JP2006018705A - Memory access trace system and memory access trace method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a technique capable of tracing a memory access in memory areas of a wide range or in a memory area assigned to an application. <P>SOLUTION: Upon receiving an assignment request of memory from a program 2, an OS 1 acquires a memory area to be assigned to the program 2 from a memory area 4, and lays the acquired memory area into an access prohibiting state by an MMU 3 as an inspection object memory area. The OS 1 ensures a trace data area 12 corresponding to the inspection object memory area. If access to the inspection object memory area occurs, the MMU 3 generates an access exception, and a trace processing part 10 records collected trace information to the trace data area 12 corresponding to the inspection object memory area where the access exception is generated. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a technique for tracing memory access to a memory area to be inspected, and in particular, a memory access trace for tracing memory access to a memory area to be inspected using a memory protection function of a memory management unit. The present invention relates to a system and a memory access trace method.

  A memory management unit (hereinafter referred to as MMU (Memory Management Unit)) is hardware for memory management for the purpose of memory mapping and protection. One important function of the MMU is a memory protection function.

  The memory protection function in the MMU is a function that limits a memory area that can be accessed by a program. For example, if an application can access a system area in which an operating system (OS) main body or the like is stored, the system may be destroyed. If the MMU memory protection function restricts the application from accessing the system area, the impact on the system can be minimized even if the application runs away.

  There is a technique for detecting illegal memory access by tracing memory writing using the memory protection function of the MMU (see, for example, Patent Document 1). In the technique described in Patent Document 1, a write protection attribute is set by the MMU for a page including a specified inspection target address, and when a write protection exception occurs, the trace information is recorded and the write protection exception is recorded. When the occurrence of the error is an access to the inspection target address, it is determined whether the changed value satisfies a preset exception stop condition, and if the condition is satisfied, the debug target program is stopped.

As another technique for detecting an illegal memory access by setting access prohibition to the memory area, for example, there is a technique described in Patent Document 2. In the technique described in Patent Document 2, an adjacent memory area that is in contact with the end of a memory area allocated by a request from an application is set as an inaccessible attribute, and the memory area to which the application is allocated exceeds the allocated memory area. Context information is recorded in the log file or the application is forcibly terminated when an exception interrupt occurs when accessed.
JP 2002-14843 A JP 2002-55851 A

  In the technique described in Patent Document 1, tracing is performed only when there is access to an inspection target address or access to a page including the inspection target address. However, since illegal memory access does not always occur at the same address, a large number of addresses to be inspected must be specified when tracing memory access in a wide range of memory areas. is not.

  In the technique described in Patent Document 2, access prohibition is not set for the memory area allocated to the application, and therefore, memory access to the memory area allocated to the application cannot be traced.

  The present invention can solve the above problems, trace memory accesses in a wide range of memory areas, and trace memory accesses in memory areas allocated to applications. An object of the present invention is to provide a memory access trace system and a memory access trace method.

  In order to solve the above-described problem, the present invention makes an access prohibited state when an inspection target memory area specified in a certain range is prohibited by the memory protection function of the MMU, and access occurs when the inspection target memory area is accessed. Collecting and recording trace information such as accessed data, accessed memory address, accessed instruction address, and whether the access is a read access or a write access when an exception occurs And

  As a result, it is possible to trace memory access to a memory area to be inspected over a wide range, and it is possible to detect illegal memory access in a wide range of memory areas.

  In addition, when the OS dynamically allocates memory to a program, the memory area that is dynamically allocated is set as a memory area to be inspected and access is prohibited by the memory protection function of the MMU, and the memory area to be inspected is accessed. Trace information is collected and recorded when an access exception occurs.

  This makes it possible to trace memory access to the memory area dynamically allocated to the program, and to detect illegal memory access in the memory area dynamically allocated to the program. Is possible.

  In addition, trace information collection conditions are set in advance, and trace information is collected and recorded only when the conditions are satisfied. At this time, for example, when it is desired to collect trace information only at the time of write access, the memory area to be inspected may be set to the write access prohibited state by the MMU, and an access exception may be generated only at the time of write access. The memory area to be inspected may be set to an access prohibited state, and it may be determined whether the access is a write access after an access exception occurs.

