JPH11134204A - Stack protecting device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To prevent a task from hanging up by halting a currently executed task and providing a page protection exception process when there is not page information on an address where a page fault is generated and when the currently executed task access a stack of another task. SOLUTION: A real-time OS 111 generates a task to a task managing means 112 and allocates a stack 108 on a main storage memory 104. A page information rewriting means 105 sets page information 116 on the stack 108 in a page table 109. At this time, the protection information of the page information 116 is set to read/write inhibition. Then if different operation, an abnormal process, illegal memory access, etc., are caused since the data of the stack 108 are rewritten owing to a bug of a program of another task, a page protection exception process is provided for a case wherein the currently executed task accesses the stack of the different task.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a microcomputer system for real-time control, and more particularly to a case where a currently executing task mistakenly manipulates a pointer to rewrite data in a stack of another task due to a malfunction of an application program. In addition, the present invention relates to a stack protection device for preventing other tasks from performing erroneous operations.

[0002]

2. Description of the Related Art In a conventional stack protection apparatus, in a large-scale operating system, page information of a process to be executed is rewritten into a page table every time the process is switched. As a result, the memory 1 access from the current process is not converted to the physical address of another process, so that the data of another process is never rewritten.

In a real-time system, a program is stored in an external storage device like a large-sized operating system, a main memory is allocated each time the program is executed, and a logical address space is made to correspond to a physical address space on the main memory. For example, a program is not loaded from an external storage device, and data is not acquired from the external storage device for high-speed processing. That is, in the real-time system, all programs are loaded on the main memory. Each task shares data and execution instructions, and a stack is allocated for each task.

In the prior art, specific data is set at the bottom of the stack to detect an overflow of the stack, and it is detected whether or not the fixed data is rewritten for each task switch. Then, if it has been rewritten, it detects that the stack has overflowed.

[0005] In a conventional example using an MMU (memory management mechanism) in a real-time operating system, a text segment, a vector table and the like and a task-specific data area are protected. No protection.

[0006]

However, in the above-described stack overflow detection method in the prior art, the stack overflow is detected when a task switch is performed. Therefore, the overflow is detected only after the stack overflow occurs. There was a problem that it was not possible.

Further, when an access to another stack is made due to a wrong address operation due to a program defect rather than an overflow, fixed data set at the bottom of the stack for detecting stack overflow is not changed. Cannot detect that an illegal memory access has occurred. In addition, since it is not possible to detect which program has caused an illegal memory access during execution, there has been a problem that it is difficult to investigate a failure.

An object of the present invention is to realize a stack protection device capable of effectively preventing a system down due to a runaway task.

Another object of the present invention is to provide a stack protection device which can effectively prevent a system down due to a runaway task and can easily detect occurrence of an illegal memory access. It is.

[0010]

[Means for Solving the Problems]

(1) In order to achieve the above object, the present invention is configured as follows. That is, a stack protection device for a real-time control microcomputer system having an operating system in which a task does not hold an address space for each task other than the task stack space and shares and executes a program space and a data space and a memory management mechanism. A page table that is used by the memory management mechanism and includes page information holding protection information of each memory block, and a page information of a specified memory block. Appropriate protection information is set, the page table rewriting means for updating the page table, and when switching tasks, the page table rewriting means is given block information of the stack of the task currently being executed, Write the currently running task to the stack Provided with to set the protection information for prohibiting gives block information of the stack of the task to be newly executed, and task switching means for setting the protection information of the read-write with respect to the protection information of the stack of the task which the cause new run, the.

(2) Preferably, in the above (1),
The memory management mechanism generates a page fault exception process in response to a request of the currently executing task, and if there is no page information of the address that caused the page fault in the page table, the operating system executes the current operation. Puts the running task into hibernation.

(3) Preferably, in the above (1), the memory management mechanism generates a page fault exception process in response to a request of a currently executing task, and generates a page fault in the page table. If there is no page information of the address, an error output means for outputting error information is provided.

(4) Preferably, in the above (1), the memory management mechanism generates a page fault exception process in response to a request of a currently executing task, and generates a page fault in the page table. If there is no page information of the address, an error saving means for saving the error information is provided.

(5) Also, preferably, in the above (1), when the currently executing task accesses the stack of another task, the memory management mechanism generates a page protection exception process. When a page protection exception process occurs, the operating system suspends the currently executing task.

(6) Preferably, in the above (1), when the currently executing task accesses a stack of another task, the memory management mechanism generates a page protection exception process. An error output unit is provided for outputting error information when page protection exception processing occurs.

