JP5848553B2 - Software analysis apparatus and program - Google Patents

Description

  The present invention relates to a software analysis apparatus that analyzes control software incorporated in an apparatus, and more particularly to a software analysis apparatus that analyzes whether or not there is a possibility of a problem in accessing a memory when an interrupt occurs.

  If an interrupt occurs in the execution of the control software of the device, problems may arise if the code executed by the interrupt accesses the same variable as the code on the interrupted side. Hereinafter, a problem caused by the code executed by the interrupt accessing the same variable as the interrupted code is referred to as a problem due to parallel access. In the following description, write access to a variable means processing for setting a value in a variable, and read access to a variable means processing for referring to a value set in a variable. To do. Access to a variable means a process including both a process for setting a value for a variable and a process for referring to a value set for the variable.

  Patent Documents 1 and 2 disclose a configuration for performing debugging of such control software on a special dedicated hardware board.

JP 2005-122329 A JP 2008-152544 A

  However, in the methods described in Patent Documents 1 and 2, it is necessary to create a special hardware substrate, which increases costs. Furthermore, there is a possibility that problems due to parallel access cannot be generated during the debugging period.

  The present invention relates to device control software, and provides a software analysis device for analyzing whether or not there is a possibility of a problem due to parallel access without using a special hardware board, and a program therefor. .

The software analysis apparatus according to the present invention analyzes the control software, analyzes an interrupt factor, an interrupt function determination unit that determines an interrupt function from a start address of a code to be processed when the interrupt factor occurs , and analyzes the control software. Among the variables accessed by the interrupt function determined by the interrupt function determination means, a variable including at least one variable to be written is set as a determination target variable, and a determination target function that is a function for accessing the determination target variable is And a processing means for performing a process of determining whether or not the interrupt by the interrupt function is possible while performing a plurality of accesses to the determination target variable and outputting a determination result, To do.

  Without using a special hardware board, it is possible to determine the possibility of a problem due to parallel access.

The flowchart of the software analysis process by one Embodiment. The hardware block diagram which implement | achieves the software analysis apparatus by one Embodiment. The figure which shows the program used for description of 1st embodiment. The figure which shows the assembler code corresponding to the program of FIG. The figure which shows the control register by one Embodiment. The functional block diagram of the software analysis apparatus by one Embodiment. The figure which shows the interruption vector table by one execution form. The flowchart of function tree information preparation in one Embodiment. The flowchart of the determination process in one Embodiment. The figure which shows the program used for description of 2nd embodiment. The figure which shows the assembler code corresponding to the program of FIG. The figure which shows the program used for description of 3rd embodiment. The figure which shows the assembler code corresponding to the program of FIG.

  (First Embodiment) In the present invention, the software analysis apparatus can be realized by executing a program on the computer system 201, and its hardware configuration is shown in FIG. A program for realizing each function of the software analysis apparatus is stored in the hard disk 202c of the main body 202 in FIG. The central processing unit (CPU) 202a loads the program and various data into the main storage unit 202b and executes them, whereby the computer system 201 operates as a software analysis device. The display device 203 displays a screen in accordance with an instruction from the main body unit 202. A keyboard 204 is used to input user instructions and character information to the computer system 201. Further, the mouse 205 is for inputting an instruction corresponding to an icon or the like displayed at the position by designating an arbitrary position on the display device 203.

  FIG. 3 shows a program used for explaining the present embodiment, and FIG. 4 shows an assembler code corresponding to the program shown in FIG. In the program of FIG. 3, there are three functions: a function main, a function int_00 called by an interrupt (hereinafter referred to as an interrupt function), and a function a called from the function main. The process on line C13 of the function main is an interrupt level setting, and the process on line C15 is an interrupt state setting.

  Hereinafter, the setting of the interrupt level and the interrupt state will be described with reference to FIG. FIG. 5 is a control register related to an interrupt. The IL0 to IL2 bits indicate an interrupt level, and the ILM0 to ILM2 and IE bits indicate an interrupt state. The ILM0 to ILM2 bits indicate an interrupt mask, and the IE bit indicates whether or not interrupts are possible. In the present embodiment, when the setting value of the IE bit is 0, it indicates that interruption is impossible, and when the setting value is 1, it indicates that interruption is possible. Further, it is assumed that IL2 is the MSB for the interrupt level and ILM2 is the MSB for the interrupt state. The interrupt is executed only when the IE bit indicates that interrupt is possible and the set value of the interrupt level is higher (stronger) than the set value of the interrupt mask. In the present embodiment, the smaller the value, the higher (stronger). That is, when the interrupt level is 2 and the interrupt mask is 0, interrupts are prohibited regardless of the value of the IE bit. On the other hand, if the interrupt level is 2 and the interrupt mask is 3, interrupt is possible if the IE bit indicates that interrupt is possible, and interrupt is not possible if the IE bit indicates that interrupt is not possible. It becomes. In the processing of the C13 line in FIG. 3, the interrupt level is set to 3, that is, IL2 is set to 0, IL1 is set to 1, and IL0 is set to 0. Also, in the process of the C15 line, 7 is set as the interrupt state. That is, 0 is set in ILM2, 1 is set in ILM1, 1 is set in ILM0, and 1 is set in IE. This sets a value of 3 in the interrupt mask and sets interrupt enable / disable to "interrupt enabled". Is.

