A method for monitoring instruction-level memory access based on a hardware page protection mechanism

Abstract

The application discloses a kind of instruction level memory access monitoring methods based on hardware page protection mechanism, steps include: S01.memory access monitoring system is applied to page protection to memory pool;S02.if triggering page error during the execution process of the monitored program, when the monitored program is interrupted after triggering page error, the execution context of the monitored program is saved in memory, and step S03 is converted;If page error is not triggered, return to step S02 and continue to execute;S03.page error processing function obtains program control authority, and executes page error processing operation;S04.the monitored program resumes execution in the single-step execution mode of processor Memory access instruction that is interrupted;S05.when the monitored program is interrupted for triggering debugging exception, debugging exception processing function obtains program control authority, and executes debugging exception processing operation.The application has the advantages of simple implementation method, high monitoring precision, flexibility and strong usability.

Description

Technical Field

[0001] This invention relates to the field of memory access monitoring technology, and in particular to an instruction-level memory access monitoring method based on a hardware page protection mechanism. Background Technology

[0002] Memory access monitoring is commonly used in scenarios such as program debugging, performance analysis, and checkpoint construction. Hardware page protection is a hardware mechanism used by the processor's memory management unit to control access permissions to virtual memory pages. By leveraging the processor's hardware page protection mechanism, a memory access monitoring system that is transparent to the monitored program can be built at the software level. This means that the memory access behavior of the monitored program can be obtained without modifying it or requiring access to its source code.

[0003] Taking memory write access operations as an example, existing memory access monitoring methods based on hardware page protection mechanisms mainly employ the following approach: The memory access monitoring system first initializes the access permissions of the monitored memory region to read-only, i.e., implements page write protection for the monitored memory region; when the monitored program attempts to perform a write operation to the monitored memory region, the processor memory control unit will trigger a page fault due to a page access permission violation; furthermore, the monitored program is interrupted, and program control is transferred to the page fault handling function; the page fault handling function records the virtual address of the accessed memory page and sets the access permissions of that memory page to writable; after the page fault handling function finishes execution, the monitored program regains program control; after regaining program control, the monitored program resumes execution from the point where the interrupted write instruction occurred.

[0004] However, the above method for monitoring page access has the following problems:

[0005] 1. Using the memory access monitoring method described above, the memory access monitoring system can only obtain memory access records in units of virtual memory pages, and cannot implement more granular memory access monitoring, thus limiting its application scope.

[0006] 2. When performing memory access monitoring using the above method, after detecting access to a memory page, the memory access monitoring system needs to remove the page protection for the accessed memory page so that the monitored program can resume the interrupted memory access operation. Once the page protection for the monitored memory region is removed, the memory access monitoring system will be unable to continue monitoring subsequent accesses to the corresponding page. Summary of the Invention

[0007] The technical problem to be solved by this invention is to provide an instruction-level memory access monitoring method based on a hardware page protection mechanism, which is simple to implement, has high monitoring accuracy, flexibility and ease of use, and addresses the technical problems existing in the prior art.

[0008] To solve the above-mentioned technical problems, the technical solution proposed by this invention is as follows:

[0009] A method for monitoring instruction-level memory access based on hardware page protection mechanism, comprising the following steps:

[0010] S01. The memory access monitoring system applies page protection to the memory pool;

[0011] S02. During the execution of the monitored program, if the instruction executed by the monitored program triggers a page fault, and the monitored program is interrupted after the page fault is triggered, the execution context of the monitored program is saved in memory, and the process proceeds to step S03; if the instruction executed by the monitored program does not trigger a page fault, the process returns to step S02 to continue execution.

[0012] S03. The page error handling function obtains program control and performs page error handling operations.

[0013] S04. The monitored program resumes execution of interrupted memory access instructions in the processor's single-step execution mode;

[0014] S05. When the monitored program is interrupted due to a debug exception, the debug exception handling function gains program control and performs debug exception handling operations.

[0015] Furthermore, in step S01, when only write access is monitored, the memory access monitoring system applies page protection to the memory pool by setting the access permissions of all memory pages in the memory pool to allow only read access.

[0016] Furthermore, in step S01, when both read access and write access are monitored simultaneously, the memory access monitoring system applies page protection to the memory pool by setting the access permissions of all memory pages in the memory pool to inaccessible.

