CN101561775A - Method and device for monitoring memory - Google Patents
Method and device for monitoring memory Download PDFInfo
- Publication number
- CN101561775A CN101561775A CNA200910084008XA CN200910084008A CN101561775A CN 101561775 A CN101561775 A CN 101561775A CN A200910084008X A CNA200910084008X A CN A200910084008XA CN 200910084008 A CN200910084008 A CN 200910084008A CN 101561775 A CN101561775 A CN 101561775A
- Authority
- CN
- China
- Prior art keywords
- memory
- routine package
- border
- carry out
- internal memory
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Landscapes
- Storage Device Security (AREA)
Abstract
The invention discloses a method and a device for monitoring a memory. The memory monitoring method comprises the following steps: setting memory management unit access protection for the memory needing to be monitored, recording a memory allocating massage by aiming at the application and release operations of a program packet to the memory, and triggering an abnormity processing operation based on the memory management unit access protection when the program packet executes data reading or writing operation to the memory; acquiring a reading or writing data destination address, and judging whether the memory access operation of the reading or writing data exceeds the limit according to the destination address and the memory allocating message, if so, recording a site message of the memory access operation exceeding the limit, and permitting the program packet to continuously carry out the following flow according to a contained program code; otherwise, permitting the program packet to continuously carry out the following flow according to the contained program code. The technical proposal can monitor the site message that the memory reading and writing data exceeds the limit in real time and achieve real-time monitoring of the memory; and the size of a monitored storage area is not restricted.
Description
Technical field
The present invention relates to technical field of electronic equipment, be specifically related to the internal memory monitoring technology.
Background technology
In embedded real time system,, therefore, need internally deposit into the row monitoring owing to have memory accessing outside or write problem such as releasing memory.Present internal memory monitoring method mainly contains following four kinds:
Method one, based on the internal memory monitoring method of filling the evil spirit numeral, promptly in the internal memory of needs monitoring, fill the evil spirit numeral, judge by whether being rewritten whether internal memory is illegally rewritten in application internal memory, releasing memory or quantitative check evil spirit numeral.This method can not in time be caught the field data that internal memory is illegally rewritten.
Method two, based on the internal memory monitoring method of update routine flow process, promptly in program circuit, add and check code, thereby when storage allocation, can write down the size of this internal memory, and before writing internal memory, check.
Because method two need rewrite program circuit, therefore, can influence the stability of original program flow process, compiling problem etc. for example appears during program compilation easily.And method two also can cause the heavy construction performance to reduce and problem such as execute file is huge.
Method three, based on using the protection internal memory to separate internal memory monitoring method between different memory fields; promptly between the different memory blocks that distribute, the memory protect page or leaf is set; when memory overwriting was write on the memory protect page or leaf, trigger data was unusual, thereby monitored the memory overwriting write operation.
The memory protect page or leaf has taken internal memory, and the size of memory protect page or leaf usually can be bigger than the memory block that distributes, and therefore, method three has reduced the availability of internal memory.In addition, method three can not reflect the executive agent of the write operation that crosses the border, and the internal memory monitoring granularity is too thick.
Method four, based on the internal memory monitoring method of debug registers, the debug registers of promptly utilizing CPU to provide is monitored specific internal memory.Because most CPU only supports limited memory address is monitored, therefore, can not satisfy the needs of bulk memory monitoring.
Summary of the invention
The purpose of embodiment of the present invention is to provide a kind of internal memory monitoring method and device, real-time monitoring the field data that internal memory read and write data are crossed the border, thereby realizes real-time monitoring to internal memory.
The internal memory monitoring method that embodiment of the present invention provides comprises:
Memory setting memory management unit visit protection for the needs monitoring;
At application and the releasing operation of routine package to described internal memory, record Memory Allocation information;
Routine package carry out to described internal memory read or write data manipulation the time, based on described memory management unit visit protection and trigger the abnormality processing operation;
Described abnormality processing operation comprises: obtain the described destination address that reads or writes data, judge according to described destination address and described Memory Allocation information whether the described internal storage access operation that reads or writes data crosses the border, if cross the border, then write down the field data that described internal storage access operation is crossed the border, allow described routine package to continue to carry out follow-up flow process according to its program coding that comprises, if do not cross the border, then allow described routine package to continue to carry out follow-up flow process according to its program coding that comprises.
The internal memory monitoring device that embodiment of the present invention provides comprises:
The visit protection is provided with module, is used to the memory setting memory management unit visit protection that needs monitoring;
Memory Allocation and release monitoring module are used at application and the releasing operation of routine package to described internal memory, record Memory Allocation information;
The aborted module; be used for described routine package carry out to described internal memory read or write data manipulation the time; be triggered based on described memory management unit visit protection; execute exception is handled operation; described abnormality processing operation comprises: obtain the described destination address that reads or writes data; judge according to described destination address and described Memory Allocation information whether the described internal storage access operation that reads or writes data crosses the border; if cross the border; then write down the field data that described internal storage access operation is crossed the border; allow described routine package to continue to carry out follow-up flow process according to its program coding that comprises; if do not cross the border, then allow described routine package to continue to carry out follow-up flow process according to its program coding that comprises.