  The function main sets the variable x to 3 in the process of line C14 and calls the function a in the process of line C16. The function a sets y to 1 if x is 0, and sets y to 2 if x is 3. The interrupt function int_00 performs a process of reducing x by 1. For example, when function a is called after setting x to 3 in function main, line A08 in FIG. 4 is processed in line A04, that is, in the process of determining whether x is 0 or not. Migrate to Thereafter, in line A11, it is determined whether x is 3. Since x is 3, in the process of the A12 line, the process does not shift to the A16 line, and in the process of the A13 and A14 lines, 2 is set to y. However, if the interrupt function int_00 is executed after the execution of the A12 line and before the execution of the A14 line, the values become x = 2 and y = 2, which may cause a malfunction. In other words, for example, when an interrupt function performs write access to a variable and the interrupted function performs read access to the variable multiple times, a problem due to concurrent access may occur depending on the call timing of the interrupt function. . This embodiment analyzes whether or not there is such a possibility.

  FIG. 6 is a functional block diagram of the software analysis apparatus according to the present embodiment, and FIG. 1 is a flowchart of analysis processing executed by the software analysis apparatus. In S1, the interrupt function determination unit 1 analyzes the control software, generates an interrupt vector table, and determines an interrupt function. The interrupt vector table indicates a correspondence relationship between an interrupt factor and a start address of a code to be processed when the factor occurs, that is, an interrupt function. FIG. 7 shows an exemplary interrupt vector table. The address of the row indicated by reference numeral 601 is an address corresponding to a hardware interrupt factor, and when an interrupt corresponding to this address occurs, processing corresponding to the label name indicated by reference numeral 602, that is, processing indicated by reference numeral 603 is performed. Branch. Reference numeral 603 calls the function int_00 in the row indicated by reference numeral 604. Based on the interrupt vector table, the interrupt function determination unit 1 acquires an interrupt factor and a function to be called when the interrupt factor occurs, that is, information on the interrupt function, and stores the information in the storage unit 5.

  Subsequently, in S2, the function access information storage unit 2 determines, for each function of the control software, a variable accessed by the function, its type, and the number of times. The access type is reading or writing to a variable. This processing can be performed by analyzing the assembler code. Specifically, a data transfer instruction, an update instruction such as an increment or decrement operation that reads data, changes or writes a value with one instruction, a conditional branch instruction that branches according to the value of a variable, etc. Access and its type can be determined. In the assembler code of FIG. 4, lines A03 and A09 are read accesses to the variable x, and processes in lines A06 and A14 are write accesses of the values 1 and 2 to the variable y, respectively. Further, the process in line A23 is a write access of value 2 to the interrupt level of the interrupt control register, the process in line A25 is a write access of value 3 to variable x, and the process in line A26 is an interrupt control register. Write access of value 7 to the interrupt state. Further, line A33 is a write access in which the variable x is decremented by 1 after reading the variable x. The function access information storage unit 2 stores variables, types, and the number of times accessed by each function in the storage unit 5 as function access information. In this embodiment, an increment or decrement operation as shown in line A33 is handled as a write access.

  Subsequently, in S3, the function tree information storage unit 3 analyzes the control software to determine the function call relationship, creates function tree information indicating the function call relationship, and stores the function tree information in the storage unit 5. FIG. 8 is a flowchart of a function tree information creation process. In S11, the function tree information storage unit 3 extracts a call process for calling a function from the code of the control software. In S12, the function tree information storage unit 3 determines whether the call is made by the function name or the pointer. If the function name is called by the function name, the function tree information storage unit 3 stores the relationship between the function and another function called by the function in S15. If the call is performed with a pointer in S12, the function tree information storage unit 3 determines in S13 whether the pointer indicates a function pointer fixed value table. When the pointer indicates the function pointer fixed value table, the function tree information storage unit 3 determines and stores the function name called from the function pointer fixed value table in S15. If the pointer does not indicate the function pointer fixed value table in S13, the function tree information storage unit 3 determines in S14 whether the pointer indicates a memory in which the function pointer table is written. When the function pointer table indicates the memory to be written, the function tree information storage unit 3 determines and stores the function name called from the memory in S15. As described above, the relationship between a function and a function called by the function is determined. When a function called by a certain function further examines the function to be called, tree information indicating the entire calling relationship of the function of the control software can be generated. For example, it is determined from the codes shown in FIGS. 3 and 4 that the function main calls the function a with the function name and that the interrupt function int_00 does not call another function.