  As a result, it is possible to collect only trace information that meets the necessary conditions, and it is possible to detect illegal memory accesses with the minimum necessary resources.

  According to the present invention, it becomes possible to detect an illegal memory access in a wide range of memory areas that are not fixed addresses, and to improve the efficiency of fault investigation.

  In addition, it becomes possible to detect an illegal memory access by using a memory area that dynamically changes depending on the allocation as an inspection target, thereby improving the efficiency of failure investigation.

  In addition, since the collection of trace information can be limited to only those that meet a pre-specified condition, an increase in the amount of trace information can be suppressed, and illegal memory accesses can be detected with fewer resources.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

[Embodiment 1]
FIG. 1 is a diagram showing a configuration example (1) of a memory access trace system according to an embodiment of the present invention. The memory access trace system includes an OS execution means (hereinafter simply referred to as “OS”), a program execution means (hereinafter simply referred to as “program”) for executing a search target program, an MMU (memory management unit) 3, a memory The region 4 is configured. The OS 1 includes an access prohibition exception handler 11 and a trace processing unit 10 including a plurality of trace data areas 12.

  The program 2 requests the OS 1 to allocate memory by a system call. At this time, the program 2 is an area for recording the identification ID for uniquely identifying the memory area to be inspected (in this case, the memory area allocated to the program 2) and the trace information simultaneously with the memory allocation request. The size of the trace area, which is the size when the trace data area 12 is acquired from the memory area 4, is also specified. This makes it possible to specify the size of the trace data area 12 for each inspection target memory area.

  In the present embodiment, the system call that the OS 1 accepts from the program 2 when a memory allocation request is made is as follows, for example.

char * mem_trace (id, trace_size, size, option)
int id;
size_t trace_size;
size_t size;
char * option;
In this example of the system call, an identification ID for uniquely identifying the inspection target memory area is specified for id, and a trace data area 12 that is an area for recording trace information is specified for the trace_size. Specifies the size of the memory to be acquired from the file, and size specifies the size of the memory that requires allocation.

You can also limit the trace information to be collected to the required one by specifying the trace information collection condition with option. Trace information collection conditions can be specified for each inspection target memory area. Examples of trace information collection conditions specified by option include the following.
(A) readonly: Traces only during read access.
(B) writeonly: Traces only during write access.
(C) range mn: Trace is performed only when a value outside the range of m to n is accessed.
(D) boundary n: Traces only when the value of the n boundary is accessed.
(E) inst ab: Trace is performed only when an inspected memory area is accessed while an instruction between addresses a and b is being executed.

  Such an option is specified as follows, for example.

char * option [] [] = {
"writeonly",
"boundary 4"
};
In this example of option specification, the trace information collection condition is specified so that tracing is performed only when a value of 4 boundaries (address is a multiple of 4) is accessed during write access.

  When the OS 1 receives a memory allocation request from the program 2 by a system call, the OS 1 acquires a memory area of the specified size from the memory area 4 and allocates it to the program 2 and simultaneously checks the memory area allocated to the program 2 for inspection. The MMU 3 is requested to make the access prohibited state as a memory area. The MMU 3 puts the memory area to be inspected into an access prohibited state in response to a request from the OS 1.

  In addition, the OS 1 acquires the trace data area 12 having a specified size from the memory area 4. At the beginning of the acquired trace data area 12, header information is provided to record an identification ID, address information of the memory area to be inspected, conditions for collecting trace information, and the like. Further, the acquired trace data area 12 has a chain structure in the trace processing unit 10.

  FIG. 2 shows an example of the data structure of the trace data area. For example, as shown in FIG. 2, the trace data area 12 includes a header part for storing management information and a data part of a data storage area for storing the collected trace information. The header part includes a trace data area. Identification ID, data storage area size, inspection target memory area information such as address and size of inspection target memory area, trace information collection conditions, pointer to next trace data area when multiple trace data areas 12 are provided, etc. Is stored.