[0017] Furthermore, in step S02, the page error triggered by the instruction executed by the monitored program includes page errors triggered due to page access permission violations.

[0018] Furthermore, the step of the page fault handling function performing page fault handling operations in step S03 includes:

[0019] S301. Record the virtual memory address that the memory access instruction that triggered the page fault needs to access, i.e. the memory address that the monitored program is accessing;

[0020] S302. Remove page protection for the memory page being accessed by the monitored program and set the access permission to allow read and write operations;

[0021] S303. Modify the processor flags stored in the execution context of the interrupted program to enable single-step execution mode;

[0022] After the S304 page fault handling function finishes execution, the operating system performs interrupt recovery. After the interrupt recovery is completed, the processor enters single-step execution mode.

[0023] Furthermore, in step S304, the interrupt recovery process uses the execution context of the interrupted program saved when the interrupt was triggered to restore the processor's register contents and flag state; after the interrupt recovery is completed, the processor begins to enter single-step execution mode.

[0024] Furthermore, in step S05, the step of the debug exception handling function performing debug exception handling operations includes:

[0025] S501. Modify the processor flags stored in the execution context of the interrupted program, and disable the single-step mode flag.

[0026] S502. Reapply page protection to the memory pages being accessed by the monitored program;

[0027] S503. After the debugging exception handling function finishes execution, the operating system performs interrupt recovery, and the processor exits the single-step execution mode.

[0028] Furthermore, step S05 is followed by step S06: if the monitored program exits, the current monitoring ends; otherwise, the process returns to step S02.

[0029] Compared with the prior art, the advantages of the present invention are as follows:

[0030] 1. The present invention is an instruction-level memory access monitoring method based on hardware page protection mechanism. The memory access monitoring system constructed can obtain the virtual memory address accessed by each memory access instruction in the monitored program. For each memory access monitored, page protection can be automatically applied to the accessed memory page after the access is completed so as to monitor the subsequent access of the monitored program to that memory page.

[0031] 2. The instruction-level memory access monitoring method based on the hardware page protection mechanism of this invention can collect memory access behavior at the instruction level, resulting in higher monitoring accuracy; and it does not require the memory access monitoring system to explicitly reprotect the monitored memory pages, making it more flexible and easier to use. Attached Figure Description

[0032] Figure 1 This is a schematic diagram illustrating the implementation process of the instruction-level memory access monitoring method based on the hardware page protection mechanism in this embodiment. Detailed Implementation

[0033] The present invention will be further described below with reference to the accompanying drawings and specific preferred embodiments, but this does not limit the scope of protection of the present invention.

[0034] The core idea of ​​this invention is to construct a more flexible and fine-grained memory access monitoring mechanism by integrating the page protection mechanism provided by the processor hardware level and the single-step execution mode. Considering that in single-step execution mode, the processor interrupts the currently executing program and triggers a debug exception every time it executes an instruction, this invention utilizes the aforementioned characteristics of the processor's single-step execution mode to achieve automatic re-protection of accessed memory pages.

[0035] like Figure 1 As shown, the steps of the instruction-level memory access monitoring method based on hardware page protection mechanism in this embodiment include:

[0036] S01. The memory access monitoring system applies page protection to the memory pool;

[0037] S02. During the execution of the monitored program, if the instruction executed by the monitored program triggers a page fault, and the monitored program is interrupted after the page fault is triggered, the execution context of the monitored program is saved in memory, and the process proceeds to step S03; if the instruction executed by the monitored program does not trigger a page fault, the process returns to step S02 to continue execution.

[0038] S03. The page error handling function obtains program control and performs page error handling operations.

[0039] S04. The monitored program resumes execution of interrupted memory access instructions in the processor's single-step execution mode;

[0040] S05. When the monitored program is interrupted due to a debug exception, the debug exception handling function gains program control and performs debug exception handling operations.

[0041] S06. If the monitored program exits, end the current monitoring; otherwise, return to step S02.

[0042] In step S01 above, when only write access is monitored, the memory access monitoring system applies page protection to the memory pool by setting the access permissions of all memory pages in the memory pool to read-only. When both read and write access are monitored simultaneously, the memory access monitoring system applies page protection to the memory pool by setting the access permissions of all memory pages in the memory pool to inaccessible. That is, for the case of monitoring only write access, page protection is applied by setting the access permissions of all memory pages in the memory pool to read-only. For the case of monitoring both read and write access simultaneously, page protection is applied by setting the access permissions of all memory pages in the memory pool to inaccessible, thus employing different page protection methods for the memory pool depending on whether only write access is monitored or both read and write access are monitored simultaneously.