Description by technique scheme as can be known; by utilizing memory management unit visit protection mechanism; and by rewriting the abnormality processing operation that memory management unit visit protection mechanism triggers; make the embodiment of the invention can real-time monitor the field data that internal memory read and write data are crossed the border; thereby can realize accurately monitoring in real time, and monitored memory size can be unrestricted to internal memory.
Description of drawings
Fig. 1 is the internal memory monitoring method process flow diagram of the embodiment of the invention one;
Fig. 2 is the process flow diagram of record assignment information in the internal memory monitoring method of the embodiment of the invention two;
Fig. 3 is the process flow diagram of the field data of record memory accessing outside in the internal memory monitoring method of the embodiment of the invention two;
Fig. 4 is the method flow diagram that internal memory monitoring is set in the system starting process of the embodiment of the invention three;
Fig. 5 is the internal memory monitoring device synoptic diagram of the embodiment of the invention four.
Embodiment
The embodiment of the invention one provides a kind of internal memory monitoring method, and the flow process of this method as shown in Figure 1.
Among Fig. 1, step 100, definite internal memory that needs monitoring, and memory setting MMU (Memory Management Unit, memory management unit) visit protection for needing to monitor.
Need the internal memory of monitoring can be all internal memories in the network equipment, also can be the partial memory in the network equipment.Need the internal memory of monitoring to determine according to actual needs, for example, can determine according to actual needs that all internal memories all need to monitor; Again for example, the internal memory in the definite according to actual needs sector address scope need be monitored.Step 100 can be carried out after the internal storage management system initialization of operating system.
Need to prove, if memory setting MMU visit protection, then the read or write to this internal memory all can trigger abnormality processing operation (also can be described as the abnormality processing flow process).Existing abnormality processing flow process is: if the data manipulation that reads or writes of the internal memory that is provided with MMU visit protection has been exceeded memory range, then the continuation of shut down procedure is carried out, output alarm information, and with task suspension or restart system.In the present embodiment; the abnormality processing flow process that triggers when the internal memory that is provided with MMU visit protection is read or write data manipulation is different with above-mentioned existing abnormality processing flow process, and operating in that the abnormality processing flow process that triggers in the present embodiment is included hereinafter has detailed description.
The pitching pile technology that can adopt present embodiment realizes that promptly the routine package in the present embodiment is: carry out the routine package after pitching pile is handled at the application and the releasing operation record Memory Allocation information of routine package to the internal memory that is provided with MMU visit protection.This pitching pile is handled at application and releasing memory operation in the routine package and is carried out.When the routine package after pitching pile is handled is applied for releasing operation in execution to the internal memory that is provided with MMU visit protection, the operation of meeting trigger recording Memory Allocation information.
The pitching pile processing mode has multiple, and the embodiment of the invention can adopt existing various pitching pile processing mode, and the embodiment of the invention does not limit the specific implementation that pitching pile is handled.
A concrete pitching pile processing mode is: by the mode of the program coding in the update routine bag routine package is carried out pitching pile and handle; the program coding place of i.e. application in routine package and release specified memory correspondence carries out pitching pile and handles; as increase program coding etc., visit the Memory Allocation information of protecting with record to being provided with MMU.This concrete pitching pile processing mode needs the program coding in the update routine bag.In addition, if adopt this concrete pitching pile processing mode, then handle as long as before the routine package compilation run, finish pitching pile.
Another concrete pitching pile processing mode is: in the routine package operational process, handle at application in the routine package and release specified memory operation carrying out pitching pile, visit the Memory Allocation information of protecting with record to being provided with MMU.This concrete pitching pile processing mode does not need the program coding in the update routine bag.
The abnormality processing operation of carrying out in this step comprises: obtain the above-mentioned destination address that reads or writes data to internal memory, then, the Memory Allocation information of this destination address and above-mentioned record is compared, if determine that according to comparative result this destination address does not belong to the memory address range that writes down in the Memory Allocation information, determine that then this destination address crosses the border (the internal storage access operation that promptly reads or writes data manipulation is crossed the border), writes down the field data that this internal storage access that reads or writes data operation is crossed the border; If determine that according to comparative result this destination address belongs to the memory address range that writes down in the Memory Allocation information, then definite internal storage access operation that this reads or writes data manipulation is not crossed the border, and does not need to write down the field data that this internal storage access that reads or writes data operation is crossed the border; And no matter whether judged result is for crossing the border, and all allows this routine package to continue to carry out follow-up process flow operation according to its program coding that comprises.That is to say that abnormality processing operates in last meeting return information bag, makes routine package proceed follow-up flow process, the abnormality processing operation that promptly triggers in the present embodiment can not influence the normal operation of routine package.