(7) Preferably, in the above (1), when the currently executing task accesses the stack of another task, the memory management mechanism generates a page protection exception process. An error saving unit is provided for saving error information when page protection exception processing occurs.

An address at which a page fault has occurred in response to a phenomenon in which a task has been rewritten in a stack due to a bug in a program of another task, causing a different operation, abnormal processing, improper memory access, or the like. If the page information does not exist, or if the currently executing task accesses the stack of another task, the currently executing task will be put to a halt state, or a page protection exception process will be provided to prevent the task from running out of control. Can be prevented.

Further, by providing error output means, error information is output when a different operation, abnormal processing, improper memory access, or the like occurs, so that a bug in the program can be found at an early stage and the bug can be corrected. Can also be easier.

Further, by providing the error saving means, it becomes possible to analyze an error when the above-mentioned different operation, abnormal processing, improper memory access or the like occurs. Error analysis becomes possible even when not in the operation place.

[0020]

Next, an embodiment of the present invention will be described in detail with reference to the drawings. FIG. 1 shows a first embodiment of the present invention.
It is a block diagram showing the composition of the stack protection device concerning an embodiment. The stack protection apparatus according to the first embodiment of the present invention includes a microprocessor (hereinafter, referred to as an MPU) 101, an MMU (memory management mechanism) 102, a main storage memory 104, a page table 109, a page protection exception Page protection exception processing unit 1 for processing 110
23, the real-time OS 111, and the task management means 1
12 task control blocks (hereinafter, referred to as TCBs) 113.

The real-time OS 111 includes a task switching unit 103 and a task switching unit 124. The task switching means 103 includes a page information rewriting means 105.

The main memory 104 includes a system text segment 106 and a system data segment 10.
7, a stack 108 for each task.

The TCB 113 has a stack start address 114, a stack size 115, a stack pointer 117, a program counter 118, a general-purpose register 119, a status register 120, a task name 121, and a task ID 122. .

FIG. 2 is a flowchart showing the operation of the stack protection method when executing the task with the highest priority in the queue at the time of task switching.

The operation of the stack protection system will be described with reference to FIGS.

The real-time OS 111 issues a request from the application to the task management means 112,
A task is generated and the stack 1 is stored on the main memory 104.
08 is assigned. The task management means 112 is the TCB 11
3, a stack start address 114 and a stack size 115 are set. When the stack 108 is allocated, the page information rewriting means 105
The page information 116 of the stack 108 is set on 9.
At this time, the protection information of the page information of the generated task stack is set to read / write prohibition.

After the currently executing task waits for an I / O input / output or activates a system call, the real-time OS 111
Instructs the task switching means 103 to perform task switching. As shown in processing step 201, the task switching means 103 sends the task 1 in the ready state having the highest priority from the task queue.
The priority of the task in the ready state is compared with the priority of the currently executing task 1 as shown in step 208, and if the priority of the currently executing task is If it is higher, the task switching means 103 does not perform task switching, proceeds to step 211, and returns the processing as a return.

If task 1 is more active than the currently executing task
If the priority of is higher, the process proceeds from processing steps 201 to 202. Then, in this processing step 202, the page information of the stack of the task 1 is acquired from the page table 109 from the page information rewriting unit 105.

If the task 1 is displayed on the page table 109,
If no stack page information exists, the task switching means 103 does not perform the task switching, and deletes the task 1 from the queue as shown in the processing step 212. Then, as shown in processing step 213, the processing is returned as a return.

Next, page information 2 of the stack of task 1
Is acquired, the stack pointer 117 is acquired from the TCB 113 of the task 1 as shown in step processing 204. The task switching means 103 performs processing step 20
As shown in FIG. 5, the stack pointer, program counter, and general-purpose register of the MPU 101 are stored in the TCB of the currently executing task.

Then, as shown in the processing step 206 from the page rewriting means 105, the page information of the stack of the task currently being executed is acquired from the page table 109. The task switching means 103 passes the acquired page information to the page table rewriting means 105, sets the protection information of this page information to read / write prohibition, and sets it in the page table 109 as shown in processing step 207. Request to. Next, as shown in a processing step 209, the protection information is set to be readable and writable for the page information 2 of the task 1, and is set in the page table 109.

As shown in processing step 210, the task switching means 124 replaces the stack pointer 117, program counter 118, general-purpose register 119 and status register 120 saved from the TCB 113 of task 1 with the stack pointer, program counter, general-purpose Set in the register and status register. Then, the process proceeds to the processing step 211 and returns.