[0043] In step S03 of this embodiment, the steps of the page error handling function performing page error handling operations include:

[0044] S301. Record the virtual memory address that the memory access instruction that triggered the page fault needs to access, i.e. the memory address that the monitored program is accessing;

[0045] S302. Remove page protection for the memory page being accessed by the monitored program and set the access permission to allow read and write operations;

[0046] S303. Modify the processor flags stored in the execution context of the interrupted program, and configure single-step execution mode to be enabled (specifically, set to 1);

[0047] After the S304 page fault handling function finishes execution, the operating system performs interrupt recovery. After the interrupt recovery is completed, the processor enters single-step execution mode.

[0048] In this embodiment, after the page fault handling function obtains authorization through the above steps, the page fault handling operation is executed, the memory address being accessed by the monitored program is recorded, the page protection for the memory page being accessed by the monitored program is removed, and the processor flag is modified to enter single-step execution mode after interrupt recovery. Until the page fault handling function finishes execution, the operating system performs interrupt recovery, which enables the virtual memory address accessed by each memory access instruction in the monitored program to be obtained.

[0049] In step S304 above, the specific interrupt recovery process uses the execution context of the interrupted program saved when the interrupt was triggered to restore the processor's register contents and flag state. After the interrupt recovery is completed, the processor enters single-step execution mode.

[0050] In step S05 of this embodiment, the steps of the debug exception handling function performing debug exception handling operations include:

[0051] S501. Modify the processor flag bits stored in the execution context of the interrupted program, and configure the single-step mode flag to be invalid (specifically, configure it to 0);

[0052] S502. Reapply page protection to the memory pages being accessed by the monitored program;

[0053] After the S503 debug exception handling function finishes execution, the operating system performs interrupt recovery, and the processor exits single-step execution mode.

[0054] In this embodiment, after the debugging exception handling function is authorized through the above steps, the debugging exception handling operation is executed, the processor flag is modified so that the processor exits the single-step execution mode after the operating system performs interrupt recovery, and page protection is reapplied to the memory page being accessed by the monitored program. This allows page protection to be automatically reapplied to the accessed memory page after each memory access is completed, so as to monitor the subsequent access of the monitored program to that memory page.

[0055] In a specific application embodiment, the detailed steps of the instruction-level memory access monitoring method based on hardware page protection mechanism of the present invention are as follows:

[0056] The first step is for the memory access monitoring system to apply page protection to the memory pool: for cases where only write access is monitored, the access permissions of all memory pages in the memory pool are set to allow only read access to apply page protection; for cases where both read and write access are monitored, the access permissions of all memory pages in the memory pool are set to be inaccessible to apply page protection.

[0057] The second step involves the monitored program accessing a protected memory page during execution. This will trigger a page fault due to a page access violation. Once a page fault is triggered, the monitored program will be interrupted, and its execution context will be saved in memory, proceeding to the fourth step. If the instructions executed by the monitored program do not trigger a page fault, the program will return to the second step and continue execution.

[0058] The third step involves the page fault handling function gaining program control and performing page fault handling operations, including:

[0059] 3.1) Record the virtual memory address that the memory access instruction that triggered the page fault attempted to access, i.e., the memory address that the monitored program is currently accessing;

[0060] 3.2) Remove page protection for the memory pages being accessed by the monitored program and set their access permissions to allow read and write operations;

[0061] 3.3) Modify the processor flags stored in the execution context of the interrupted program, and set the single-step mode flag to 1;

[0062] 3.4) After the page fault handling function finishes execution, the operating system performs interrupt recovery. The interrupt recovery process uses the execution context of the interrupted program saved when the interrupt was triggered to restore the processor's register contents and flag states. After the interrupt recovery is completed, the processor enters single-step execution mode.

[0063] The fourth step is for the monitored program to resume execution of the interrupted memory access instructions in the processor's single-step execution mode.

