A method for locating abnormality of electric energy meter program

Abstract

The present invention discloses a method for locating an abnormality of an electric energy meter program. First, the data such as the stack pointer, program counter and link register when the abnormality occurs are saved, and then the data are analyzed to find the functions related to the abnormality and the calling relationship between the functions, and then the branch set of the program is combined to narrow the scope of the problem location. The present invention analyzes the data in the stack when the abnormality occurs, can quickly narrow the scope of the investigation, reduce the difficulty of locating the problem, and will not affect the architecture of the original program, and has the advantage of occupying less resources.

Description

Technical Field

[0001] The invention belongs to the technical field of electric energy meter program development, and in particular relates to an abnormality locating method for an electric energy meter program. Background Art

[0002] The stable operation of the energy meter is crucial to ensure the accuracy of grid measurement and the fairness of electricity user charges. As a small embedded product, the energy meter is designed with low resource usage (32K RAM memory, 128K FLASH memory), low cost and low power consumption. However, due to resource limitations, power consumption control and operating frequency constraints, the performance of the microcontroller used in the energy meter is limited. Therefore, developers need to focus on the problem of abnormal program crashes.

[0003] Program abnormal crash means that during the execution of the program, the program suddenly stops running and automatically resets due to some reasons. The abnormal crash of the energy meter program is mostly due to stack data corruption caused by out-of-bounds access of the array. Since the microcontroller design lacks the memory protection unit (MPU) and the ability to record LOG logs under abnormal circumstances while meeting the basic functional requirements, it is impossible to locate the exception when the program crashes. Summary of the invention

[0004] The present invention proposes a method for locating an abnormality of an electric energy meter program, the purpose of which is to reduce the scope of abnormal crash investigation and the difficulty of locating the problem without increasing costs or affecting performance.

[0005] The technical solution of the present invention is as follows:

[0006] A method for locating an abnormality of an electric energy meter program, characterized in that: after the program crashes abnormally and the kernel automatically pushes the stack, firstly extracting basic data related to the abnormality location from the stack, the basic data including the stack pointer sp, the program counter pc, the link register lr and the predicted stack frame, the predicted stack frame refers to a plurality of stack frames at the top of the stack before the kernel automatically pushes the stack; then executing the following steps:

[0007] Step 1, read the stack pointer sp, program counter pc and link register lr in the basic data, and obtain the stack pointer sp_snapshot at the time of abnormal crash according to the saved stack pointer sp, and record the read program counter pc and link register lr as pc_snapshot and lr_snapshot respectively;

[0008] Step 2: If the value of pc_snapshot is within the program address range, the exception is not caused by a stack frame exception, and the positioning is stopped. Otherwise, continue to step 3.

[0009] Step 3: Find the function where the instruction pointed to by lr_snapshot is located in the assembler program, and set the function as function1; at the same time, find the function called by the instruction before the instruction pointed to by lr_snapshot in the assembler program, and record the function as function2;

[0010] Step 4: If function2 is not the last function called in function1, the problem occurs in function2 and the problem is located; otherwise, go to step 5;

[0011] Step 5, list all branch sets funLists that call function1 through the software editor;

[0012] Step 6, read the saved prediction stack frame for traversal: for the current prediction stack frame, if it does not point to the program address of a certain instruction in the assembler, no processing is performed, otherwise: find the instruction pointed to by the prediction stack frame from the assembler, if the previous instruction of the found instruction is a jump instruction and the jump instruction requires jumping to function function1, then record the function where the instruction pointed to by the prediction stack frame in the assembler is located as function3, end the traversal, and jump to step 7; if the function function3 that meets the conditions is not found after the traversal is completed, the branch set funLists is directly used as the branch set funListsSelected1, and jump to step 8;

[0013] Step 7, select all branches that meet the condition of "calling function 1 from function 3" in the branch set funLists as the new branch set funListsSelected1;

[0014] Step 8, traverse each branch in the branch set funListsSelected1, check the calling status of each function in each branch, if the real-time value of the stack pointer when a function is called matches sp_snapshot, then add the branch where the function is located to the branch set funListsSelected2;

[0015] Step 9: Use the functions contained in all branches in the branch set funListsSelected2 as the scope for problem location and troubleshooting, and check the code logic of each function in turn.

[0016] As a further improvement of the method for locating anomalies in the electric energy meter program: the method for determining the stack pointer when a function is called is one of static analysis and dynamic analysis.

