from actually occurring when using an application, it is necessary to check whether or not there is unauthorized access in a debugging operation or the like at the software development stage. Thus, for example, Patent Document 1 proposes a software support apparatus that detects unauthorized access related to exclusive control of a shared memory when a semaphore is used.

  In Patent Document 1, the software support apparatus monitors execution of a memory access instruction during execution of a user application, and accesses the shared memory by referring to shared resource information that stores designation information of each shared memory of the multitask OS. To detect. Then, the software support apparatus detects unauthorized access by comparing the access task ID in the OS state table with the semaphore acquisition task ID.

  By the way, even in a user application executed on the real-time OS, exclusive control by enabling / disabling the CPU external interrupt is necessary to access the shared memory used between the interrupt processing and the task. The semaphore cannot be used in the interrupt processing that runs on.

  However, as described above, the software support apparatus in Patent Document 1 is a detection method for unauthorized access by a task that does not have access rights to the shared memory controlled by the semaphore. Therefore, even if the software support apparatus in Patent Document 1 is used, unauthorized access to the shared memory that is shared between the interrupt processing and the task running on the real-time OS and between the task and other tasks is not possible. It cannot be detected.

JP 2001-154872 A

  An object of the present invention is to detect unauthorized access to a shared memory that is shared and used between an interrupt process and a task operating on a real-time OS and between a task and another task.

The unauthorized access detection apparatus according to the present invention is configured to allow unauthorized access to a shared memory on a real-time OS that causes a computer to execute control for permitting or prohibiting external interrupts to the shared memory in accordance with the value of an interrupt control register built in the CPU. An unauthorized access detection device for detecting access, detection means for detecting access to the shared memory, state determination means for determining whether the external interrupt is enabled or disabled based on the value of the interrupt control register; If it is determined that the external interrupt is permitted, an unauthorized access detecting unit that detects an access to the shared memory detected by the detecting unit as an unauthorized access is provided.

  According to the present invention, the state determination unit determines whether the external interrupt is enabled or disabled based on the value of the specific area indicated in the interrupt control register. If the result of the determination is that the external interrupt is enabled, the unauthorized access is detected. The means detects the access to the shared memory detected by the detecting means as unauthorized access. Therefore, access to the shared memory can be performed by referring to the value of the specific area indicating the external interrupt enable / disable status in the interrupt control register and determining whether the external interrupt is enabled based on the value. It is possible to determine whether or not it is unauthorized access, and it is easy to detect unauthorized access to shared memory that is shared between interrupt processing and tasks running on the real-time OS and between tasks and other tasks. can do.

  Embodiments (hereinafter, embodiments) of the present invention will be described below with reference to the drawings.

  FIG. 1 is an overall configuration diagram of a software development support system in the present embodiment. In FIG. 1, the target device 10 is a hardware device on which a real-time OS 20 is installed. The software development support device 30 is a device that outputs an instruction to detect unauthorized access to the shared memory to the real-time OS 20. Then, the target device 10 and the software development support apparatus 30 are connected using a communication unit mounted on the target device 10 such as an RS-232C cable or a USB cable.

  In the present embodiment, in the software development support system configured as described above, when a user application that executes a plurality of tasks and a plurality of interrupt processes is executed on the real-time OS, unauthorized access to the shared memory is performed. Whether or not is detected.

  Next, the real-time OS 20 mounted on the target device 10 will be described in more detail using the functional block diagram shown in FIG.

  In FIG. 2, an interrupt control unit 21 is a module that receives an external interrupt signal from an external device or the like and starts a user interrupt routine 22 corresponding to the interrupt signal. The task schedule unit 24 receives a service routine call from the user interrupt routine 22 or the user task 23, performs task execution scheduling in consideration of the task execution priority, and selects the task with the highest executable priority. The module to execute. The service routine group 25 is a program code including various routines such as task generation / deletion, semaphore generation / deletion / acquisition / release, and event flag generation / deletion / set / wait. The service routine group 25 is called from the user task 23 and executed. Note that service routines that do not wait for operation, such as task generation and event flag setting, can also be called from the user interrupt routine 22. However, a service routine that can be held, such as semaphore acquisition, cannot be called from the user interrupt routine 22.

  The monitoring target address information receiving unit 26 is a module that records the monitoring target address information transmitted from the software development support device 30 in the monitoring target address information storage unit 27 and notifies the access monitoring unit 28 of the monitoring target address information. is there. Here, the monitoring target address information refers to information indicating each memory address or memory address pattern of the shared memory that requires exclusive control by enabling / disabling external interrupts. The memory address pattern is an address group including a plurality of memory addresses. For example, when the memory address is expressed in hexadecimal, one memory address (10 ** (*: arbitrary)) having the same upper two digits is assigned. Assuming one group, memory addresses (1000 to 10 ff) having the same upper two digits are the memory addresses to be monitored.