[0064] Fifth, after the monitored program is interrupted due to a debug exception, the debug exception handling function gains control of the program and performs debug exception handling operations, including:

[0065] 5.1) Modify the processor flags stored in the execution context of the interrupted program, and set the single-step mode flag to 0;

[0066] 5.2) Reapply page protection to the memory pages being accessed by the monitored program;

[0067] 5.3) After the debugging exception handling function finishes execution, the operating system performs interrupt recovery and the processor exits single-step execution mode.

[0068] Step 6: If the monitored program exits, the process ends; otherwise, proceed to step 2.

[0069] This invention achieves instruction-level memory access monitoring based on a hardware page protection mechanism through the above-described method. During memory access monitoring, it can obtain the virtual memory address accessed by each memory access instruction in the monitored program. For each monitored memory access, it can automatically reapply page protection to the accessed memory page after the access is completed to monitor subsequent accesses of that memory page by the monitored program. At the same time, it can also collect instruction-level memory access behavior, resulting in higher monitoring accuracy. Furthermore, it does not require the memory access monitoring system to explicitly reprotect the monitored memory pages, and can achieve flexible and efficient instruction-level memory access monitoring based on a hardware page protection mechanism.

[0070] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention in any way. Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the invention. Therefore, any simple modifications, equivalent changes, and alterations made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention should fall within the protection scope of the present invention.

Claims

1. A method for monitoring instruction-level memory access based on hardware page protection mechanism, characterized in that the steps include... include: S01. The memory access monitoring system applies page protection to the memory pool; S02. During the execution of the monitored program, if the instruction executed by the monitored program triggers a page fault, and the monitored program is interrupted after the page fault is triggered, the execution context of the monitored program is saved in memory, and the process proceeds to step S03; if the instruction executed by the monitored program does not trigger a page fault, the process returns to step S02 to continue execution. S03. The page error handling function obtains program control and performs page error handling operations. S04. The monitored program resumes execution of interrupted memory access instructions in the processor's single-step execution mode; S05. When the monitored program is interrupted due to a debug exception, the debug exception handling function gains program control and performs debug exception handling operations. The steps in step S03 where the page error handling function performs page error handling operations include: S301. Record the virtual memory address that the memory access instruction that triggered the page fault needs to access, i.e. the memory address that the monitored program is accessing; S302. Remove page protection for the memory page being accessed by the monitored program and set the access permission to allow read and write operations; S303. Modify the processor flags stored in the execution context of the interrupted program to enable single-step execution mode; After the S304 page fault handling function finishes execution, the operating system performs interrupt recovery. After the interrupt recovery is completed, the processor enters single-step execution mode. In step S05, the steps of the debugging exception handling function performing debugging exception handling operations include: S501. Modify the processor flags stored in the execution context of the interrupted program, and configure the single-step mode flag to be invalid; S502. Reapply page protection to the memory pages being accessed by the monitored program; S503. After the debugging exception handling function finishes execution, the operating system performs interrupt recovery, and the processor exits the single-step execution mode.

2. The instruction-level memory access monitoring method based on hardware page protection mechanism according to claim 1, characterized in that, In step S01, when only write access is monitored, the memory access monitoring system applies page protection to the memory pool by setting the access permissions of all memory pages in the memory pool to read-only.

3. The instruction-level memory access monitoring method based on hardware page protection mechanism according to claim 1, characterized in that, In step S01, when both read access and write access are monitored simultaneously, the memory access monitoring system applies page protection to the memory pool by setting the access permissions of all memory pages in the memory pool to inaccessible.

4. The instruction-level memory access monitoring method based on hardware page protection mechanism according to claim 1, characterized in that, In step S02, the page error triggered by the instruction executed by the monitored program includes page errors triggered due to page access permission violations.

5. The instruction-level memory access monitoring method based on hardware page protection mechanism according to claim 1, characterized in that, In step S304, the interrupt recovery process uses the execution context of the interrupted program saved when the interrupt was triggered to restore the processor's register contents and flag state; after the interrupt recovery is completed, the processor begins to enter single-step execution mode.

6. The instruction-level memory access monitoring method based on hardware page protection mechanism according to any one of claims 1 to 5, characterized in that, The process after step S05 includes step S06: if the monitored program exits, the current monitoring ends; otherwise, the process returns to step S02.

7. A computer device comprising a processor and a memory, the memory being used to store computer programs, characterized in that, The processor is used to execute the computer program to perform the method as described in any one of claims 1 to 6.

8. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed, it implements the method as described in any one of claims 1 to 6.

Images