[0017] As a further improvement of the abnormality locating method of the electric energy meter program: the static analysis refers to analyzing the push instructions in the compiled assembly program to determine the real-time value of the stack pointer when each function is called.

[0018] As a further improvement of the abnormal location method of the electric energy meter program: the dynamic analysis refers to setting a breakpoint at the push instruction when each function is called, and then using a debugger to capture the real-time value of the stack pointer when each function is called during program execution.

[0019] As a further improvement of the abnormal location method of the electric energy meter program: according to the number of stack frames pushed in when the kernel automatically pushes the stack and the direction of stack generation, the stack pointer sp_snapshot is calculated according to the stack pointer sp.

[0020] Compared with the prior art, the present invention has the following positive effects: the present invention analyzes the data in the stack when the exception occurs, can quickly narrow the scope of investigation, reduce the difficulty of locating the problem, and will not affect the architecture of the original program, and has the advantage of occupying less resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 After allocating memory on the stack for the local variable array Buf, the corresponding stack frame layout diagram of fun1;

[0022] Figure 2 The data from 20001000 to 20001013 is written as all FFs for function fun3, that is, the stack frame layout diagram after the lr data of the fun1 stack frame is abnormally tampered with;

[0023] Figure 3 This is a schematic diagram of the stack popping operation when exiting the fun1 function;

[0024] Figure 4 Schematic diagram of automatic stack push for ARM kernel;

[0025] Figure 5 This is a diagram showing the correspondence between the basic data recorded by the stack information recording program procexception and the stack frame. DETAILED DESCRIPTION

[0026] The technical solution of the present invention is described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments.

[0027] First, the related operations of the stack before and after the abnormal crash of the electric energy meter program are introduced. In this embodiment, the electric energy meter is based on a single-chip microcomputer with any core of ARM Cortex-M0, Cortex-M0+, Cortex-M3, and Cortex-M4. Assume that the program running on the electric energy meter is as follows:

[0028] void fun2(void);

[0029] void fun4(void);

[0030] void fun3(int Buf)

[0031] {

[0032] / / Array out of bounds, array 16 bytes

[0033] / / Buf address is 0x20001000

[0034] memset(Buf,0xFF,20);

[0035] }

[0036] void fun1(void)

[0037] {

[0038] int Buf[4]; / / occupies 16 bytes

[0039] fun2(); ...

[0041] fun3(Buf); ...

[0043] fun4();

[0044] }

[0045] void fun5(void)

[0046] {

[0047] fun1();

[0048] }

[0049] It can be seen that function fun5 calls fun1, in which fun1 first creates an array Buf occupying 16 bytes, and then calls fun2, fun3 and fun4 in sequence. Function fun3 writes 20 bytes of 0xFF to Buf, which exceeds the length of Buf, so an array out of bounds will occur.

[0050] Table 1 - AAPCS assembly information for function fun1.

[0051] Program address Assembly code that complies with AAPCS Remark 0x0801000 push{r4-r6,I r}; Stack frame pushed 0x0801002 sub Sp, 16; Create a Buf array 0x0801004 bI fun2; Call fun2 0x0801008 mov r0,Sp; buf start address 0x080100A <![CDATA[bl fu n 3;]]> <![CDATA[Call fu n 3]]> 0x080100E bI fun4; Call fun4 0x0801012 add Sp, 16; Destroy the Buf array 0x0801014 pop{r4-r6,pc}; Stack frame recovery

[0052] As shown in Table 1, when a function is executed, some of the destination registers (r4-r6) and link register 1r used by the calling function need to be pushed onto the stack (program address 0x0801000). The data on the stack is called a stack frame. When the called function is executed and returns, the data in the stack is popped into the destination register and program counter pc (program address 0x0801014), the calling function's on-site data is restored, and subsequent instructions continue to run. Among them, the program counter pc points to the value instruction, the link register 1r points to the next instruction of the instruction being executed, and the stack pointer sp points to the top of the stack. In this embodiment, the growth direction of the stack is decreasing.

[0053] Therefore, when function fun1 allocates space for array Buf, the stack frame layout will be as follows: Figure 1 shown.

[0054] When function fun3 mistakenly writes all FFs from 20001000 to 20001013, the data of 1r in the funl stack frame will be abnormally tampered with. At this time, the stack frame layout will be as follows: Figure 2 shown.