  FIG. 3 is a process flowchart of the OS according to the first embodiment. First, when a memory allocation request is received from the program 2 by a system call (step S10), the identification ID specified by the system call overlaps with the identification ID already recorded in the header information of the other trace data area 12 (Step S11), and if it is duplicated, an error is restored (step S12).

  If the identification IDs are not duplicated in step S11, it is confirmed whether there is enough space in the memory area 4 by the size of the memory requested for allocation and the size of the designated trace data area 12 (step S13). ), If there is no space, the error is restored (step S12).

  If there is sufficient space in the memory area 4 in step S13, the memory area allocated to the program 2 and the trace data area 12 are acquired from the memory area 4 (step S14). Further, the allocated memory area acquired by controlling the MMU 3 is set to the access prohibited state as the inspection target memory area (step S15).

  Further, header information is set at the head of the acquired trace data area 12, and the specified identification ID, the address information of the acquired memory area to be inspected, the collection conditions of the specified trace information, etc. are recorded (step S16). Further, the acquired trace data area 12 is connected to the chain of the trace data area 12 of the trace processing unit 10 (step S17). Thereafter, the program returns to the program 2 using the acquired start address of the memory area to be inspected as return information (step S18).

  When the memory allocation to the program 2 as described above is completed, the trace information is collected when accessing the inspection target memory area.

  When the MMU 3 detects an access to the inspection target memory area in the access prohibited state, the MMU 3 generates an access exception, and the access prohibited exception handler 11 of the trace processing unit 10 is activated by this interrupt.

  The access prohibition exception handler 11 detects the corresponding trace data area 12 from the chain of the trace data area 12 based on the address of the inspection target memory area where the access exception has occurred, and stores the trace information in the detected trace data area 12. Record. At this time, when the collection condition of the trace information is specified, the trace information is recorded in the detected trace data area 12 only when the collection condition is satisfied.

Here, the trace information recorded in the trace data area 12 includes, for example,
(1) Information indicating whether the access to the inspection target memory area is a read access or a write access,
(2) Data read from the inspection target memory area or data written to the inspection target memory area,
(3) Address of the inspection target memory area to be read or address of the inspection target memory area to be written,
(4) The address of an instruction that reads from the memory area to be inspected or the address of an instruction that writes to the memory area to be inspected,
and so on.

  FIG. 4 is a flowchart of trace processing in the present embodiment. When receiving an interrupt due to the occurrence of an access exception from the MMU 3 (step S20), the trace processing unit 10 saves the register at the time of the access exception occurrence to the stack or the like (step S21).

  The corresponding trace data area 12 is searched by comparing the address of the inspection target memory area where the access exception has occurred with the inspection target memory area information in the header portion of each trace data area 12 (step S22). It is confirmed whether or not the corresponding trace data area 12 has been detected (step S23). If not detected, normal address exception processing is performed (step S24).

  When the corresponding trace data area 12 is detected in step S23 and the trace information collection condition specified in advance is satisfied (step S25), trace information is collected for the generated access exception (step S26) and detected. Trace information collected in the trace data area 12 is additionally recorded in the data storage area (step S27).

  Using a register saved in the stack or the like, processing is performed to issue an instruction so that the same result as that of the instruction that should have been executed if it was not an access exception is obtained (step S28).

  Thereafter, the return position is changed so that the instruction next to the instruction in which the access exception has occurred can be executed (step S29), the register saved in the stack or the like is restored (step S30), and the process returns from the access exception (step S29). S31).

  The trace processing of the access information to the inspection target memory area as described above is performed, and the trace information is accumulated in the trace data area 12.

  When the system is stopped due to memory destruction, the corresponding trace data area 12 is detected from the identification ID of each trace data area 12 by following the chain of the trace data area 12 of the trace processing unit 10. By analyzing the trace information in the detected trace data area 12, the cause of memory corruption can be pursued.