  Returning to FIG. 1, in S <b> 4, the processing unit 4 determines a variable to which the interrupt function writes and accesses and sets it as a determination target variable. This process can use the function access information generated by the function access information storage unit 2. For example, in the interrupt function int_00 of the program shown in FIGS. 3 and 4, the variable x is determined as a determination target variable. In the process of S4, when the interrupt function calls another function, the process in the called other function is also handled as the process by the interrupt function. Subsequently, the processing unit 4 determines, in S5, a function that reads and accesses the determination target variable a plurality of times, and sets it as a determination target function. For example, in the program shown in FIGS. 3 and 4, when the variable x is not 0, the function a is determined as a determination target function because the variable x is read and accessed twice. In this process, the function access information generated by the function access information storage unit 2 can be used. Finally, the processing unit 4 determines the possibility of a problem due to parallel access for each determination target function determined in S5.

  FIG. 9 is a flowchart of the determination process executed by the processing unit 4 in S6. First, in S22, the processing unit 4 sequentially analyzes the determination target function and the processing of the function called by the determination target function. Then, while the determination target function performs read access to the determination target variable a plurality of times, it is determined whether or not the interrupt by the interrupt function that performs write access to the determination target variable is possible. That is, it is determined whether or not an interrupt by the interrupt function is possible before the determination target function reads and accesses the determination target variable and then the determination target function reads and accesses the determination target variable. If there is a conditional branch in the process from the determination target function, the process is analyzed for each branch pattern. If an interrupt by the interrupt function is possible during a plurality of read accesses, the processing unit 4 determines that there is a possibility of a problem due to parallel access. On the other hand, when the interrupt by the interrupt function is impossible, the processing unit 4 determines that there is no possibility of a problem due to parallel access. If it is possible to determine whether or not there is a possibility of a problem, the processing unit 4 determines in S23 that determination is possible, and outputs a determination result, that is, whether or not a problem may occur, via an output unit (not shown). To finish the process. On the other hand, if it is not possible to determine whether or not an interrupt by the interrupt function is possible during successive read accesses, the processing unit 4 determines that determination is not possible in S23. In this case, in S24, the processing unit 4 changes the function that calls the determination target function to the determination target function, and repeats the process of S23. At this time, the processing unit 4 determines a function that calls the determination target function based on the function tree information generated by the function tree information storage unit 3.

  For example, in the program of FIGS. 3 and 4, since the function a is determined as the determination target function in the process of S5, the processes from the A01 line to the A18 line in FIG. 4 are executed in order. In the processing from the A01 line to the A18 line, when the variable x is a value other than 0, the read access to the variable x that is the determination target variable is performed twice in succession. However, since there is no setting for the interrupt control register and the interrupt level and the interrupt state are undefined, it cannot be determined whether or not the interrupt function int_00 can be executed. Accordingly, the determination becomes impossible in S23, and the processing unit 4 sets the function main that calls the function a in S24 as the determination target function. In the function main, the interrupt level is set to value 2, the interrupt mask is set to value 3, and interrupt enable / disable is set to enable interrupt. Therefore, the processing unit 4 performs two read accesses to the variable x in the function a. Recognize that the interrupt function int_00 can be executed during Therefore, the processing unit 4 determines in S23 that a problem due to parallel access may occur.

  (Second Embodiment) Next, the second embodiment will be described focusing on the differences from the first embodiment. In the first embodiment, it is determined whether or not an interrupt function that performs write access to a determination target variable can be executed during a plurality of read accesses to the determination target variable. In the present embodiment, it is determined whether or not the interrupt function can execute the write access to the determination target variable after the read access to the determination target variable and before the write access is performed. FIG. 10 shows a program used in this embodiment, and FIG. 11 shows an assembler code corresponding to the program of FIG.

