A method and system for recording the source of memory access

Abstract

Embodiments of the present invention disclose a method and system for recording the source of memory access, relating to the field of computer technology. The method includes: when a memory read / write execution module for executing a memory access instruction receives a memory access instruction, determining whether a target memory address to be accessed by the memory access instruction belongs to a preset monitored memory address range; if the target memory address belongs to the preset monitored memory address range, the memory read / write execution module executes the memory access instruction, and records the current memory access information through a memory access record cache module provided in a CPU physical core; the memory access record cache module writes the recorded memory access information back into a main memory buffer area corresponding to a preset computer main memory address range in the order of recording time. The present invention expands the range of memory addresses that can be recorded and also keeps the system performance basically unaffected.

Description

Technical Field

[0001] The present invention relates to the field of computer technologies, and particularly to a method and system for recording the source of memory access. Background Art

[0002] In a computer system, the memory is an important component. All data during the running of a computer program is stored in the memory. Stealing data in the memory is the most common means and target of a hacker program. Recording and monitoring the source of memory access is an effective means to trace hacker programs.

[0003] Currently, there are three common solutions for recording the source of memory access:

[0004] The first solution is to set hardware breakpoints. The hardware debug registers under X86 hardware support triggering exceptions for memory read and write. There are defined DR0 - DR7 debug registers under X86 hardware. DR0–DR3 record the memory addresses to be debugged, and DR7 manages and configures the debugging conditions. Fill the memory virtual address into registers DR0–DR3, and configure DR7 to control generating exceptions when reading and writing the memory virtual address. When an instruction is executed, if the read or written memory virtual address is the same as the address in DR0–DR3, the hardware will trigger a #DB exception. In the exception handling function, the instruction address of the memory read and write can be recorded.

[0005] In this solution, during the system startup phase, a sufficiently large memory range and a read - write instruction buffer need to be allocated to save all the instruction addresses of address read and write. Configure the addresses to be traced into the DR0 - DR3 registers. Any read and write to the memory addresses in DR0 - DR3 will trigger a #DB exception. In the #DB exception function, save the instruction address (IP) saved by the hardware on the exception stack to the read - write instruction buffer (as Figure 1 shown). When the read - write instruction buffer is full, transfer it to the disk. However, in this solution, when entering the processing function, the hardware needs to switch the stack and save the return instruction address, return stack address, and other information to the stack. The exception handling function needs to save the general registers to the stack. After the exception handling is completed, the registers need to be popped in reverse order to restore to the original position. The overhead of the entire process is very large. When continuously capturing memory access instructions, it will seriously reduce the performance of the system.

[0006] The second solution is to apply a tool dynamic binary instrumentation framework, which can monitor every step of the execution of a program and provides rich APIs. Various functions can be inserted during the running of a binary program to achieve tracing of the program. For example, to count how many instructions a program has executed, information such as the address of each instruction, etc. Conceptually, the dynamic binary instrumentation framework is similar to a JIT (Just - In - Time) compiler, which reads the instructions of an executable program, re - translates them, and then simulates the execution.

[0007] The dynamic binary instrumentation framework provides an instruction-level instrumentation mode. In this mode, all instructions are traversed and the stub program is executed. A callback function is added to each instruction, and when an instruction reads or writes to a specified memory range, the instruction address is recorded, so as to achieve the purpose of recording the source of instruction access.

[0008] The third solution is to use the debugging tool gdb. Gdb is a commonly used debugger under the Unix / Linux operating system. The watch command of gdb provides breakpoints for memory reads and writes. When setting a watch on a virtual memory address, during the execution of the program, read or write operations on this virtual memory trigger breakpoints, and the program pauses execution, and the addresses of the executed read and write instructions can be recorded.

[0009] However, in the second and third solutions, similar to instant translation tools or debuggers like gdb, they cannot be used in the production environment. Their main working scenarios are in the R & D debugging stage or the on-site troubleshooting stage after an error. At the same time, the intrusion process of hackers may occur in various application programs and even the operating system. Users cannot use instant translation tools or gdb to track program execution when each application program starts, which will greatly reduce the performance of the production environment; in addition, if the operating system vulnerability is attacked by hackers and illegal memory reads and writes occur within the operating system, instant translation tools or gdb cannot be used. Summary of the Invention

[0010] In view of this, embodiments of the present invention provide a method and system for recording the source of memory access, which can solve the problems of the existing solutions for recording the source of memory access, such as limited recorded memory addresses, affecting system performance, and being easily attacked resulting in the system not working properly.

[0011] In a first aspect, an embodiment of the present invention provides a method for recording the source of memory access, including:

[0012] When a memory read / write execution module for executing a memory access instruction receives a memory access instruction, it determines whether the target memory address to be accessed by the memory access instruction belongs to a preset monitored memory address range; wherein, the monitored memory address range is recorded in the MSR register set in the CPU physical core;

[0013] If the target memory address belongs to the preset monitored memory address range, the memory read / write execution module executes the memory access instruction, and records the current memory access information through a memory access record cache module set in the CPU physical core; the memory access information includes the instruction address of the memory access instruction, the target memory address, and the process page table base address at the time of memory access;

[0014] The memory access record cache module writes the recorded memory access information back to the main memory buffer corresponding to the preset computer main memory address range in the order of recording time; wherein, the main memory address range is recorded in the MSR register.

[0015] A method for recording the source of memory access provided in this embodiment adds a dedicated hardware module, the memory access record cache module, inside the CPU to save the instruction address for accessing the specified memory range. The hardware directly saves the instruction IP without software participation, expanding the memory address range that can be recorded and keeping the system performance basically unaffected.

[0016] Combined with the first aspect, in the first implementation manner of the first aspect, the memory access record cache module records the current memory access information, including:

[0017] The memory access record cache module determines whether the cache queue for recording memory access information is full;

[0018] If the cache queue is not full, the memory access record cache module stores the current memory access information at the tail of the cache queue;

[0019] The memory access record cache module updates the tail position identification value of the data recorded in the cache queue.

[0020] In this embodiment, the memory access record cache module records memory access information through a cache queue. Therefore, when the cache queue is not full, the memory access information can be recorded. After recording, updating its tail position identification value can achieve the physical recording of memory access information, and the recording method is simple and efficient.

[0021] Combined with the first implementation manner of the first aspect, in the second implementation manner of the first aspect, the memory access record cache module writes the recorded memory access information back to the main memory buffer corresponding to the preset computer main memory address range, including:

[0022] The memory access record cache module determines whether the head position identification value of the data recorded in the cache queue is equal to the tail position identification value;

[0023] If the head position identification value of the data recorded in the cache queue is not equal to the tail position identification value, the memory access record cache module writes the memory access information at the position corresponding to the head position identification value in the cache queue back to the main memory buffer.