  The access monitoring unit 28 is generally realized by an access monitoring controller (for example, a user break controller) mounted on a CPU. Then, the access monitoring unit 28 monitors the access to the memory address indicated in the notified monitoring target address information, and if an access to the memory address occurs, the event is detected using a CPU internal interrupt. The unauthorized access detection unit 29 is notified.

  The unauthorized access detection unit 29 receives an access notification from the access monitoring unit 28, and based on the value of the area indicating the permission / prohibition state of the external interrupt indicated in the interrupt control register of the CPU immediately before the access occurs. This module determines whether an external interrupt is enabled or disabled when an access to a monitored memory address occurs. If the external interrupt is permitted as a result of the determination, it is determined that the shared memory is accessed while the external interrupt is permitted, and the access is determined to be unauthorized access. If it is determined that the access is unauthorized, the unauthorized access detection unit 29 identifies the CPU program counter immediately before the access occurs, that is, the task that performed the unauthorized access, such as the execution address of the program that accessed the monitored memory address. Necessary information is collected and transmitted to the software development support apparatus 30.

  Next, the software development support device 30 will be described with reference to the functional block diagram shown in FIG.

  In FIG. 3, the monitoring target address information input unit 31 accepts input of management target address information indicating the memory address and memory address pattern of the shared memory to be monitored for illegal memory access in an interactive manner by command input. This is a user interface for notifying the monitoring target address information accepting unit 26 of access monitoring to the memory address. FIG. 4 shows an input example of management address information input in the monitoring target address information input unit 31.

  The unauthorized access detection display unit 32 is information necessary for identifying the task that performed unauthorized access, such as the address of the program that caused the unauthorized access transmitted from the unauthorized access detection unit 29, the task ID, and the accessed memory address. Is a module that displays on a screen such as a monitor. The monitored address information input unit 31 and the unauthorized access detection display unit 32 can use general terminal software instead of special software.

  According to this embodiment, the access monitoring unit 28 monitors the access to the memory address of the monitoring target shared memory received by the monitoring target address information receiving unit 26. When an access to the monitoring target memory address occurs, the unauthorized access detection unit 29 determines whether or not external interrupt to the monitoring target memory address is permitted based on a value indicated in a specific area of the interrupt control register. Determine if it is in a state. As a result, when the external interrupt is permitted, the unauthorized access detection unit 29 determines that the shared memory is accessed while the external interrupt is permitted, and determines that the access is unauthorized access.

  5A, 5B, and 5C are diagrams illustrating examples of shared memory access programs in the present embodiment, respectively.

FIG. 5A is a program showing a user interrupt routine (hereinafter referred to as user_int ).

FIG. 5B is a program that normally performs exclusive control and executes access to the shared memory (hereinafter referred to as user_1task ). In FIG. 5B, the loc_cpu function is one of the service routines of the real-time OS, and is a service routine that operates an interrupt control register built in the CPU and disables external interrupts. The unl_cpu function is also a service routine of the real-time OS, and is a service routine that enables external interrupts. Therefore, when user_1task is executed, the external interrupt to the shared memory is disabled by the loc_cpu function, then the shared memory is accessed and the data is taken out from the shared memory. When the data fetch is finished, the unl_cpu function is used for sharing. The external interrupt to the memory is changed to the enabled state. Therefore, even if user_1task is executed, exclusive control of the shared memory is normally performed, so that an application malfunction does not occur due to simultaneous access to the shared memory.

On the other hand, FIG. 5C is a program that executes access to the shared memory without performing exclusive control. In this embodiment, the program corresponds to so-called unauthorized access (hereinafter referred to as user_2task ). In other words, when user_2task is executed, external interrupt to the shared memory is not disabled before accessing the shared memory. For example, user_1task is executed while user_2task is accessing the shared memory. May be. Then, two or more tasks are simultaneously accessed for one shared memory, the shared memory cannot be normally accessed, and data may not be extracted normally. Therefore, in this embodiment, a case where a program as shown in FIG. 5C is executed is detected as unauthorized access and notified.

  Here, the unauthorized access determination flow in the unauthorized access detection unit 29 will be further described with reference to the flowchart shown in FIG.

  First, upon receiving an access notification from the access monitoring unit 28, the unauthorized access detection unit 29 uses the interrupt control register immediately before the occurrence of the access, the value of the general-purpose register in the CPU, and the program counter immediately before the occurrence of the access as information on the processing interruption point. Information indicating the execution status of the task or interrupt processing routine that has been running immediately before the occurrence of access, such as a value, is stored in the stack area (S101). Subsequently, referring to the monitoring target address information shown in the monitoring target address information storage unit 27, whether or not the memory address of the accessed shared memory is indicated in the monitoring target address information (the memory address pattern is the monitoring target address information). If the address matches the condition indicated by the memory address pattern), it is determined whether or not the address requires exclusive control by enabling / disabling an external interrupt. Determine (S102). If the result of determination in S102 is a memory address that requires exclusive control by external interrupt enable / disable, the external interrupt enable / disable state of the interrupt control register immediately before the occurrence of the access stored in the stack area is displayed. With reference to the value of the indicated area, it is determined whether or not the value is in the external interrupt enabled state (S103).