  In the program of FIG. 10, there are four functions: a function main, an interrupt function int_00, and a function a and a function b called from the function main. The processing of line C10 and line C13 of the function main is the setting of the interrupt level and the interrupt state, as in the first embodiment. The process on line C14 is to write the address information of function b to func, and the process when the if statement on line C16 is True is a pointer call using a RAM value called func. In line C07, it is declared that function a is stored in tableA, and the process in line C17 is a pointer call indicating tableA. Therefore, the function tree information storage unit 3 determines that the function main calls the function b in the process of S13 of FIG. 8, and determines that the function main calls the function a in the process of S14 of FIG.

  The function main sets the variable x to 3 in the process of the C11 line, and calls the function a or b according to the value of the variable x in the process of the C16 line and the C17 line. The function a sets 2 to x, and the function b sets 3 to x. The interrupt function int_00 performs a process of reducing x by 1. For example, it is assumed that an interrupt occurs after the function to be called is determined by the if statement of the function main and before the called function is executed. In this case, even if the interrupt function int_00 updates the variable x, a function called based on the value of the variable x before the interrupt further overwrites the variable x, which may cause a problem.

  In the assembler code of FIG. 11, the read access to the variable is the processing of the A23 line, the A25 line, and the A09 line, and the write access to the variable is A06, A12, A19, A21, A22, A24, respectively. And A41 line processing.

  In the program of FIG. 11, since the interrupt function int_00 executes write access to the variable x in the A41 line, the determination target variable becomes the variable x in S4 of FIG. Further, since it is the function main that accesses the variable x a plurality of times, the determination target function is the function main in S5 of FIG. Therefore, in step S6, the processing unit 4 sequentially analyzes the processing of the function main, executes read access to the variable x in the execution of the if statement in FIG. 9, reads the function a or b, and writes to the variable x. Recognize access. Furthermore, since the interrupt level is set to value 2, the interrupt mask is set to value 3, and interrupt enable / disable is set to enable interrupt, the processing unit 4 interrupts the interrupt function int_00 between the read access and the write access to the variable x. Recognize that can be executed. Therefore, the processing unit 4 determines that a problem due to parallel access may occur.

  (Third Embodiment) Next, the third embodiment will be described focusing on the differences from the first embodiment. FIG. 12 shows a program used in this embodiment, and FIG. 13 shows an assembler code corresponding to the program of FIG. In the program of FIG. 12, there are three functions: a function main, an interrupt function int_00, and a function a called from the function main. The processing of lines C08 and C11 of the function main is the setting of the interrupt level and interrupt state, as in the first embodiment. The function main sets 3 to the variable x in the process of the C09 line, and sets 1 to the variable y in the process of the C10 line. Thereafter, the function a is called in the process of the C12 line. The function a sets the value 2 to the variable x in the process of the C03 line and sets 0 to the variable y in the process of the C04 line. Further, the interrupt function int_00 performs a process of setting 1 to x if y is other than 0.

  For example, assume that after setting values 3 and 1 to the variables x and y with the function main, an interrupt occurs between the processing of the C03 line and C04 line of the function a. In this case, the interrupt function int_00 updates the variable x to 1, so that the variables x and y have values 1 and 0, respectively, which are different from the execution results of the function a and the interrupt function int_00. . This embodiment is for detecting such a problem. Therefore, in the present embodiment, there are two determination target variables, one is the first variable read in the interrupt function for the determination of the conditional branch, and the other is the second variable that is subsequently accessed for writing. Variable. Note that the second variable is a variable different from the first variable. When the interrupt function performs write access to the second variable after the read access to the first variable used for the conditional branch in S4 of FIG. 1, the processing unit 4 uses the two variables as the determination target variables. judge. This processing can be performed by the processing unit 4 analyzing the processing of the interrupt function. A problem may occur when an interrupt occurs during write access in the order of the second variable and the first variable. Therefore, in S5 of FIG. 1, the processing unit 4 selects a function that performs write access to both the first variable and the second variable as a determination target function based on the function access information.

  In the assembler code shown in FIG. 12, the read access to the variable is the process on line A23, and the write access to the variable is the process on line A04, A06, A12, A14, A16, A17, and A26, respectively. .

  In the programs of FIGS. 12 and 13, the interrupt function int_00 executes a read access to the variable y in the A23 line, and then executes a write access to the variable x in the A26 line. Therefore, in S4 of FIG. 1, the determination target variables are the first variable y and the second variable x. The function main performs one write access to the variable x and one write access to the variable y, that is, a total of two accesses to the determination target variable. Furthermore, the function a also performs one write access to the variable x and one write access to the variable y, that is, a total of two accesses to the determination target variable. Therefore, in S5 of FIG. 1, the function main and the function a are determined as determination target functions for accessing the determination target variable a plurality of times. However, since the function tree information indicates that the function main calls the function a, only the function main is set as a determination target function. Therefore, in S6, the processing unit 4 sequentially analyzes the processing of the function main, and recognizes that the write access is performed in the order of the variables x and y after the function a is called. Further, as in the first embodiment, since the interrupt level is set to value 2, the interrupt mask is set to value 3, and interrupt enable / disable is set to enable interrupt, the processing unit 4 may have a problem due to parallel access. Is determined.