[0024] In this embodiment, when the memory access record cache module records each time, it determines whether the memory access record cache module is full by comparing the head position identification value and the tail position identification value of the cache queue. If it is not full, the memory access information can be recorded, and the judgment method is simple.

[0025] Combined with the second implementation manner of the first aspect, in the third implementation manner of the first aspect, the memory access record cache module writes the memory access information at the position corresponding to the head position identification value in the cache queue back to the main memory buffer, including:

[0026] The memory access record cache module determines whether the main memory buffer storage identification value recorded in the MSR register is equal to a first preset value; wherein, the initial value of the main memory buffer storage identification value is a second preset value, the first preset value is used to indicate that the main memory buffer is full, and the second preset value is used to indicate that the main memory buffer is not full;

[0027] If the main memory buffer storage identification value is not equal to the first preset value, the memory access record cache module obtains the starting address of the main memory buffer and the number of stored memory access information;

[0028] The memory access record cache module writes the memory access information at the position corresponding to the head position identification value in the cache queue into the main memory buffer, and the starting position for writing is A0 + offset * N; wherein, A0 is the starting address of the main memory buffer, offset is the number of stored memory access information in the main memory buffer, and N is the length of each memory access information recorded in the cache queue;

[0029] The memory access record cache module makes head = head + 1, offset = offset + 1; wherein, head is the head position identification value of the data already recorded in the cache queue;

[0030] The memory access record cache module determines whether A0 + offset * N is equal to A1; wherein, A1 is the end address of the main memory buffer;

[0031] If A0 + offset * N is equal to A1, the memory access record cache module sets the main memory buffer storage identification value recorded in the MSR register to the first preset value, and sends an interrupt signal indicating that the main memory buffer is full to the CPU to wait for the CPU to reset the main memory buffer storage identification value to the second preset value after processing.

[0032] In this embodiment, the main memory buffer storage identification value is recorded by the MSR register. When the memory access record cache module writes information related to the memory access instruction into the main memory buffer, it first determines whether the main memory buffer is full according to the main memory buffer storage identification value, and only writes the information when it is not full, which will effectively improve the performance of the system.

[0033] Combined with the first aspect, in the fourth implementation manner of the first aspect, the preset monitored memory address range includes: multiple address ranges corresponding to multiple non - continuous memory intervals respectively.

[0034] In this embodiment, the memory access records of multiple non - continuous memory intervals can be recorded, further improving the flexibility and comprehensiveness of the memory access records.

[0035] Combined with the first aspect, the first, second, third, or fourth implementation manner of the first aspect, in the fifth implementation manner of the first aspect, the memory access information further includes: the access category of the memory access instruction, and the CPU identification;

[0036] The memory access record cache module records the current memory access information, including:

[0037] The memory access record cache module respectively uses 8 bytes to save the instruction address, the target memory address, and the page table base address at the time of memory access, and borrows the highest bit of the 8 - byte instruction address to record the access category, and borrows the highest 12 bits of the 8 - byte target memory address to record the CPU identification.

[0038] In this embodiment, according to the length characteristics of the virtual address, the occupied space of each memory access record recorded by the memory access record cache module is set, and each byte is fully utilized. The useful information is maximally recorded with the least number of bytes, further improving the cache space utilization rate of the memory access record cache module and improving the system performance.

[0039] Combined with the fifth implementation manner of the first aspect, in the sixth implementation manner of the first aspect, after the memory access record cache module records the current memory access information, the method further includes:

[0040] Reading the process page table base address in the recorded memory access information through the process information acquisition module;

[0041] The process information acquisition module traverses the process queue of the operating system to obtain the process information of the process that matches the currently read process page table base address; the process information at least includes the process identification and the process name;

[0042] The process information acquisition module transfers the currently read instruction address, target memory address, read / write category, CPU identifier and matched process information to a designated file accordingly.

[0043] In this embodiment, the problem that the base address of the process page table is not friendly to the user in analyzing the memory read and write records and the user cannot associate the base address of the page table with the relevant information of the process is further solved. Not only can the process information be obtained through the process information acquisition module and provided to the user, but also the memory address, read and write category, instruction address, CPU ID, process ID, process name and other information can be transferred to a file for archiving and offline viewing by users. It is a function of memory access records that takes into account both online recording and offline viewing.

[0044] In a second aspect, an embodiment of the present invention provides a system for recording memory access sources, including: a memory read / write execution module for executing memory access instructions, and also including: a memory access record cache module and an MSR register arranged in a CPU physical core;

[0045] The MSR register is used to store a preset monitoring memory address range and a preset main memory address range for storing memory access information;

[0046] The memory read / write execution module is used to determine whether the target memory address to be accessed by the memory access instruction belongs to the monitoring memory address range stored in the MSR register when receiving the memory access instruction. If so, execute the memory access instruction to access the memory and send the memory access information to the memory access record cache module; the memory access information includes the instruction address of the memory access instruction, the target memory address and the process page table base address at the time of memory access;

[0047] The memory access record cache module is used to record the received memory access information of this time, and write the recorded memory access information back to the main memory buffer corresponding to the main memory address range in the order of recording time.

[0048] This embodiment provides a method for recording the source of memory access, which adds a dedicated hardware module, a memory access record cache module, inside the CPU to save the instruction address of accessing a specified memory range. The hardware directly saves the instruction IP without the need for software participation, thereby expanding the range of memory addresses that can be recorded and keeping system performance basically unaffected.

[0049] In combination with the second aspect, in a first implementation of the second aspect, the memory access record cache module includes: a cache queue, a tail position register, a first judgment submodule, a storage submodule, a tail identification update submodule and a write-back module;

[0050] The cache queue is used to record memory access information;

[0051] The tail position register is used to record the tail position identification value of the data already recorded in the cache queue;

[0052] The first judgment sub-module is used to judge whether the cache queue is full when receiving the current memory access information;

[0053] The storage sub-module is used to store the current memory access information at the tail of the cache queue when the judgment result of the first judgment sub-module is negative;

[0054] The tail identification update sub-module is used to update the tail position identification value recorded in the tail position register after the storage sub-module stores the current memory access information at the tail of the cache queue;

[0055] The write-back module is used to write back the memory access information recorded in the cache queue to the main memory buffer in the order of recording time.

[0056] In this embodiment, the memory access record cache module records memory access information through the cache queue. Therefore, when the cache queue is not full, memory access information can be recorded. After recording, the tail position identification value is updated, and the physical recording of memory access information can be realized. The recording method is simple and efficient.