As described above, according to the first embodiment of the present invention, since a task has been rewritten in the stack due to a bug in a program of another task, different operations, abnormal processing, and improper memory In response to the occurrence of access, etc., the system is configured to provide page protection exception handling when the currently executing task accesses the stack of another task, so that system down due to runaway of the task can be effectively prevented A stack protection device that can be prevented can be realized.

FIG. 3 is a block diagram showing a configuration of a stack protection device according to a second embodiment of the present invention. In the example of FIG. 3, an error output unit 301 and a terminal 302 are added to the configuration of the stack protection device shown in FIG. The page protection exception processing 110 is processed by the error output unit 301.

FIG. 4 shows that when the task with the highest priority in the queue is executed at the time of task switching, if the page information of the stack of this task does not exist in the page table 109, the error output means 301 sends the information to the terminal 302. 9 is a flowchart illustrating an operation when outputting error information. In FIG. 4, step 401 is added between steps 212 and 213 of the flowchart of FIG. 2, and the other steps are the same as the steps of FIG.

Next, when the MPU 102 is assigned to the task with the highest priority in the queue by task switching, error information is stored in the page table 105 when page information of the stack of this task does not exist.
Will be described with reference to FIGS. 3 and 4. FIG. Note that, as described above, FIG.
Steps other than 01 are the same as the steps in FIG. 2, and therefore only different points will be described.

In the processing step 202 of FIG. 4, if the page information of the stack of the task 1 having the highest priority in the queue does not exist in the page table 109, the task name 12 of the TCB 113 is displayed as shown in step processing 401.
1. The task ID 122 and the error message are sent to the terminal 30.
Output to 2. Then, as shown in processing step 213, the task switching means 103 does not perform task switching and returns.

According to the second embodiment of the present invention, a different operation, abnormal processing, improper memory access, and the like occur because a task has rewritten the data in the stack due to a bug in a program of another task. For the phenomenon,
Set a page protection exception when the currently executing task accesses the stack of another task, and
An error display means is provided to display error information when a phenomenon such as improper memory access occurs occurs. Thus, it is possible to effectively prevent the system from going down due to a runaway task, and Thus, it is possible to realize a stack protection device that can easily detect occurrence of a complicated memory access.

FIG. 5 is a block diagram showing a configuration of a stack protection device according to a third embodiment of the present invention. In the example of FIG. 5, an error saving unit 501 and a nonvolatile memory 502 are added to the configuration of the stack protection device shown in FIG.
Are added, and the page information rewriting unit 103 includes an error saving unit 501.

FIG. 6 shows an example in which when the task with the highest priority in the queue is executed at the time of task switching, if the page information of the stack of this task does not exist in the page table 109, the non-volatile memory 502 9 is a flowchart showing an operation when error information is output to a STA. Note that FIG. 6 includes a step 601 between steps 212 and 213 in the flowchart of FIG.
Are added, and the other steps are the same as the steps in FIG.

Next, when the MPU 102 is assigned to the task with the highest priority in the queue by task switching, when the page information of the stack of this task does not exist in the page table 105, error information is displayed in the nonvolatile memory 502. 5 and FIG.
Will be described with reference to FIG. Note that, as described above, FIG. 6 is the same as the step in FIG. 2 except for step 601, and thus only different points will be described.

In processing step 202, if there is no page information of the stack of task 1 having the highest priority in the queue in the page table 109, step processing 6
01, the task name 121 of the TCB 113,
The task ID 122 and the error message are saved in the nonvolatile memory 502. Then, as shown in processing step 213, the task switching means 103 does not perform task switching and returns. In the third embodiment of the present invention described above, the same effect as in the second embodiment can be obtained.

FIG. 7 is a block diagram showing a configuration of a stack protection device according to a fourth embodiment of the present invention. In the example of FIG. 7, an error saving unit 701 and a hard disk (hereinafter, referred to as H / D) 703 are added to the configuration of the stack protection device shown in FIG. 702.

FIG. 8 shows an example in which the task with the highest priority in the queue is executed at the time of task switching, and the H / D is saved by the error saving means 701 when the page information of the stack of the task does not exist in the page table 109.
703 is a flowchart showing the operation when outputting error information to 703.

FIG. 8 shows steps 801 and 8 between steps 212 and 213 in the flowchart of FIG.
02 and 803 are added, and the other steps are the same as the steps in FIG.

Next, when the MPU 102 is assigned to the task with the highest priority in the queue by task switching, error information is stored in the page table 105 when the page information of the stack of this task does not exist in the H / D 70.
3 will be described with reference to FIGS. 7 and 8. FIG.