  As a result of the determination in S103, if the external interrupt is permitted, it is determined that the access is unauthorized, and the task that performed unauthorized access such as the value of the program counter stored in the stack area, the access memory address, and the task ID Is transmitted to the unauthorized access detection display unit 32 (S104), and the user task that caused the unauthorized access is suspended (S105).

  Then, the unauthorized access detection display unit 32 that has received the information for identifying the task, as shown in FIG. 7, uses the value of the program counter, the access memory address, the task ID as information for identifying the task that has performed unauthorized access. Is displayed on the monitor as a character string. The user can immediately identify the cause of the unauthorized access operation of the user application by looking at the character string displayed on the monitor.

  On the other hand, if it is determined in S103 that the external interrupt is disabled, it is determined that the shared memory is normally accessed, and the value indicated by the interrupt control register, the value indicated by the CPU built-in general-purpose register, or the program counter is indicated. The value or the like is returned to the value stored in the stack area in S101, and the process interrupted by the memory access is resumed from the processing interruption point (S106).

  As described above, in this embodiment, the unauthorized access detection unit 29 refers to the value of the area indicating the external interrupt permission / prohibition state in the interrupt control register, and determines whether the value is in the external interrupt permission state. Therefore, it is possible to determine whether or not the access to the shared memory is an unauthorized access, and the sharing that is shared between the interrupt processing and the task that runs on the real-time OS and between the task and another task is used. Unauthorized access to the memory can be easily detected.

  Further, in the unauthorized access detection method disclosed in Patent Document 1, the real-time OS needs to sequentially generate internal events of the OS, and the software development support apparatus needs to read the events sequentially. There was a risk of performance degradation. On the other hand, according to the present embodiment, since unauthorized access can be detected simply by referring to the value indicated in the interrupt control register, it is possible to reduce deterioration in processing performance of the real-time OS.

  Furthermore, since the software development support apparatus of this embodiment can use general terminal software instead of special software, it can be realized with a general personal computer, and the construction cost of the software development support apparatus can be reduced. Can do.

It is a figure which shows the whole structure of the software development assistance system in this embodiment. 3 is a diagram showing functional blocks of a real-time OS 20 mounted on a target device 10. FIG. It is a figure which shows the functional block of a software development assistance apparatus. It is a figure which shows the input example of the monitoring object address information input in the monitoring object address information input part 31 of this embodiment. It is an example of the program which performs the access process to a shared memory on real time OS of this embodiment. It is an example of the program which performs the access process to a shared memory on real time OS of this embodiment. It is an example of the program which performs the access process to a shared memory on real time OS of this embodiment. It is a flowchart figure which shows the determination flow of the unauthorized access in the unauthorized access detection part 29 in this embodiment. It is an example of the information for specifying the task which performed unauthorized access displayed on a monitor when unauthorized access is detected in this embodiment.

Explanation of symbols

  10 target device, 20 real-time OS, 21 interrupt control unit, 22 user interrupt routine, 23 user task, 24 task schedule unit, 25 service routine group, 26 monitoring target address information receiving unit, 27 monitoring target address information storage unit, 28 access Monitoring unit, 29 Unauthorized access detection unit, 30 Software development support device, 31 Monitoring target address information input unit, 32 Unauthorized access detection display unit.

Claims (3)

An unauthorized access detection device that detects unauthorized access to a shared memory on a real-time OS that allows a computer to execute control to enable or prohibit external interrupts to the shared memory in accordance with the value of an interrupt control register built in the CPU. And
Detecting means for detecting access to the shared memory;
State determining means for determining whether the external interrupt is enabled or disabled based on the value of the interrupt control register;
As a result of the determination, in the case of an external interrupt permission state, unauthorized access detection means for detecting access to the shared memory detected by the detection means as unauthorized access;
An unauthorized access detection device comprising: This is an unauthorized access detection method for detecting unauthorized access to the shared memory on a real-time OS that allows a computer to execute control for permitting or prohibiting external interrupts to the shared memory in accordance with the value of an interrupt control register built in the CPU. As a step executed by the computer,
A detection step of detecting access to the shared memory;
A state determination step of determining whether the external interrupt is enabled or disabled based on the value of the interrupt control register;
As a result of determination, in the case of an external interrupt permission state, an unauthorized access detection step of detecting access to the shared memory detected in the detection step as unauthorized access;
An unauthorized access detection method comprising: Using a computer , detection of unauthorized access to the shared memory on a real-time OS that allows the computer to execute control to permit or prohibit external interrupts to the shared memory in accordance with the value of an interrupt control register built in the CPU A program for
A detection step of detecting access to the shared memory;
A state determination step of determining whether the external interrupt is enabled or disabled based on the value of the interrupt control register;
As a result of the determination, in the case of an external interrupt enabled state, an unauthorized access detection step for detecting access to the shared memory detected in the detection step as unauthorized access;
A program characterized by causing the computer to perform the.

Images