[0057] Combined with the first implementation manner of the second aspect, in the second implementation manner of the second aspect, the memory access record cache module further includes: a head position register, which is used to record the head position identification value of the data already recorded in the cache queue;

[0058] The write-back module includes:

[0059] The second judgment sub-module is used to judge whether the head position identification value recorded in the head position register is equal to the tail position identification value recorded in the tail position register;

[0060] The write-back sub-module is used to write back the memory access information at the position corresponding to the head position identification value in the cache queue to the main memory buffer when the judgment result of the second judgment sub-module is negative.

[0061] In this embodiment, when recording each time, the memory access record cache module determines whether the memory access record cache module is full by comparing the head position identification value and the tail position identification value of the cache queue. If it is not full, memory access information can be recorded, and the judgment method is simple.

[0062] Combined with the second implementation of the second aspect, in the third implementation of the second aspect, the MSR register is further used to record the main memory buffer storage identification value;

[0063] The write-back sub-module includes:

[0064] The first judgment unit is used to judge whether the main memory buffer storage identification value is equal to a first preset value when the judgment result of the second judgment sub-module is negative; wherein, the initial value of the main memory buffer storage identification value is a second preset value, the first preset value is used to represent that the main memory buffer is full, and the second preset value is used to represent that the main memory buffer is not full;

[0065] The acquisition unit is used to acquire the starting address of the main memory buffer and the number of stored memory access information when the judgment result of the first judgment unit is negative;

[0066] The write-back unit is used to write the memory access information at the position corresponding to the head position identification value in the cache queue into the main memory buffer, and the starting position of writing is A0 + offset * N; wherein, A0 is the starting address of the main memory buffer, offset is the number of stored memory access information in the main memory buffer, and N is the length of each memory access information recorded in the cache queue;

[0067] The first setting unit is used to update the head position identification value recorded in the head position register to head = head + 1 and make offset = offset + 1 after the write-back unit writes the memory access information at the position corresponding to the head position identification value in the cache queue into the main memory buffer; where head is the head position identification value recorded in the head position register;

[0068] The second judgment unit is used to judge whether A0 + offset * N is equal to A1; where A1 is the end address of the main memory buffer;

[0069] The second setting unit is used to set the main memory buffer storage identification value recorded in the MSR register to the first preset value and send an interrupt signal indicating that the main memory buffer is full to the CPU when the judgment result of the second judgment unit is positive, so as to wait for the CPU to process and reset the main memory buffer storage identification value to the second preset value.

[0070] In this embodiment, the main memory buffer storage identification value is recorded by the MSR register. When the memory access record cache module writes the information related to the memory access instruction into the main memory buffer, it first determines whether the main memory buffer is full according to the main memory buffer storage identification value, and only writes the information when it is not full, which will effectively improve the performance of the system.

[0071] Combined with the second aspect, in the fourth implementation manner of the second aspect, the preset monitored memory address range includes: multiple address ranges corresponding to multiple non - continuous memory intervals respectively.

[0072] This embodiment can record the memory access records of multiple non - continuous memory intervals, further improving the flexibility and comprehensiveness of the memory access records.

[0073] Combined with the second aspect, the first, second, third, or fourth implementation manner of the second aspect, in the fifth implementation manner of the second aspect, the memory access information further includes: the access category of the memory access instruction, the CPU identification;

[0074] The memory access record cache module respectively uses 8 bytes to save the instruction address, the target memory address, and the page table base address at the time of memory access, and borrows the highest bit of the 8 - byte instruction address to record the access category, and borrows the highest 12 bits of the 8 - byte target memory address to record the CPU identification.

[0075] In this embodiment, according to the length characteristics of the virtual address, the occupied space of each memory access record recorded by the memory access record cache module is set, and each byte is fully utilized. The useful information is maximally recorded with the least number of bytes, further improving the cache space utilization rate of the memory access record cache module and improving the system performance.

[0076] Combined with the fifth implementation manner of the second aspect, in the sixth implementation manner of the second aspect, the system for recording the memory access source further includes: a process information acquisition module;

[0077] The process information acquisition module includes:

[0078] A page table base address reading sub - module, configured to read the process page table base address in the memory access information recorded by the memory access record cache module and / or the main memory buffer;

[0079] A process queue traversing sub - module, configured to traverse the process queue of the operating system to obtain the process information of the process that matches the currently read process page table base address; the process information at least includes a process identification and a process name;

[0080] The file storage submodule is used to transfer the currently read instruction address, target memory address, read / write category, CPU identifier and matched process information to the specified file.

[0081] In this embodiment, the problem that the base address of the process page table is not friendly to the user in analyzing the memory read and write records and the user cannot associate the base address of the page table with the relevant information of the process is further solved. Not only can the process information be obtained through the process information acquisition module and provided to the user, but also the memory address, read and write category, instruction address, CPU ID, process ID, process name and other information can be transferred to a file for archiving and offline viewing by users. It is a function of memory access records that takes into account both online recording and offline viewing. BRIEF DESCRIPTION OF THE DRAWINGS

[0082] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0083] Figure 1 A schematic diagram of using hardware breakpoint registers to save the address of read and write memory instructions;

[0084] Figure 2 A flow chart of a method for recording memory access sources according to a first embodiment of the present invention;

[0085] Figure 3 This is a CPU core architecture diagram with memory read and write record cache;

[0086] Figure 4 A flow chart of a second embodiment of a method for recording memory access sources according to the present invention;

[0087] Figure 5 This is a structural diagram of a first embodiment of a system for recording memory access sources according to the present invention;

[0088] Figure 6 This is a structural diagram of a second embodiment of a system for recording memory access sources according to the present invention;

[0089] Figure 7 This is a structural diagram of a third embodiment of a system for recording memory access sources according to the present invention;

[0090] Figure 8 This is a structural diagram of a fourth embodiment of a system for recording memory access sources according to the present invention;

[0091] Figure 9This is a schematic structural diagram of the fifth embodiment of a system for recording the source of memory access in the present invention. Specific embodiments

[0092] The following describes in detail a method and a system for recording the source of memory access in an embodiment of the present invention with reference to the accompanying drawings.

[0093] It should be clear that the described embodiments are only a part of the embodiments of the present invention, rather than all of the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts belong to the scope of protection of the present invention.

[0094] Figure 2 This is a flowchart of the first embodiment of a method for recording the source of memory access in the present invention. As Figure 2 shown, the method of this embodiment may include the following steps S101 - S103:

[0095] Step S101: When the memory read / write execution module for executing the memory access instruction receives the memory access instruction, it determines whether the target memory address to be accessed by the memory access instruction belongs to a preset monitored memory address range. If so, step S102 is executed.