[0055] After the execution of function fun3 is completed, fun4 (program address 0x080100E) will continue to execute. At this time, register lr will be updated to 0x0801012, which is the address of the next instruction of jump instruction BL. After the execution of function fun4 is completed, the subsequent instructions will continue. Finally, when the fun1 function is exited through the instruction pop{r4-r6,pc} at 0x8001014, Figure 3 As shown, since the value at address 20001010 (the original lr value saved in the stack) is modified, the program counter pc is incorrectly assigned to 0xFFFFFFFF, which is an illegal value, causing the program to crash abnormally.

[0056] On the other hand, the MCU based on the ARM M core will automatically push the current values ​​of registers r0, r1, r2, r3, r12, lr, pc, and psr to the stack when the program crashes. Figure 4 As shown, important information such as pc and lr will be saved in the stack. At the same time, the relevant register status of the function fun5 that calls fun1 is also saved in the stack.

[0057] Therefore, after the program crashes abnormally and the kernel automatically pushes the stack, the basic data related to the abnormal location is first extracted from the stack. The basic data includes the stack pointer sp, the program counter pc, the link register lr and the predicted stack frame, which refers to the stack frames at the top of the stack before the kernel automatically pushes the stack.

[0058] This process is implemented by the following code:

[0059] HardFault_Handler:

[0060] mrs r0,sp; / / Save the stack pointer sp to r0

[0061] bl procexception; / / The sp saved in r0 will be passed to procexception

[0062] b HardFault_Handler;

[0063] __noint DWORD g_ExcetInfo[1+1+8]; / / Create an array to store basic data

[0064] void procexception(DWORD*SP) / / procexception definition

[0065] {

[0066] g_ExcetInfo[0]=0x12345678;

[0067] g_ExcetInfo[1] = SP; / / sp

[0068] g_ExcetInfo[2] = SP[5]; / / lr

[0069] g_ExcetInfo[3] = SP[6]; / / pc

[0070] memcpy(&g_ExcetInfo[4],&SP[8],24); / / The kernel automatically pushes the previous 6 stack frames

[0071] / / Reset

[0072] ResetCPU();

[0073] }

[0074] After saving the base data, perform the following steps:

[0075] Step 1: read the stack pointer sp, program counter pc and link register lr in the basic data, and obtain the stack pointer sp_snapshot at the time of abnormal crash according to the saved stack pointer sp, and record the read program counter pc and link register lr as pc_snapshot and lr_snapshot respectively.

[0076] In this embodiment, the saved stack pointer sp is g_ExcetInfo[1], and the stack pointer sp_snapshot at the time of abnormal crash=g_ExcetInfo[1]+32.

[0077] Step 2: If the value of pc_snapshot is within the program address range, the exception is not caused by a stack frame exception, and the positioning is stopped. Otherwise, continue to step 3.

[0078] Step 3: Find the function where the instruction pointed to by lr_snapshot is located in the assembler program, and set the function as function1; at the same time, find the function called by the instruction before the instruction pointed to by lr_snapshot in the assembler program, and record the function as function2.

[0079] In this embodiment, lr_snapshot=0x0801012. According to Table 1, function1 is fun1 and function2 is fun4.

[0080] Step 4: If function2 is not the last function called in function1, the problem occurs in function2 and the problem is located; otherwise, go to step 5.

[0081] Step 5: Use the software editor to list all branch sets funLists that call function1. For example:

[0082] mian->fx11->fx12->fx13...-fx1M->function1;

[0083] mian->fx21->fx22->fx23...-fx2M->function1;

[0084] mian->fx31->fx32->fx33...-fx2M->function1; ...

[0086] mian->fxN1->fxN2->fxN3...-fxNM->function1;

[0087] Step 6, read the saved prediction stack frame for traversal: For the current prediction stack frame, if it does not point to the program address of a certain instruction in the assembler, no processing is done, otherwise: find the instruction pointed to by the prediction stack frame from the assembler, if the previous instruction of the found instruction is a jump instruction (bl instruction) and the jump instruction requires jumping to function function1, then record the function where the instruction pointed to by the prediction stack frame in the assembler is located as function3, end the traversal, and jump to step 7. If the function function3 that meets the conditions is not found after the traversal is completed, the branch set funLists is directly used as the branch set funListsSelected1, and jump to step 8.

[0088] Through the above method, the function that calls function1 can be found, that is, fun5 in this embodiment.