  In particular, when the program 2 requests the OS 1 to release the allocated memory area (inspection target memory area) without causing memory destruction, the OS 1 sets the allocation memory area (inspection target memory area) requested to be released to the memory area 4. release. Further, the trace data area 12 corresponding to the inspection target memory area is detected from the chain of the trace data area 12 of the trace processing unit 10, and the detected trace data area 12 is removed from the chain and released.

[Embodiment 2]
Next, a description will be given of a form in which tracing is performed regarding access to a memory area dynamically allocated to the program 2 by an input command or the like.

  FIG. 5 is a diagram showing a configuration example (2) of the memory access trace system in the embodiment of the present invention. The memory access trace system of FIG. 5 further includes a trace setting unit 5 in addition to the memory access trace system of FIG. The trace setting unit 5 accepts a designation for setting a memory area to be allocated in response to a memory allocation request by a process in the program 2 and notifies the OS 1 of the designation information. The OS 1 may directly accept the designation that the memory area to be allocated in response to the memory allocation request by the process is the inspection target memory area. The received designation information is retained.

  The designation of the memory area to be allocated in response to the memory allocation request by the process is received by the following command, for example.

memtrace [option] Identification ID Trace area size Process ID
In this command example, an ID for uniquely identifying the inspection target memory area is designated as the identification ID, and the trace data area 12 that is an area for recording trace information is stored in the memory area as the size of the trace area. A size for obtaining from the area 4 is designated, and an ID for uniquely identifying a process that makes a memory allocation request is designated as the process ID.

  If the identification ID specified by the command is the identification ID already recorded in the header information of the other trace data area 12, or if it is already specified by another command, an error will occur. To be notified.

  You can also limit the trace information to be collected to the required one by specifying the trace information collection condition with option. The trace information collection condition specified by option may be the same as that described in the example of the system call in the first embodiment, for example.

  When the OS 1 receives a memory allocation request from a process of the program 2, the OS 1 checks whether the process that has requested the memory allocation is a process specified in advance by the above-mentioned command or the like. For example, the MMU 3 is requested to acquire a memory area of the size requested by the process from the memory area 4 and assign it to the process, and at the same time, set the memory area assigned to the process as an inspection target memory area to be in an access prohibited state. The MMU 3 puts the memory area to be inspected into an access prohibited state in response to a request from the OS 1.

  In addition, the OS 1 acquires from the memory area 4 the trace data area 12 having a size specified in advance by the above-described command or the like. At the beginning of the acquired trace data area 12, header information is provided to record an identification ID, address information of the memory area to be inspected, conditions for collecting trace information, and the like. The acquired trace data area 12 has a chain structure in the trace processing unit 10 as shown in FIG.

  FIG. 6 is a process flowchart of the OS according to the second embodiment. First, when a memory allocation request is received by a system call from a process of the program 2 (step S40), it is confirmed whether the process which has requested the memory allocation is a process corresponding to the process ID specified in advance by the command. (Step S41) If it is not a corresponding process, normal memory allocation processing is performed (Step S42).

  If it is a corresponding process in step S41, it is confirmed whether there is enough free space in the memory area 4 by the size of the memory requested for allocation and the size of the trace data area 12 specified in advance by the command (step S41). S43), if there is no space, the error is restored (step S44).

  If there is sufficient free space in the memory area 4 in step S43, the memory area allocated to the process and the trace data area 12 are acquired from the memory area 4 (step S45). Further, the allocated memory area acquired by controlling the MMU 3 is set to the access prohibited state as the inspection target memory area (step S46).

  Header information is set at the beginning of the acquired trace data area 12, and the identification ID specified in advance by the command, the address information of the acquired memory area to be inspected, the collection condition of the trace information specified in advance by the command, etc. are recorded ( Step S47). Further, the acquired trace data area 12 is connected to the chain of the trace data area 12 of the trace processing unit 10 (step S48). Thereafter, the acquired head address of the inspection target memory area is used as return information to return to the memory allocation request source (step S49).

  When the memory allocation to the process of the program 2 as described above is completed, the trace information is collected when accessing the inspection target memory area.