[0096] Among them, the monitored memory address range is recorded in a model - specific register (MSR, Model Specific Register) set in the physical core of the CPU.

[0097] In this embodiment, the MSR register includes a total of 5 registers. The first register MSR Memory Trace Control, which can be preset to control whether to turn on the memory read / write record tracking for this memory core, has a length of 4 bytes (32 bits). Bits 1 - 31 are reserved, and bit 0 is the control value for controlling whether to turn on the memory read / write record tracking for this memory core. For example, when bit 0 = 1 (true), it means to turn on the memory read / write record tracking, and when bit 0 = 0 (false), it means not to turn on the memory read / write record tracking. Before determining whether the target memory address belongs to the preset monitored memory address range, a pre - judgment can be made according to this value. If bit 0 = 0, it is directly returned that it does not belong to the preset monitored memory address range. If bit 0 = 1, then it continues to determine whether the target memory address to be accessed by the memory access instruction is the set monitored memory address, which will effectively improve the performance of the system.

[0098] Among them, the monitored memory address range is defined by presetting the start address and the end address of the monitored memory address. Among them, the start address of the monitored memory address is stored in the second register MSR Traced Memory Base register of the MSR register, and the end address of the monitored memory address is stored in the third register MSR Traced Memory Limit register of the MSR register. The formats of the two registers MSR Traced Memory Base register and MSR Traced Memory Limit register are exactly the same, with a length of 8 bytes (64 bits). Bits 63:12 of the address are saved in bits 63:12 of this register, and bits 11:0 must be 0.

[0099] Preferably, in order to better represent discontinuous monitored memory addresses, the start addresses and end addresses of multiple monitored memory addresses can be set to represent multiple address ranges corresponding to multiple non - continuous memory intervals respectively, so as to achieve the monitoring of multiple non - continuous memory intervals. Correspondingly, in order to record the multiple address ranges corresponding to multiple non - continuous memory intervals respectively, MSR Traced Memory Base / MSR Traced Memory Limit can be extended into multiple ones, and each MSR Traced Memory Base / MSR Traced Memory Limit is used to record the start address / end address of the monitored address of a continuous memory interval.

[0100] In this embodiment, if the memory read - write execution module determines that the target memory address does not belong to the preset monitored memory address range, it directly obtains data from the first - level data cache.

[0101] Step S102, the memory read - write execution module executes the memory access instruction, and records the current memory access information through the memory access record cache module set in the CPU physical core.

[0102] Among them, the memory access information includes the instruction address of the memory access instruction, the target memory address, and the process page - table base address during memory access.

[0103] In this embodiment, the memory access information uses 24 bytes, and the format is shown in Table 1 below:

[0104] Table 1. Memory access information format table

[0105] Offset Length Byte Field 0 8 Destination Memory Address 8 8 Instruction Address of Memory Access Instruction 16 8 Base Address of Process Page Table during Memory Access

[0106] Figure 3It is a CPU core architecture diagram with a memory read / write record cache. As shown in Figure 3 In the figure, in the embodiments of the present invention, a memory access record cache module 1 and an MSR register 2 are added to the CPU core. The memory access record cache module 1 receives data from the memory read / write execution module in the CPU core while writing the memory read / write records cached in itself back to the main memory. The MSR register 2 is used to record the monitored memory address range. Specifically, Figure 3 The basic process of the CPU core executing memory read / write is as described in steps 1)-5) below:

[0107] 1) Fetch instruction

[0108] The CPU core obtains the memory address where the current instruction is located from the instruction register (IP, Instruction Pointer). The CPU core queries the content of the current instruction from the instruction cache (Instruction Cache) with the IP as the keyword. If found, the instruction code is sent to the instruction decoding module for decoding. If not found, the content of the current instruction is queried from the lower-level cache until the memory.

[0109] 2) Instruction decoding

[0110] To improve CPU performance, the instructions used inside modern CPUs are not exactly the same as the instructions used by users for programming. Taking X86 as an example, the user instructions provided by X86 are 3-15 variable-length instructions. However, inside the CPU, the instruction decoding module re-decodes the variable-length instructions into one or more fixed-length instructions before execution.

[0111] 3) Issue

[0112] The function of the issue module is to send the decoded instruction sequence to the instruction scheduler. The scheduler is responsible for identifying the instruction categories and sending instructions of each type to the corresponding instruction execution module. For example, the scheduler will send memory read / write type instructions to the memory read / write execution module 3.

[0113] 4) Memory read / write instruction

[0114] To support high-performance acquisition of memory read / write records, in the embodiments of the present invention, a memory access record cache module 1 is added to the CPU core. As shown in Figure 3As shown in the figure, the memory access record cache module 1 can use a cache queue 13 to save memory access information, and use a head position pointer head (head position identification value) and a tail position pointer tail (tail position identification value) to indicate the record position that has not been written back to the main memory currently. The length of the cache queue 13 is preset by hardware, such as 4096 or 8192. Using the cache queue 13 to store memory access information, its read and write characteristics are first in first out, and this characteristic is convenient for subsequent operations on memory access information according to time.

[0115] Figure 3 After receiving a memory access instruction, the memory read / write execution module 3 in [reference] first determines whether the target memory address to be accessed by the currently received memory access instruction belongs to the preset monitored memory address range recorded in the MSR register 2 before querying the memory content from the data cache. If so, the memory read / write execution module 3 executes the current memory access instruction (the memory read / write execution module uses the memory address to be read / written as an index, and queries memory data level by level in the order of primary data cache → secondary data cache → main memory, and updates the cache status), and sends the memory address + IP address information of the current memory access instruction to the memory read / write record cache module 1. The memory read / write record cache module 1 stores the current memory access information in the cache queue 13 and updates the tail position pointer tail.

[0116] 5) Commit

[0117] After the memory read / write instruction is executed, the commit module is responsible for updating the content of the instruction register and clearing the intermediate state.

[0118] Among them, the memory access record cache module 1 is added to each CPU physical core, and the added MSR register is also added to each CPU physical core. Therefore, after the software configures each CPU physical core, the memory read records of each physical core can work simultaneously. The buffer areas allocated in the main memory are also recommended to be allocated in different address spaces, which can ensure that the write-back operations to the main memory can also work concurrently, that is, it can support multiple CPUs.

[0119] Step S103, the memory access record cache module writes the recorded memory access information back to the main memory buffer area corresponding to the preset computer main memory address range in the order of recording time.

[0120] Among them, the main memory address range is recorded in the MSR register.