  As described above, it is possible to determine the possibility of a problem due to parallel access without using a special hardware board. In the first and second embodiments, the determination target variable is a variable that the interrupt function writes and accesses, and in the third embodiment, the variable that is read and accessed for the determination of the conditional branch, and the write after that It was a variable to access. However, if the interrupt function has write access to a variable, problems can arise due to concurrent access. Therefore, as the selection criterion for the determination target variable, any other predetermined selection criterion can be applied as long as it includes at least one variable for write access. Further, it is understood by those skilled in the art that there are various patterns other than the specific examples described in the above embodiment regarding the order of access to the determination target variable by the determination target function and the type of the determination target function. Is clear.

  Furthermore, in the above-described embodiment, the determination target function is a function that accesses the determination target variable a plurality of times in the process of S5 of FIG. For this reason, the function access information storage unit 2 stores the variables, types, and the number of times accessed by each function in the storage unit 5 as function access information. However, the function for accessing the determination target variable may be selected as the determination target function regardless of the number of times. In this case, the processing unit 4 determines that the determination target function accesses the determination target variable in a predetermined pattern in the process of S6. Furthermore, the function access information storage unit 2 is not provided, and thus the function access information is not used for the determination of the determination target function and the determination target variable. In this case, the processing unit 4 performs determination of the determination target variable and the determination target function by analyzing the control software.

  (Other Embodiments) The present invention is also realized by executing the following processing. That is, software (program) that realizes the functions of the above-described embodiments is supplied to a system or apparatus via a network or various storage media, and a computer (or CPU, MPU, or the like) of the system or apparatus reads the program. It is a process to be executed.

Claims (9)

Analyzing the control software, interrupt function determining means for determining the interrupt function from the interrupt factor and the start address of the code to be processed by the occurrence of the interrupt factor ,
Analyzing the control software, among the variables accessed by the interrupt function determined by the interrupt function determining means, a variable including at least one variable to be accessed for writing is set as a determination target variable, and the determination target variable is accessed. A processing unit that performs a process of determining whether or not an interrupt by the interrupt function is possible while the determination target function being a function accesses the determination target variable a plurality of times, and outputting a determination result;
A software analysis device comprising: A function tree information storage means for analyzing the control software and determining a function called by each function and storing the function software as function tree information;
The processing means analyzes the process of the determination target function to determine whether or not the interrupt by the interrupt function is possible. From the process of the determination target function, can the interrupt by the interrupt function be possible? If it is not possible to determine whether or not, a function that calls the function to be determined is determined from the function tree information, and processing of the function to be called is analyzed to determine whether interruption by the interrupt function is possible. The software analysis apparatus according to claim 1.   The processing means determines whether or not an interrupt by the interrupt function is possible from an instruction of the control software for setting an interrupt control register indicating whether or not an interrupt by the interrupt function is possible The software analysis apparatus according to claim 1, wherein:   The setting of the control register includes setting of an interrupt mask and an interrupt level, and when the set value of the interrupt level is higher than the set value of the interrupt mask, the processing means is capable of interrupting The software analysis apparatus according to claim 3, wherein the determination is performed.   The setting of the control register further includes an interrupt enable / disable setting, the interrupt enable / disable setting indicates that interrupt is possible, and the interrupt level setting value is the interrupt mask setting value. The software analysis apparatus according to claim 4, wherein when the value is higher, the processing unit determines that an interrupt is possible.   The processing means determines that the variable to which the interrupt function has write access is the determination target variable, and the determination target function has read access to the determination target variable, and then has read or write access to the determination target variable. 6. The software analysis apparatus according to claim 1, wherein it is determined whether or not an interrupt by the interrupt function is possible.   When the interrupt function performs read access to the first variable for conditional branching, the processing means performs second write access after the read access to the first variable and the first variable. Can be interrupted by the interrupt function until the determination target function has write access to the second variable and then has write access to the first variable. 6. The software analysis apparatus according to claim 1, wherein it is determined whether or not there is any. Analyzing the control software, further comprising function access information storing means for storing function access information including a variable accessed by each function and information indicating whether the access is a write access or a read access;
The software analysis apparatus according to claim 1, wherein the processing unit uses the function access information for determining the determination target variable and the determination target function.   A program that causes a computer to function as the software analysis apparatus according to claim 1.

Images