As described above, FIG. 8 is the same as FIG. 2 except for steps 801 to 803, and therefore only different points will be described.

If it is determined in step 202 that the page information of the stack of the task 1 having the highest priority in the queue does not exist in the page table 109, step processing 8
As shown at 01, the error saving unit 701 requests the file system 702 to open a file for writing error information.

If the file is successfully opened, the task name 121 and task ID 1 of the TCB 113 are added to the opened file as shown in processing step 802.
22 and an error message. Then, as shown in processing step 803, this file is closed. Finally, as shown in processing step 213, the task switching means 103 does not switch tasks,
Return and return.

In step 801, if the opening of the file fails, the task switching means 103 does not perform the task switching as shown in processing step 213, and returns as the processing.

In the above-described fourth embodiment of the present invention, the same effects as in the second embodiment can be obtained.

FIG. 9 is a block diagram showing a configuration of a stack protection device according to a fifth embodiment of the present invention. In the example of FIG. 9, an error output unit 901 and a remote PC (personal computer) 903 are added to the configuration of the stack protection device shown in FIG.
It is configured to include a network communication unit 902.

FIG. 10 shows an example in which when the task with the highest priority in the queue is executed at the time of task switching, if the page information of the stack of the task does not exist in the page table 109, an error is output to the remote PC 903 by the error output means 901. 5 is a flowchart illustrating an operation when outputting information.

In FIG. 10, step 202 is executed after step 201 in the flowchart of FIG. 2. If the page information is successfully acquired in step 202, the process proceeds to step 208. The process proceeds from step 208 to step 204 or step 211. And
In FIG. 10, step 2 of the flowchart of FIG.
Between steps 12 and 213, steps 1001, 1002, 1
003 has been added, and the other steps are the same as the steps in FIG.

Next, when the MPU 102 is assigned to the task with the highest priority in the queue by task switching, if the page information of the stack of this task does not exist in the page table 105, the error information is transmitted to the remote PC 903 connected by Ethernet. Will be described with reference to FIGS. 9 and 10. FIG.

As described above, in FIG. 10, steps other than the above-described steps 1001, 1002, and 1003 are the same as the steps in FIG. 2, and therefore only different points will be described.

In the processing step 202 of FIG. 10, if the page information of the stack of the task 1 having the highest priority in the queue does not exist in the page table 109, the error output means 901 sets the network communication means as shown in step processing 1001. 902 is requested to connect to the remote PC 903 to output error information.

In step 1001, if the connection is successful, as shown in processing step 1002, the remote PC 903 is sent to the TCB 11
The third task name 121, task ID 122, and error message are transmitted. Then, as shown in processing step 1003, the connection with the remote PC 903 is disconnected. Finally, as shown in processing step 213, the task switching means 103 does not perform task switching, and returns to the processing.

In step 1001, if the connection fails, the task switching means 103 does not perform task switching and returns as shown in processing step 213, and returns the processing.

In the fifth embodiment of the present invention described above, the same effects as in the second embodiment can be obtained.

FIG. 11 is a flowchart showing the operation when the currently executing task accesses a block not described in the page table 109 in the sixth embodiment of the present invention. The configuration of the stack protection device according to the sixth embodiment is the same as the configuration shown in FIG.

Next, an operation when a page protection exception occurs because a currently executing task accesses a stack of another task will be described with reference to FIGS. When the currently executing task accesses the stack of another task, the MMU 102 requests the MPU 101 to generate a page protection exception 110.

When page protection exception 110 occurs, MP
U101 activates the page protection exception processing unit 123. The page protection exception processing unit 123 puts the currently executing task into a suspended state (suspend) as shown in processing step 1101. Next, as shown in processing step 1102, the real-time OS 111
03 to start task switching.

The task switching means 103 acquires the task 1 with the highest priority from the task queue as shown in the processing step 201. Then, the stack pointer is acquired from the TCB 113 of the task 1 as shown in the processing step 204.

The task switching means 103 includes the page information rewriting means 10
5 is requested to acquire the page information of the stack of the task 1 from the page table 109.

The task switching means 103 instructs the page table rewriting means 105 to process step 11
As shown at 03, the page information of the currently executing task is deleted from the page table 109.

If the page information of the stack of the task 1 does not exist, the task switching means 103 does not perform the task switching and returns the processing to the step 201 via the step 212.

If the page information of the stack of the task 1 exists, the task switching means 103 sends the page information rewriting means 105
As shown in FIG. 9, the protection information of the page information of task 1 is set to be readable and writable, and a request is made to set it in the page table 109.