  When the MMU 3 detects access to the inspection target memory area in the access prohibited state, the MMU 3 generates an access exception, and control is passed to the access prohibited exception handler 11 of the trace processing unit 10 by this interrupt.

  The access prohibition exception handler 11 detects the corresponding trace data area 12 from the chain of the trace data area 12 based on the address of the inspection target memory area where the access exception has occurred, and stores the trace information in the detected trace data area 12. Record. At this time, when the collection condition of the trace information is specified, the trace information is recorded in the detected trace data area 12 only when the collection condition is satisfied.

  The specific processing flow of the trace processing is the same as the processing flow shown in the flowchart of FIG. 4 described in the first embodiment. Trace processing of access information to such an inspection target memory area is performed, and the trace information is accumulated in the trace data area 12.

  When the system is stopped due to memory destruction, the corresponding trace data area 12 is detected from the identification ID of each trace data area 12 by following the chain of the trace data area 12 of the trace processing unit 10. By analyzing the trace information in the detected trace data area 12, the cause of memory corruption can be pursued.

  In particular, when the process of the program 2 requests the OS 1 to release the allocated memory area (inspection target memory area) without causing memory destruction, the OS 1 uses the allocated memory area (inspection target memory area) requested to be released as the memory area. Release to 4. In addition, the trace data area 12 corresponding to the inspection target memory area is detected from the chain of the trace data area 12 of the trace processing unit 10, and the detected trace data area 12 is removed from the chain and released to the memory area 4.

[Embodiment 3]
Next, regardless of the memory allocation to the program 2, the memory area to be inspected (in this case, the memory area designated as the inspection target) is designated by a command or the like, and the memory area to be inspected is accessed. A form of tracing when it occurs will be described. The inspection target memory area can be specified in a wide range. Here, the configuration of the memory access trace system of FIG. 5 will be used as it is.

  The trace setting unit 5 receives the designation of the inspection target memory area and notifies the OS 1 of the designation information. The OS 1 may directly accept the designation of the inspection target memory area. The inspection target memory area is designated by, for example, the following command.

memtrace [option] Identification ID Trace area size Start address Last address In this command example, the identification ID specifies an ID that uniquely identifies the memory area to be examined, and the trace area size contains the trace information. The size when the trace data area 12 that is an area for recording the memory is acquired from the memory area 4 is specified, the start address of the inspection target memory area is specified as the start address, and the inspection target memory is specified as the final address Specifies the final address of the area.

  You can also limit the trace information to be collected to the required one by specifying the trace information collection condition with option. The trace information collection condition specified by option may be the same as that described in the example of the system call in the first embodiment, for example.

  When the OS 1 receives the designation of the inspection target memory area, the OS 1 requests the MMU 3 to place the inspection target memory area in an access prohibited state. The MMU 3 puts the memory area to be inspected into an access prohibited state in response to a request from the OS 1.

  In addition, the OS 1 acquires the trace data area 12 having a specified size from the memory area 4. At the beginning of the acquired trace data area 12, header information is provided to record an identification ID, address information of the memory area to be inspected, conditions for collecting trace information, and the like. Further, the acquired trace data area 12 has a chain structure in the trace processing unit 10.

  FIG. 7 is a processing flowchart of the OS according to the third embodiment. First, when a command for specifying a memory area to be inspected is received (step S50), it is confirmed whether the identification ID specified by the command overlaps with an identification ID already recorded in the header information of another trace data area 12. If it is duplicated, an error is notified (step S52), and the process is terminated.

  If the identification IDs are not duplicated in step S51, it is confirmed whether there is enough space in the memory area 4 by the size of the trace data area 12 specified by the command (step S53). Notification is made (step S52), and the process is terminated.

  If there is sufficient free space in the memory area 4 in step S53, the trace data area 12 is acquired from the memory area 4 (step S54). Further, the MMU 3 is controlled so that the inspection target memory area specified by the command is in an access prohibited state (step S55).

  Header information is set at the head of the acquired trace data area 12, and the specified identification ID, the address information of the specified memory area to be inspected, the conditions for collecting the specified trace information, etc. are recorded (step S56). Further, the acquired trace data area 12 is connected to the chain of the trace data area 12 of the trace processing unit 10 (step S57), and the process is terminated.