[0121] In this embodiment, the main memory buffer area can be defined by setting the start address and the end address of the main memory buffer area.

[0122] Such as Figure 3For the structure shown, the memory read / write record cache module 1 is also used to write the data in the cache queue back to the main memory and update the head position pointer head. When the main memory buffer is full, an exception is sent to the CPU for subsequent processing. To ensure that the memory access information can be successfully written into the main memory buffer, it is necessary to determine whether the main memory buffer is full before writing. If it is full, an exception is sent to notify the CPU. If it is not full, the write operation is performed, thereby effectively improving the performance of the system. Among them, the starting address of the main memory buffer is stored in the fourth register of the MSR register, the MSR MemoryTrace Log Base register, and the ending address of the main memory buffer is stored in the fifth register of the MSR register, the MSR Memory Trace Log Limit register. Then, before writing the memory access information into the main memory buffer, the values recorded in the MSR Memory Trace Log Base register and the MSR Memory Trace Log Limit register can be read and judged to determine the write address range.

[0123] As an optional embodiment, the memory access record cache module records the current memory access information, including S1021 - S1023:

[0124] S1021: The memory access record cache module determines whether the cache queue used to record memory access information is full; otherwise, execute S1022.

[0125] In this embodiment, a queue is used to store the memory access information. Then, the corresponding queue has a head position pointer (head), a tail position pointer (tail), and a queue length (queue_length). When (tail + 1) % queue_length = head, it means the queue is full. On the contrary, when (tail + 1) % queue_length!= head, it means the queue is not full, which has the advantages of simple and accurate judgment.

[0126] S1022: The memory access record cache module stores the current memory access information at the tail of the cache queue.

[0127] In this embodiment, when (tail + 1) % queue_length!= head, the memory access information can be stored at the tail of the cache queue, that is, at the position of (tail + 1) % queue_length.

[0128] S1023: The memory access record cache module updates the tail position identification value of the data already recorded in the cache queue.

[0129] In this embodiment, after each time a memory access information is stored at the tail of the cache queue, it is necessary to set the tail position identification value tail of the recorded data in the cache queue to tail = tail + 1, which is convenient for writing the next information.

[0130] As an optional embodiment, step S103 includes:

[0131] S1031: The memory access record cache module determines whether the head position identification value of the recorded data in the cache queue is equal to the tail position identification value. Otherwise, execute S1032.

[0132] In this embodiment, when tail = head of the cache queue, that is, when the head position identification value of the cache queue is equal to the tail position identification value, it means that all records in the queue have been written back to the main memory. Otherwise, it means that there are still records in the queue that have not been written back to the main memory buffer.

[0133] S1032: The memory access record cache module writes the memory access information at the position corresponding to the head position identification value in the cache queue back to the main memory buffer.

[0134] In this embodiment, when tail!= head of the cache queue, there must be memory access information recorded at the position pointed to by head. Therefore, the record at this position can be written back to the main memory buffer.

[0135] A method for recording the source of memory access provided in this embodiment saves the information related to the memory access instruction (i.e., the source of memory access) that accesses the memory address within the preset monitored memory address range by adding a hardware module memory read / write record cache inside the CPU. Since the instruction IP is directly saved to the main memory cache area by hardware without software participation, the range of memory addresses that can be recorded is expanded, and the system performance is basically not affected.

[0136] Figure 4 This is the flowchart of the second embodiment of a method for recording the source of memory access according to the present invention. As Figure 4 shown, the method of this embodiment includes S201 - S212:

[0137] S201: When the memory read / write execution module for executing the memory access instruction receives the memory access instruction, it determines whether the target memory address to be accessed by the memory access instruction belongs to the preset monitored memory address range. If so, execute S202.

[0138] S202: The memory read / write execution module executes the memory access instruction and sends the memory access information to the memory access record cache module set in the CPU physical core.

[0139] S203: The memory access record cache module determines whether the cache queue for recording memory access information is full; otherwise, execute S204.

[0140] S204: The memory access record cache module stores the current memory access information at the tail of the cache queue.

[0141] Preferably, as shown in Table 1 above, since the actual length of the virtual address does not need to be 64 bits (i.e., 8 bytes), under the 4-level page table, the virtual address space is at most 48 bits. The remaining high-order addresses are either all 0 or all 1. Therefore, the highest bit of the read / written memory address can be borrowed to indicate whether the record is a read operation or a write operation. The original value of the highest bit can be easily restored according to other high-order contents. For the same reason, borrow the high 12 bits of the instruction address to save the CPU id. Since the memory addresses and instruction addresses saved in the memory record are both virtual addresses, to distinguish whether the virtual addresses between different records belong to the same process, the page table base address at the time of sending the memory access is also saved in the record. Then the refined memory access information format is as shown in Table 2 below:

[0142] Table 2. Refined Memory Access Information Format Table

[0143]

[0144]

[0145] As an alternative embodiment, after this step S204, it further includes S2041 - S2043:

[0146] S2041: The process information acquisition module reads the process page table base address in the recorded memory access information.

[0147] S2042: The process information acquisition module traverses the process queue of the operating system to obtain the process information of the process that matches the currently read process page table base address.

[0148] The process information at least includes a process identifier and a process name.

[0149] S2043: The process information acquisition module transfers the currently read instruction address, target memory address, read / write category, CPU identifier, and the matched process information to a specified file correspondingly.

[0150] In this embodiment, the page table base address in the memory read / write record is read, and the process queue of the operating system is traversed to compare whether the page table base address of each process is the same as the page table base address in the read / write record one by one. If they are the same, it indicates that the process accessing the memory has been found, and then other information such as the process ID and process name can be obtained from the process data structure. Information such as the memory address, read / write category, instruction address, CPU ID, process ID, and process name can be transferred and stored in a file.

[0151] S5205: The memory access record cache module updates the tail position identification value of the data recorded in the cache queue.

[0152] S206: The memory access record cache module determines whether the head position identification value of the data recorded in the cache queue is equal to the tail position identification value. Otherwise, S207 is executed.

[0153] S207: The memory access record cache module determines whether the main memory buffer storage identification value recorded in the MSR register is equal to a first preset value; otherwise, S208 is executed.

[0154] Among them, the initial value of the main memory buffer storage identification value is a second preset value. The first preset value is used to represent that the main memory buffer is full, and the second preset value is used to represent that the main memory buffer is not full.

[0155] In this embodiment, in order to ensure that the memory access information can be successfully written into the main memory, it is necessary to determine whether the main memory buffer is full before writing. If it is full, an exception is sent to notify the CPU. If it is not full, the write operation is performed. Among them, the size of the main memory buffer should be an integer multiple of the length of the memory access information (such as 24 bytes), and its storage identification value can be written into the MSR Memory Trace Log Full register. When the value of MSR Memory Trace Log Full = 1 (true), it represents that the main memory buffer is full. When the value of MSR Memory Trace Log Full = 0 (false), it represents that the main memory buffer is not full.