Then, as shown in the processing step 210, the task switching means 103
The stack pointer 117, the program counter 118, the general-purpose register 119, and the status register 120 evacuated from the MPU 13 are stored in the stack pointer of the MPU 101.
Set in the program counter, general-purpose register, and status register. Then, as shown in processing step 211, a return is made and the processing is returned. In the above-described sixth embodiment of the present invention, effects similar to those of the first embodiment can be obtained.

FIG. 12 is a block diagram showing the configuration of the stack protection device according to the seventh embodiment of the present invention. In the example of FIG. 12, a page protection exception processing unit 1201 is provided instead of the page protection exception processing unit 123 of the stack protection device shown in FIG. 1, and a terminal 302 is added. The page protection exception processing unit 1201 includes an error output unit 301 that outputs error information.

FIG. 13 is a flowchart showing the operation of outputting error information to the terminal 302 when the currently executing task accesses the stack of another task. Note that FIG. 13 corresponds to steps 212 and 2 in the flowchart of FIG.
The step 1301 is added between the steps 01 and 01, and the other steps are the same as the steps in FIG.

Next, the operation of outputting error information to the terminal 302 when a page protection exception occurs due to the currently executing task accessing the stack of another task will be described with reference to FIGS. State. Note that, as described above, FIG. 13 is the same as the step in FIG. 11 except for step 1301, and thus only different points will be described.

When a page protection exception occurs, the MPU 10
1 activates the page protection exception processing unit 1201. The page protection exception processing unit 1201 outputs the task name 121, the task ID 122, and the error message of the TCB 113 to the terminal 302 as shown in processing step 1301.

The page protection exception processing unit 1201 puts the currently executing task into a sleep state as shown in processing step 1101. Next, as shown in processing step 1102, the real-time OS 112
3 is required to start task switching. The task switching means 103 acquires the task 1 having the highest priority from the task queue as shown in processing steps 201 and 204.

The task switching means 103 includes the page information rewriting means 105 as shown in the processing step 202.
Is requested to acquire the page information of the stack of the task 1 from the page table 109.

If the page information of the stack of the task 1 does not exist, the task switching means 103 does not switch the task and returns the processing.

If the page information of the stack of the task 1 exists, the task switching means 103 instructs the page table rewriting means 105 from the page table 109 as shown in the processing step 1103 for the page of the task currently being executed. Delete information.

The task switching means 103 requests the page information rewriting means 105 to set the protection information of the page information of the task 1 to be readable and writable as shown in the processing step 209 and to set the protection information in the page table 109.

Then, the task switching means 103 stores the stack pointer 117, the program counter 118, the general-purpose register 119 and the status register 120 evacuated from the TCB 113 of the task 1 into the stack pointer, program counter, Set in the general-purpose register and status register. Then, the process returns as shown in processing step 211. In the above-described seventh embodiment of the present invention, the same effects as in the second embodiment can be obtained.

FIG. 14 is a block diagram showing the configuration of the stack protection device according to the eighth embodiment of the present invention. In the example of FIG. 14, a page protection exception processing unit 1201 is provided instead of the page protection exception processing unit 123 of the stack protection device shown in FIG. 1, and a nonvolatile memory 502 is added. Then, the page protection exception processing unit 1201
Is configured to include error saving means 501 for saving error information.

FIG. 15 shows a state where the currently executing task accesses the stack of another task when the nonvolatile memory 50 is accessed.
2 is a flowchart showing an operation of outputting error information to the second embodiment. In FIG. 15, step 1501 is added instead of step 1301 in the flowchart in FIG. 13, and the other steps are the same as those in FIG.

Next, with reference to FIGS. 14 and 15, the operation when the error information is saved in the nonvolatile memory 502 when a page protection exception occurs due to the currently executing task accessing the stack of another task. I will describe. Note that, as described above, FIG.
Steps other than 1 are the same as the steps in FIG. 13, and therefore only different points will be described.

When a page protection exception occurs, the MPU 10
1 activates the page protection exception processing unit 1201. The page protection exception process 1201 stores the task name 121, the task ID 122, and the error message of the TCB 113 in the nonvolatile memory 502 as shown in a process step 1501.

The page protection exception processing unit 1201 puts the currently executing task into a sleep state as shown in processing step 1101. Next, as shown in processing step 1102, the real-time OS 112
3 is required to start task switching. The task switching means 103 acquires the task 1 having the highest priority from the task queue as shown in processing steps 201 and 204.