  After the inspection target memory area is specified as described above, trace information is collected when accessing the inspection target memory area.

  When the MMU 3 detects an access to the inspection target memory area in the access prohibited state, the MMU 3 generates an access exception, and control is passed to the access prohibited exception handler 11 of the trace processing unit 10 by the interrupt.

  The access prohibition exception handler 11 detects the corresponding trace data area 12 from the chain of the trace data area 12 based on the address of the inspection target memory area where the access exception has occurred, and stores the trace information in the detected trace data area 12. Record. At this time, when the collection condition of the trace information is specified, the trace information is recorded in the detected trace data area 12 only when the collection condition is satisfied.

  The specific processing flow of the trace processing is the same as the processing flow shown in the flowchart of FIG. 4 described in the first embodiment. Trace processing of access information to such an inspection target memory area is performed, and the trace information is accumulated in the trace data area 12.

  When the system is stopped due to memory destruction, the corresponding trace data area 12 is detected from the identification ID of each trace data area 12 by following the chain of the trace data area 12 of the trace processing unit 10. By analyzing the trace information in the detected trace data area 12, the cause of memory corruption can be pursued.

It is a figure which shows the structural example (1) of the memory access trace system in embodiment of this invention. It is a figure which shows the example of the data structure of a trace data area. 3 is a process flowchart of the OS according to the first embodiment. It is a trace process flowchart in this Embodiment. It is a figure which shows the structural example (2) of the memory access trace system in embodiment of this invention. 10 is a process flowchart of the OS according to the second embodiment. 10 is a process flowchart of an OS according to the third embodiment.

Explanation of symbols

1 OS execution means (OS)
2 Program execution means (program)
3 MMU
4 Memory area 5 Trace setting section 10 Trace processing section 11 Access prohibition exception handler 12 Trace data area

Claims (5)

A memory access trace system for recording trace information that is information related to access to a memory area to be inspected,
Means for inputting a designation of a memory area to be inspected;
Means for bringing the memory area to be inspected into an access prohibited state or a write prohibited state by a memory management unit;
Means for obtaining a trace data area, which is an area for recording trace information;
Means for collecting trace information when an access exception occurs due to access to the memory area to be inspected;
A memory access trace system comprising: means for recording the collected trace information in the trace data area. A memory access trace system for recording trace information that is information related to access to a memory area to be inspected,
A means of receiving a memory allocation request;
Means for allocating a memory area in response to the memory allocation request;
Means for setting the allocated memory area as a memory area to be inspected and setting the access prohibited state or the write prohibited state by the memory management unit;
Means for obtaining a trace data area, which is an area for recording trace information;
Means for collecting trace information when an access exception occurs due to access to the memory area to be inspected;
A memory access trace system comprising: means for recording the collected trace information in the trace data area. In the memory access trace system according to claim 1 or 2,
A means for inputting conditions for collecting trace information is provided.
The memory access trace system characterized in that the means for collecting the trace information collects the trace information only when a condition for collecting the trace information is satisfied. A memory access tracing method for recording trace information, which is information relating to access to a memory area to be inspected,
A process of inputting a specification of a memory area to be inspected;
A process of bringing the memory area to be inspected into an access prohibited state or a write prohibited state by the memory management unit;
A process of acquiring a trace data area which is an area for recording trace information;
A process of collecting trace information when an access exception occurs due to access to the memory area to be inspected;
And a step of recording the collected trace information in the trace data area. A memory access tracing method for recording trace information, which is information relating to access to a memory area to be inspected,
Receiving a memory allocation request;
Allocating a memory area in response to the memory allocation request;
The memory management unit sets the allocated memory area as a memory area to be inspected, and sets the access prohibited state or the write prohibited state by the memory management unit;
A process of acquiring a trace data area which is an area for recording trace information;
A process of collecting trace information when an access exception occurs due to access to the memory area to be inspected;
And a step of recording the collected trace information in the trace data area.

Images