[0156] S208: The memory access record cache module obtains the starting address of the main memory buffer and the number of stored memory access information.

[0157] In this embodiment, when the value of MSR Memory Trace Log Full!= 1 (true), it indicates that the main memory buffer is not full. Then, the starting address of the main memory buffer stored in the MSR Memory Trace Log Base register can be read. At the same time / subsequently, the number of stored memory access information offset is obtained, which is convenient for calculating the position where the memory access information should be stored later.

[0158] S209: The memory access record caching module writes the memory access information at the position corresponding to the head position identification value in the cache queue into the main memory buffer, and the starting write position is A0 + offset * N;

[0159] Wherein, A0 is the starting address of the main memory buffer, offset is the number of stored memory access information in the main memory buffer, and N is the length of each memory access information recorded in the cache queue.

[0160] In this embodiment, assuming that the value of MSR Memory Trace Log Base is 100, the number of stored memory access information in the main memory buffer offset = 3, and N = 24, then the memory access information in the cache queue can be written back to the main memory buffer address 172.

[0161] S210: The memory access record caching module sets head = head + 1 and offset = offset + 1.

[0162] Wherein, head is the head position identification value of the data recorded in the cache queue.

[0163] In this embodiment, the memory access record caching module sets head = head + 1 and offset = offset + 1, which is convenient for subsequent queue storage of memory access information or timely setting of the main memory buffer storage identification value.

[0164] S211: The memory access record caching module determines whether A0 + offset * N is equal to A1; if so, execute S212.

[0165] Wherein, A1 is the end address of the main memory buffer.

[0166] In this embodiment, the value of A0 + offset * N indicates that the memory access information has been written full from address A0 to A0 + offset * N. The judgment of whether A0 + offset * N is equal to A1 is mainly to realize the judgment of whether the main memory buffer can still write memory access information. If they are equal, no more memory access information can be written.

[0167] S212: The memory access record cache module sets the main memory buffer storage identification value recorded in the MSR register to a first preset value, and sends an interrupt signal indicating that the main memory buffer is full to the CPU, waiting for the CPU to reset the main memory buffer storage identification value to a second preset value after processing.

[0168] In this embodiment, when A0 + offset * N is equal to A1, it indicates that there is no more space in the main memory buffer to write memory access information. Therefore, the main memory buffer storage identification value should be immediately set to the first preset value (true), and an interrupt signal indicating that the main memory buffer is full is sent to the CPU. After receiving the interrupt indicating that the buffer is full, the CPU can transfer the buffer content to the disk in the interrupt handling function or reallocate a block of memory. After processing, Memory Trace Log Full is restored to 0. If a buffer is reallocated, the MSR Memory Trace Log Base / MSR Memory Log BufferLimit registers need to be updated.

[0169] A method for recording the source of memory access provided in this embodiment adds a hardware module memory read / write record cache inside the CPU to save information related to memory access instructions (including: instruction address of the memory access instruction, target memory address, process page table base address at the time of memory access, access category of the memory access instruction, CPU identification) that belong to a preset monitored memory address range. The saved memory access source information is comprehensive. At the same time, when the memory access record cache module writes information related to memory access instructions into the main memory buffer, it first determines whether the main memory buffer is full according to the main memory buffer storage identification value, and only writes the information when it is not full, which will effectively improve the performance of the system.

[0170] Based on the same technical concept, an embodiment of the present invention also provides a system for recording the source of memory access, as Figure 5 shown. The system includes: a memory read / write execution module 3 for executing memory access instructions, and further includes: a memory access record cache module 1 and an MSR register 2 provided in the physical core of the CPU;

[0171] The MSR register 2 is used to store a preset monitored memory address range and a preset main memory address range for saving memory access information. Specifically, the MSR register 2 includes: the first register, the MSR Memory Trace Control register, which is used to control whether the memory core turns on the memory read / write record tracing; the second register, the MSR TracedMemory Base register, which is used to record the start address of the monitored memory address; the third register, the MSR TracedMemory Limit register, which is used to record the end address of the monitored memory address. The functions of each MSR register are as described above and will not be elaborated here.

[0172] Preferably, the preset monitored memory address range includes: multiple address ranges corresponding to multiple non - continuous memory intervals respectively. Correspondingly, to record the multiple address ranges corresponding to multiple non - continuous memory intervals respectively, the MSR Traced Memory Base / MSR Traced Memory Limit in the MSR register 2 can be extended into multiple ones, and each MSR Traced Memory Base / MSR Traced Memory Limit is respectively used to record the start address / end address of the monitored address of a continuous memory interval.

[0173] The memory read / write execution module 3 is used to, when receiving a memory access instruction, determine whether the target memory address to be accessed by the memory access instruction belongs to the monitored memory address range stored in the MSR register 2. If so, execute the memory access instruction to access the memory, and send the current memory access information to the memory access record cache module 1; the memory access information includes the instruction address of the memory access instruction, the target memory address, and the process page table base address at the time of memory access.

[0174] The memory access record cache module 1 is used to record the received current memory access information, and write the recorded memory access information back to the main memory buffer corresponding to the main memory address range in the order of the recording time. Preferably, the memory access information further includes: the access category of the memory access instruction, the CPU identifier; the memory access record cache module 1 respectively saves the instruction address, the target memory address, and the page table base address at the time of memory access with 8 bytes, and borrows the highest bit of the 8 - byte instruction address to record the access category, and borrows the highest 12 bits of the 8 - byte target memory address to record the CPU identifier.

[0175] Figure 6 This is a schematic structural diagram of the second embodiment of the system for recording the source of memory access in the present invention. As Figure 6 shown, this embodiment is in Figure 5On the basis of the structure of the first system embodiment shown, further, the memory access record cache module 1 includes: a cache queue 13, a tail position register 16, a first judgment sub-module 11, a storage sub-module 12, a tail identification update sub-module 15, and a write-back module 14;

[0176] The cache queue 13 is used to record memory access information;

[0177] The tail position register 16 is used to record the tail position identification value of the data already recorded in the cache queue 13;

[0178] The first judgment sub-module 11 is used to judge whether the cache queue 13 is full when receiving the current memory access information;

[0179] The storage sub-module 12 is used to store the current memory access information at the tail of the cache queue 13 when the judgment result of the first judgment sub-module 11 is negative;

[0180] The tail identification update sub-module 15 is used to update the tail position identification value recorded in the tail position register 16 after the storage sub-module 12 stores the current memory access information at the tail of the cache queue;

[0181] The write-back module 14 is used to write back the memory access information recorded in the cache queue 13 to the main memory buffer in the order of recording time.