Next, the task switching means 103
As shown in the processing step 202, the page table rewriting unit 105 is requested to acquire the page information of the stack of the task 1 from the page table 109.

If the page information of the stack of the task 1 does not exist, the task switching means 103 does not switch the task, and the steps 212 and 150 are not performed.
Then, the process returns to step 201 via step 1.

If the page information of the stack of the task 1 exists, the task switching means 103 instructs the page table rewriting means 105 to read the page of the currently executing task from the page table 109 as shown in processing step 1103. Delete information.

The task switching means 103 requests the page information rewriting means 105 to set the protection information of the page information of the task 1 to be readable and writable, and to set it in the page table 109, as shown in processing step 209. .

Then, the task switching means 103 executes the TCB 11 of the task 1 as shown in the processing step 210.
The stack pointer 117, the program counter 118, the general-purpose register 119, and the status register 120 saved from Step 2 are set as the stack pointer, the program counter, the general-purpose register, and the status register of the MPU 101. Then, the process returns as shown in processing step 211.

In the above-described eighth embodiment of the present invention, the same effects as in the second embodiment can be obtained.

FIG. 16 is a block diagram showing the configuration of the stack protection device according to the ninth embodiment of the present invention. In the example of FIG. 16, a page protection exception processing unit 1201 is arranged in place of the page protection exception processing unit 123 of the stack protection device shown in FIG. 1, and a hard disk (H / D)
703 has been added. The page protection exception processing unit 1201 includes an error saving unit 701 that saves error information in the H / D 703. The error saving unit 701 includes a file system 702.

FIG. 17 is a flowchart showing the operation of outputting error information to the H / D 703 when the currently executing task accesses the stack of another task. Note that FIG. 17 corresponds to step 1301 in the flowchart of FIG.
Are replaced by steps 1701 to 1703, and the other steps are the same as the steps in FIG.

Next, with reference to FIGS. 16 and 17, the operation in the case where error information is saved in the H / D 703 when a page protection exception occurs because the currently executing task accesses the stack of another task will be described. State.

When page protection exception 110 occurs, MP
U101 activates the page protection exception processing unit 1201.
The page protection exception processing unit 1201 performs processing step 1701
As shown in (1), the file system 702 is requested to open a file for storing error information. If the opening of the file fails, the processing step 201 is executed.

In step 1701, if the file is successfully opened, the processing step 1702
The task name 121, task ID 122, and error message (error information) of the TCB 113 are written in this file as shown in FIG. And processing step 1
As shown at 703, this file is closed.

Next, the page protection exception processing unit 1201
As shown in processing step 1101, the currently executing task is put into a sleep state. Next, the real-time OS 112 requests the task switching means 103 to start task switching as shown in processing step 1102. The task switching means 103 acquires the task 1 having the highest priority from the task queue as shown in processing steps 201 and 204.

The task switching means 103 requests the page table rewriting means 105 to acquire the page information 2 of the stack of the task 1 from the page table 109, as shown in the processing step 202.

If there is no page information of the task stack, the task switching means 103 does not perform task switching, and returns the processing to step 212.

In step 202, if the page information of the task stack exists, the task switching means 103
, The page information of the currently executing task is deleted from the page table 109 as shown in processing step 1103.

The task switching means requests the page information rewriting means 105 to set the protection information of the page information of task 1 to be readable and writable as shown in processing step 209, and to set the protection information in the page table 109.

As shown in processing step 210, the task switching means 103 stores the stack pointer 117 saved from the TCB 112 of the task 1 and the program counter 1
18, general-purpose register 119 and status register 12
0 is set in the stack pointer, program counter, general-purpose register, and status register of the MPU 101. Then, the process returns as shown in processing step 211.

In the ninth embodiment of the present invention described above, the same effects as in the second embodiment can be obtained.

FIG. 18 is a block diagram showing a configuration of a stack protection device according to a tenth embodiment of the present invention. In the example of FIG. 18, a page protection exception processing unit 1201 is provided instead of the page protection exception processing unit 123 of the stack protection device shown in FIG. 1, and a remote PC 903 is added. Then, the page protection exception processing unit 1201
Is configured to include an error output unit 901 for saving the error information to the remote PC 903. The error output unit 901 includes a network communication unit 902.

FIG. 19 shows the remote PC 90 when the currently executing task accesses the stack of another task.
3 is a flowchart showing an operation of outputting error information to the third embodiment. Note that FIG. 19 is different from Steps 1901 to 1903 in the flowchart of FIG.
3 has been added, and the other steps are the same as the steps in FIG.