[0089] Step 7: Select all branches in the branch set funLists that meet the condition of "calling function function1 from function function3" as the new branch set funListsSelected1.

[0090] Step 8, traverse each branch in the branch set funListsSelected1, check the calling status of each function in each branch, if the real-time value of the stack pointer when a function is called matches sp_snapshot, add the branch where the function is located to the branch set funListsSelected2.

[0091] The method of determining the stack pointer when a function is called includes static analysis and dynamic analysis. The static analysis refers to analyzing the push instructions in the compiled assembly program to determine the real-time value of the stack pointer when each function is called. The dynamic analysis refers to setting a breakpoint at the push instruction when each function is called, and then using a debugger to capture the real-time value of the stack pointer when each function is called during program execution.

[0092] Step 9: Use the functions contained in all branches in the branch set funListsSelected2 as the scope for problem location and troubleshooting, and check the code logic of each function in turn.

[0093] It should be noted that it is obvious to those skilled in the art that the present invention is not limited to the details of the above exemplary embodiments, and that the present invention can be implemented in other specific forms without departing from the spirit or essential features of the present invention. The scope of the present invention is defined by the claims rather than the above description.

Claims

1. A method for locating abnormality of an electric energy meter program, characterized in that: After the program crashes abnormally and the kernel automatically pushes the stack, first extract the basic data related to the exception location from the stack, the basic data includes the stack pointer sp, the program counter pc, the link register lr and the predicted stack frame, the predicted stack frame refers to the stack frames at the top of the stack before the kernel automatically pushes the stack; then perform the following steps: Step 1, read the stack pointer sp, program counter pc and link register lr in the basic data, and obtain the stack pointer sp_snapshot at the time of abnormal crash according to the saved stack pointer sp, and record the read program counter pc and link register lr as pc_snapshot and lr_snapshot respectively; Step 2: If the value of pc_snapshot is within the program address range, the exception is not caused by a stack frame exception, and the positioning is stopped. Otherwise, continue to step 3. Step 3: Find the function where the instruction pointed to by lr_snapshot is located in the assembler program, and set the function as function1; at the same time, find the function called by the instruction before the instruction pointed to by lr_snapshot in the assembler program, and record the function as function2; Step 4: If function2 is not the last function called in function1, the problem occurs in function2 and the problem is located; otherwise, go to step 5; Step 5, list all branch sets funLists that call function1 through the software editor; Step 6, read the saved prediction stack frame for traversal: for the current prediction stack frame, if it does not point to the program address of a certain instruction in the assembler, no processing is performed, otherwise: find the instruction pointed to by the prediction stack frame from the assembler, if the previous instruction of the found instruction is a jump instruction and the jump instruction requires jumping to function function1, then record the function where the instruction pointed to by the prediction stack frame in the assembler is located as function3, end the traversal, and jump to step 7; if the function function3 that meets the conditions is not found after the traversal is completed, the branch set funLists is directly used as the branch set funListsSelected1, and jump to step 8; Step 7, select all branches that meet the condition of "calling function1 from function3" in the branch set funLists as the new branch set funListsSelected1; Step 8, traverse each branch in the branch set funListsSelected1, check the calling status of each function in each branch, if the real-time value of the stack pointer when a function is called matches sp_snapshot, then add the branch where the function is located to the branch set funListsSelected2; Step 9: Use the functions contained in all branches in the branch set funListsSelected2 as the scope for problem location and troubleshooting, and check the code logic of each function in turn.

2. The method for locating abnormality of an electric energy meter program according to claim 1, characterized in that: The method of determining the stack pointer when a function is called is one of static analysis and dynamic analysis.

3. The method for locating abnormality of an electric energy meter program according to claim 2, characterized in that: The static analysis refers to analyzing the push instructions in the compiled assembly program to determine the real-time value of the stack pointer when each function is called.

4. The method for locating anomalies in an electric energy meter program according to claim 2, characterized in that: The dynamic analysis refers to setting a breakpoint at the stack push instruction when each function is called, and then using a debugger to capture the real-time value of the stack pointer when each function is called during program execution.

5. The method for locating an abnormality in an electric energy meter program according to any one of claims 1 to 4, characterized in that: According to the number of stack frames pushed into the stack when the kernel automatically pushes the stack and the direction of stack generation, the stack pointer sp_snapshot is calculated based on the stack pointer sp.

Images