[0182] Figure 7 This is a schematic structural diagram of the third system embodiment of the system for recording the source of memory access of the present invention. As Figure 7 shown, this embodiment is based on Figure 6 On the basis of the structure of the second system embodiment shown, further, the memory access record cache module 1 further includes: a head position register 17, which is used to record the head position identification value of the data already recorded in the cache queue;

[0183] The write-back module 14 includes:

[0184] The second judgment sub-module 141 is used to judge whether the head position identification value recorded in the head position register 17 is equal to the tail position identification value recorded in the tail position register 16;

[0185] The write-back sub-module 142 is used to write back the memory access information at the position corresponding to the head position identification value in the cache queue 13 to the main memory buffer when the judgment result of the second judgment sub-module 141 is negative.

[0186] Figure 8 This is a schematic structural diagram of the fourth system embodiment of the system for recording the source of memory access of the present invention. As Figure 8 shown, this embodiment is based on Figure 7Based on the structure of the third system embodiment shown, further, the MSR register 2 is also used to record the main memory buffer storage identification value; specifically, the MSR register 2 further includes: a fourth register, the MSR Memory TraceLog Base register, for recording the starting address of the main memory buffer; a fifth register, the MSR Memory TraceLog Limit register, for recording the ending address of the main memory buffer.

[0187] Figure 8 In the embodiment shown, the write-back sub-module 142 includes:

[0188] A first judgment unit 1426, configured to judge whether the main memory buffer storage identification value is equal to a first preset value when the judgment result of the second judgment sub-module 141 is negative; wherein, the initial value of the main memory buffer storage identification value is a second preset value, the first preset value is used to represent that the main memory buffer is full, and the second preset value is used to represent that the main memory buffer is not full;

[0189] An acquisition unit 1425, configured to acquire the starting address of the main memory buffer and the number of stored memory access information when the judgment result of the first judgment unit 1426 is negative;

[0190] A write-back unit 1424, configured to write the memory access information at the position corresponding to the head position identification value in the cache queue 13 into the main memory buffer, and the starting position of writing is A0 + offset * N; wherein, A0 is the starting address of the main memory buffer, offset is the number of stored memory access information in the main memory buffer, and N is the length of each memory access information recorded in the cache queue;

[0191] A first setting unit 1423, configured to update the head position identification value recorded in the head position register to head = head + 1 and make offset = offset + 1 after the write-back unit 1424 writes the memory access information at the position corresponding to the head position identification value in the cache queue 13 into the main memory buffer; where head is the head position identification value recorded in the head position register;

[0192] A second judgment unit 1422, configured to judge whether A0 + offset * N is equal to A1; where A1 is the ending address of the main memory buffer;

[0193] The second setting unit 1421 is used to set the main memory buffer storage identification value recorded in the MSR register 2 to the first preset value when the result of the judgment of the second judgment unit 1422 is yes, and send a main memory buffer full interrupt signal to the CPU to wait for the CPU to reset the main memory buffer storage identification value to the second preset value after processing.

[0194] Figure 9 FIG. 5 is a schematic diagram of a fifth embodiment of a system for recording memory access sources according to the present invention. Figure 9 As shown, in this embodiment Figure 8 Based on the structure of the fourth embodiment of the system, the system for recording memory access sources further includes: a process information acquisition module 4;

[0195] The process information acquisition module 4 includes:

[0196] The page table base address reading submodule 41 is used to read the process page table base address in the memory access information recorded by the memory access record cache module 1 and / or the main memory buffer.

[0197] The process queue traversal submodule 42 is used to traverse the process queue of the operating system and obtain the process information of the process matching the base address of the currently read process page table; the process information at least includes a process identifier and a process name.

[0198] The file storage submodule 43 is used to transfer the currently read instruction address, target memory address, read / write category, CPU identifier and matched process information to a designated file accordingly.

[0199] It should be noted that, in this document, relational terms such as first and second, etc. are merely used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations.

[0200] A person skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The storage medium can be a disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM), etc.

[0201] The above are only specific embodiments of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by those skilled in the art within the technical scope disclosed by the present invention should be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A method for recording the source of memory access, characterized in that, Including: When the memory read / write execution module for executing memory access instructions receives a memory access instruction, it determines whether the target memory address to be accessed by the memory access instruction belongs to a preset monitored memory address range; wherein, the monitored memory address range is recorded in the MSR register set in the CPU physical core; If the target memory address belongs to the preset monitored memory address range, the memory read / write execution module executes the memory access instruction and records the current memory access information through the memory access record cache module set in the CPU physical core; the memory access information includes the instruction address of the memory access instruction, the target memory address, and the process page table base address during memory access; The memory access record cache module writes the recorded memory access information back to the main memory buffer corresponding to the preset computer main memory address range in the order of recording time; wherein, the main memory address range is recorded in the MSR register.

2. The method for recording the source of memory access according to claim 1, wherein The memory access record cache module records the current memory access information, including: The memory access record cache module determines whether the cache queue for recording memory access information is full; If the cache queue is not full, the memory access record cache module stores the current memory access information at the tail of the cache queue; The memory access record cache module updates the tail position identification value of the data already recorded in the cache queue.

3. The method for recording the source of memory access according to claim 2, wherein, The memory access record cache module writes the recorded memory access information back to the main memory buffer corresponding to the preset computer main memory address range in the order of recording time, including: The memory access record cache module determines whether the head position identification value of the data already recorded in the cache queue is equal to the tail position identification value; If the head position identification value of the data already recorded in the cache queue is not equal to the tail position identification value, the memory access record cache module writes the memory access information at the position corresponding to the head position identification value in the cache queue back to the main memory buffer.

4. The method for recording the source of memory access according to claim 3, wherein The memory access record cache module writes the memory access information at the position corresponding to the head position identification value in the cache queue back to the main memory buffer, including: The memory access record cache module determines whether the main memory buffer storage identification value recorded in the MSR register is equal to a first preset value; wherein, the initial value of the main memory buffer storage identification value is a second preset value, the first preset value is used to indicate that the main memory buffer is full, and the second preset value is used to indicate that the main memory buffer is not full; If the main memory buffer storage identification value is not equal to the first preset value, the memory access record cache module obtains the starting address of the main memory buffer and the number of memory access information already stored; The memory access record cache module writes the memory access information at the position corresponding to the head position identification value in the cache queue into the main memory buffer, and the starting position for writing is A0 + offset * N; where A0 is the starting address of the main memory buffer, offset is the number of memory access information already stored in the main memory buffer, and N is the length of each memory access information recorded in the cache queue; The memory access record cache module makes head = head + 1, offset = offset + 1; where head is the head position identification value of the data already recorded in the cache queue; The memory access record cache module determines whether A0 + offset * N is equal to A1; where A1 is the end address of the main memory buffer; If A0 + offset * N is equal to A1, the memory access record cache module sets the main memory buffer storage identification value recorded in the MSR register to a first preset value, and sends an interrupt signal indicating that the main memory buffer is full to the CPU, waiting for the CPU to reset the main memory buffer storage identification value to a second preset value after processing.