Next, the operation when error information is transmitted to the remote PC 903 when the currently executing task accesses the stack of another task and a page protection exception occurs will be described with reference to FIGS. State.

When page protection exception 110 occurs, MP
U101 activates the page protection exception processing unit 1201.
Error output unit 901 of page protection exception processing unit 1201
Requests the network communication means 902 to establish a network connection in order to transmit error information, as shown in processing step 1901.

If the connection with the remote PC 903 fails, the processing step 201 is executed.

In step 1901, if the connection with the remote PC 903 is successful,
As shown in processing step 1902, the remote PC 903
For task name 121 of TCB 113, task I
D122 and an error message are transmitted.

Then, as shown in processing step 1903, the connection with the remote PC 903 is disconnected.

Next, the page protection exception processing 1201 puts the currently executing task into a sleep state as shown in processing step 1101. Next, as shown in processing step 1102, the real-time OS 111
03 to start task switching. The task switching means 103 acquires the task 1 having the highest priority from the task queue as shown in processing steps 201 and 204.

The task switching means 103 sets the page table rewriting means 1 as shown in processing step 202.
05 is requested to obtain page information of the task stack from the page table 109.

If the page information of the stack of the task 1 does not exist, the task switching means 103 does not perform the task switching and returns the processing to step 212.

In step 202, if task 1
If the page information of the stack exists, the task switching means 103
For 5, the page information of the currently executing task is deleted from the page table 109 as shown in processing step 1103.

The task switching means 103 sends the page table rewriting means 105 a
As shown in FIG. 9, the protection information of the page information of the task is set to be readable and writable, and is requested to be set in the page table 109.

As shown in the processing step 210, the task switching means 103 stores the stack pointer 117 saved from the TCB 113 of the task 1 and the program counter 1
18, general-purpose register 119 and status register 12
0 is set in the stack pointer, program counter, general-purpose register, and status register of the MPU 101.

Then, the processing is returned as shown in processing step 211.

In the tenth embodiment of the present invention described above, the same effects as in the second embodiment can be obtained.

In the above-described embodiment of the present invention, a case where page protection exception processing is generated when a currently executing task accesses another stack has been mainly described. Reference numeral 102 denotes a page fault exception handling in response to a request of the currently executing task. If there is no page information of the address that caused the page fault exception handling in the page table 109, the operating system 111 executes the currently executed task. The running task can be put into a sleep state to prevent runaway of the task.

[0119]

Since the present invention is configured as described above, it has the following effects. A stack protection device that can effectively prevent the system from going down due to a runaway task can be realized.

Furthermore, it is possible to realize a stack protection device that can effectively prevent the system from going down due to a runaway task and can easily detect the occurrence of an illegal memory access.

(1) That is, if the currently executing task attempts to write to the stack of another task, M
An exception process is started by the MU, and the task currently being executed is put into a sleep state so that the data of the stack of another task is not rewritten. This has the effect of preventing runaway and system down.

(2) If the currently executing task attempts to write to the stack of another task, error information is displayed on an external output device or stored in an external storage device, thereby causing a problem. In order to facilitate the investigation, there is an effect that the mean time to repair (MTTR) time of the system can be reduced.

[Brief description of the drawings]

FIG. 1 is a block diagram illustrating a system configuration of a stack protection device according to a first embodiment of the present invention.

FIG. 2 shows a stack protection device according to a first embodiment.
9 is a flowchart showing an operation when rewriting the page table of the MMU at the time of task switching.

FIG. 3 is a block diagram illustrating a system configuration of a stack protection device according to a second embodiment of the present invention.

FIG. 4 shows a stack protection device according to a second embodiment.
9 is a flowchart illustrating an operation of outputting error information to a terminal when there is no page information of a task with the highest priority in a queue to which an MPU is assigned at the time of task switching.

FIG. 5 is a block diagram showing a system configuration of a stack protection device according to a third embodiment of the present invention.

FIG. 6 shows a stack protection device according to a third embodiment.
11 is a flowchart showing an operation of saving error information to a nonvolatile memory when page information of a task with the highest priority in a queue to which an MPU is assigned at the time of task switching does not exist.

FIG. 7 is a block diagram showing a system configuration of a stack protection device according to a fourth embodiment of the present invention.

FIG. 8 shows a stack protection device according to a fourth embodiment.
11 is a flowchart showing an operation when error information is stored in the H / D when page information of a task with the highest priority in a queue to which an MPU is assigned at the time of task switching does not exist.

FIG. 9 is a block diagram illustrating a system configuration of a stack protection device according to a fifth embodiment of the present invention.