5. The method for recording the source of memory access according to claim 1, wherein The preset monitored memory address range includes: multiple address ranges corresponding to multiple non - continuous memory intervals respectively.

6. The method for recording the source of memory access according to any one of claims 1-5, characterized in that, The memory access information further includes: the access category of the memory access instruction, the CPU identification; The memory access record cache module records the current memory access information, including: The memory access record cache module respectively uses 8 bytes to save the instruction address, the target memory address, and the page table base address at the time of memory access, and borrows the highest bit of the 8 - byte instruction address to record the access category, and borrows the highest 12 bits of the 8 - byte target memory address to record the CPU identification.

7. The method for recording the source of memory access according to claim 6, wherein After the memory access record cache module records the current memory access information, the method further includes: Reading the process page table base address in the recorded memory access information through the process information acquisition module; The process information acquisition module traverses the process queue of the operating system to obtain the process information of the process that matches the currently read process page table base address; the process information at least includes the process identification and the process name; The process information acquisition module correspondingly transfers and stores the currently read instruction address, target memory address, read - write category, CPU identification, and the matched process information into a specified file.

8. A system for recording the source of memory accesses, comprising: A memory read - write execution module for executing memory access instructions, characterized by further including: a memory access record cache module and an MSR register provided in the CPU physical core; The MSR register is used to store the preset monitored memory address range and the preset main memory address range for saving memory access information; The memory read / write execution module is used to, when receiving a memory access instruction, determine whether the target memory address to be accessed by the memory access instruction belongs to the monitored memory address range stored in the MSR register. If so, execute the memory access instruction to access the memory, and send the current memory access information to the memory access record cache module; the memory access information includes the instruction address of the memory access instruction, the target memory address, and the process page table base address at the time of memory access. The memory access record cache module is used to record the current memory access information received, and write the recorded memory access information back to the main memory buffer corresponding to the main memory address range in the order of recording time.

9. The system for recording the source of memory access according to claim 8, wherein The memory access record cache module includes: a cache queue, a tail position register, a first judgment sub-module, a storage sub-module, a tail identifier update sub-module, and a write-back module. The cache queue is used to record memory access information. The tail position register is used to record the tail position identifier value of the data already recorded in the cache queue. The first judgment sub-module is used to, when receiving the current memory access information, judge whether the cache queue is full. The storage sub-module is used to, when the judgment result of the first judgment sub-module is no, store the current memory access information at the tail of the cache queue. The tail identifier update sub-module is used to, after the storage sub-module stores the current memory access information at the tail of the cache queue, update the tail position identifier value recorded by the tail position register. The write-back module is used to write back the memory access information recorded in the cache queue to the main memory buffer in the order of recording time.

10. The system for recording the source of memory access according to claim 9, wherein The memory access record cache module further includes: a head position register, which is used to record the head position identifier value of the data already recorded in the cache queue. The write-back module includes: A second judgment sub-module, which is used to judge whether the head position identifier value recorded by the head position register is equal to the tail position identifier value recorded by the tail position register. A write-back sub-module, which is used to, when the judgment result of the second judgment sub-module is no, write back the memory access information at the position corresponding to the head position identifier value in the cache queue to the main memory buffer.

11. The system for recording the source of memory access according to claim 10, wherein The MSR register is further used to record the main memory buffer storage identifier value. The write-back sub-module includes: A first judgment unit, which is used to, when the judgment result of the second judgment sub-module is no, judge whether the main memory buffer storage identifier value is equal to a first preset value; wherein, the initial value of the main memory buffer storage identifier value is a second preset value, the first preset value is used to represent that the main memory buffer is full, and the second preset value is used to represent that the main memory buffer is not full. An acquisition unit, which is used to, when the judgment result of the first judgment unit is no, acquire the starting address of the main memory buffer and the number of stored memory access information. A write-back unit, configured to write the memory access information at the position corresponding to the head position identification value in the cache queue into the main memory buffer, and the starting write position is A0 + offset * N; where A0 is the starting address of the main memory buffer, offset is the number of memory access information already stored in the main memory buffer, and N is the length of each memory access information recorded in the cache queue; A first setting unit, configured to, after the write-back unit writes the memory access information at the position corresponding to the head position identification value in the cache queue into the main memory buffer, update the head position identification value recorded in the head position register to head = head + 1, and make offset = offset + 1; where head is the head position identification value recorded in the head position register; A second judgment unit, configured to judge whether A0 + offset * N is equal to A1; where A1 is the end address of the main memory buffer; A second setting unit, configured to, when the judgment result of the second judgment unit is yes, set the main memory buffer storage identification value recorded in the MSR register to a first preset value, and send an interrupt signal indicating that the main memory buffer is full to the CPU, so as to wait for the CPU to process and reset the main memory buffer storage identification value to a second preset value.

12. The system for recording the source of memory access according to claim 8, wherein The preset monitored memory address range includes: multiple discontinuous memory intervals corresponding to multiple address ranges respectively.

13. The system for recording the source of memory access according to any one of claims 8-12, characterized in that, The memory access information further includes: the access category of the memory access instruction and the CPU identification; The memory access record cache module stores the instruction address, the target memory address, and the page table base address at the time of memory access in 8 bytes respectively, and borrows the highest bit of the 8-byte instruction address to record the access category, and borrows the highest 12 bits of the 8-byte target memory address to record the CPU identification.

14. The system for recording the source of memory access according to claim 13, wherein Further included: A process information acquisition module; The process information acquisition module includes: A page table base address reading sub-module, configured to read the process page table base address in the memory access information recorded in the memory access record cache module and / or the main memory buffer; A process queue traversing sub-module, configured to traverse the process queue of the operating system to obtain the process information of the process that matches the currently read process page table base address; the process information includes at least the process identification and the process name; A file storage sub-module, configured to correspondingly transfer and store the currently read instruction address, target memory address, read / write category, CPU identification, and the matched process information to a specified file.

Images