FIG. 10 is a diagram illustrating a stack protection apparatus according to a fifth embodiment in which error information to a remote PC connected via a network when page information of a task with the highest priority in a queue to which an MPU is assigned at the time of task switching does not exist; 5 is a flowchart illustrating an operation when transmitting.

FIG. 11 is a flowchart showing an operation when page protection exception processing is executed when a currently executing task accesses a stack of another task in the stack protection apparatus according to the sixth embodiment of the present invention. .

FIG. 12 is a block diagram illustrating a system configuration of a stack protection device according to a seventh embodiment of the present invention.

FIG. 13 is a flowchart illustrating an operation of outputting error information to a terminal when a currently executing task accesses a stack of another task in the stack protection apparatus of the seventh embodiment.

FIG. 14 is a block diagram showing a system configuration of a stack protection device according to an eighth embodiment of the present invention.

FIG. 15 is a flowchart illustrating an operation of saving error information in a nonvolatile memory when a currently executing task accesses a stack of another task in the stack protection apparatus according to the eighth embodiment;

FIG. 16 is a block diagram showing a system configuration of a stack protection device according to a ninth embodiment of the present invention.

FIG. 17 is a flowchart illustrating an operation of storing error information in the H / D when a currently executing task accesses a stack of another task in the stack protection apparatus according to the ninth embodiment;

FIG. 18 is a block diagram illustrating a system configuration of a stack protection device according to a tenth embodiment of the present invention.

FIG. 19 shows an operation of transmitting error information to a remote PC connected via a network when a currently executing task accesses a stack of another task in the stack protection apparatus of the tenth embodiment. It is a flowchart.

[Explanation of symbols]

 Reference Signs List 101 MPU 102 MMU 103 Task switching means 104 Main storage memory 105 Page information rewriting means 106 System text segment 107 System data segment 108 Task stack 109 Page table 110 Page protection exception handling 111 Real-time OS 112 Task management means 113 TCB 114 Stack Start address 115 Stack size 116 Page information 117 Stack pointer 118 Program counter 119 General-purpose register 120 Status register 121 Task name 122 Task ID 123, 1201 Page protection exception processing unit 124 Task switching unit 301 Error output unit 302 Terminal 501, 701 Error saving unit 502 Non-volatile memory 702 File system 7 03 H / D 901 Error output means 902 Network communication means 903 Remote PC

Claims (7)

[Claims] 1. A microcomputer system for real-time control having an operating system in which a task does not hold an address space for each task other than a stack space of the task, the task shares and executes a program space and a data space, and a memory management mechanism. In the stack protection device, a page table which is used by the memory management mechanism and includes page information holding protection information of each memory block, and page information of a specified memory block are searched. A page table rewriting means for setting appropriate protection information for the page table and updating the page table; and when switching the task, the page table rewriting means informs the page table rewriting means of block information of the stack of the task currently being executed. And write to the stack of the currently running task With to set the protection information of the write prohibition,
A stack protection device, comprising: task switching means for providing block information of a stack of a task to be newly executed and setting read / write protection information to the protection information of the stack of the task to be newly executed. 2. The stack protection device according to claim 1, wherein the memory management mechanism generates a page fault exception process in response to a request of a task currently being executed, and generates a page fault exception process in the page table. The stack protection device, wherein when there is no page information of the address, the operating system puts a currently executing task into a sleep state. 3. The stack protection device according to claim 1, wherein said memory management mechanism generates a page fault exception process in response to a request of a currently executing task, and generates a page fault exception process in said page table. A stack protection device comprising: an error output unit that outputs error information when there is no page information of an address. 4. The stack protection device according to claim 1, wherein said memory management mechanism generates a page fault exception process in response to a request of a currently executing task, and generates a page fault exception process in said page table. A stack protection device comprising: an error saving unit that saves error information when page information of an address does not exist. 5. The stack protection device according to claim 1, wherein when a currently executing task accesses a stack of another task, the memory management mechanism generates a page protection exception process, and the page protection exception processing is performed. The stack protection device, wherein when the exception processing occurs, the operating system puts a currently executing task into a sleep state. 6. The stack protection device according to claim 1, wherein when the currently executing task accesses a stack of another task, the memory management mechanism generates a page protection exception process, and the page protection exception processing is performed. A stack protection device comprising: an error output unit that outputs error information when exception processing occurs. 7. The stack protection device according to claim 1, wherein when the currently executing task accesses the stack of another task, the memory management mechanism generates a page protection exception process, and the page protection exception processing is performed. A stack protection device comprising an error saving means for saving error information when exception processing occurs.