The object lesson that a definite internal storage access operation in the operation of the abnormality processing of present embodiment is crossed the border is: cross the border if the destination address that reads or writes data not in Memory Allocation information within the address realm of arbitrary storage allocation, is then determined this internal storage access that reads or writes data operation.
The above-mentioned destination address that reads or writes data then also needs to consider to read or write the length of data if start address in the deterministic process of crossing the border; If the above-mentioned destination address that reads or writes data is an address realm, then in the deterministic process of crossing the border, can not consider to read or write the length of data.
By foregoing description as can be known; present embodiment has been revised the existing abnormality processing flow process that MMU visit protection triggers; by triggering amended abnormality processing flow process; not only can not influence the normal execution of routine package; and the internal storage access that in time reads or writes data in the logging program bag is operated the field data that crosses the border.
The field data of above-mentioned record comprises: any one in call stack information, internal storage state, register value and the Memory Allocation situation or a plurality of, and can comprise other information as required.
The field data of above-mentioned record can be used for multiple application, and a concrete examples of applications is: outputting alarm information, so that carry out memory management according to warning information.The warning information here is as triggering the bright trigger pip of stand by lamp; For another example, to output field datas such as display screen or printers.The embodiment of the invention does not limit particular content, the concrete application mode of field data and the specific implementation of outputting alarm information that field data comprises.
The foregoing description one need to prove: at some routine package (as the routine package of the memory management of operating system operation); if this part routine package does not need to carry out processing such as the above-mentioned protection of whether crossing the border to the data manipulation that reads or writes of the internal memory of the above-mentioned MMU of being provided with protection; then this part routine package can be called the routine package that does not need to carry out internal memory monitoring; on the contrary, reading or writing data manipulation and need carry out the above-mentioned routine package that whether crosses the border processing such as protection and can be called the routine package that need carry out internal memory monitoring the internal memory of the above-mentioned MMU of being provided with protection.At the routine package that does not need to carry out internal memory monitoring, present embodiment can not carry out the triggering of abnormality processing operation, also can trigger above-mentioned abnormality processing operation, but, in the abnormality processing operation, do not obtain the operation of destination address and judgement, but directly allow this part routine package to continue to carry out follow-up flow process according to its program coding that comprises.
A concrete example that does not carry out the triggering of abnormality processing operation is: when the routine package that does not need to carry out internal memory monitoring reads or writes data manipulation to the internal memory that is provided with MMU visit protection; control MMU visit protection is in closed condition; otherwise control MMU visit protection is in open mode.The embodiment of the invention can make the MMU visit protection of the whole internal memory that is provided with MMU visit protection all be in closed condition, also can make the MMU visit protection that reads or writes the internal memory that data manipulation relates to of the routine package that do not need to carry out internal memory monitoring be in closed condition.
If do not carry out the triggering of abnormality processing operation; then can adopt the mode of pitching pile to realize; promptly carry out the pitching pile processing at the routine package that does not need to carry out internal memory monitoring; this pitching pile handle be at: routine package carry out to the internal memory that is provided with MMU visit protection read or write data manipulation the time; make MMU visit protection be in closed condition; otherwise, make MMU visit protection be in open mode and carry out.Routine package after pitching pile is handled can be realized: when the internal memory that is provided with MMU visit protection is read or write data manipulation, make MMU visit protection be in closed condition, otherwise make MMU visit protection be in open mode.The implementation of the pitching pile here still has two kinds, and promptly the mode by the update routine coding realizes pitching pile and realize pitching pile that in the routine package operational process concrete implementation no longer describes in detail.
If there is the routine package that does not need to carry out the routine package of internal memory monitoring and need carry out internal memory monitoring, these two kinds of routine packages all need to trigger the abnormality processing operation, and need in the abnormality processing operation, treat with a certain discrimination these two kinds of routine packages, then need this two parts routine package is distinguished, the object lesson of a differentiation is: the routine package that does not need to carry out internal memory monitoring is carried out mark, and the routine package that needs is carried out internal memory monitoring does not carry out mark; The object lesson of another differentiation is: the routine package that needs is carried out internal memory monitoring carries out mark, and the routine package that does not need to carry out internal memory monitoring is not carried out mark.Thereby in the abnormality processing operating process, can be the routine package that needs carry out internal memory monitoring according to the marker for judgment routine package earlier, still not need to carry out the routine package of internal memory monitoring, then, carry out subsequent treatment again.
Under situations such as internal memory monitoring end, can remove the MMU visit protection of internal memory and at the pitching pile of routine package (realize in the operational process pitching pile handle) etc.A specific implementation removing MMU visit protection and removal pitching pile is: the operating system that restarts electronic equipment.
From the description of the foregoing description one as can be known; by specified memory being provided with MMU visit protection; and the existing abnormality processing of revising MMU visit protection triggering is operated; program code that can read and write operation in need not be at routine package is made amendment and is not influenced under the situation of routine package normal process flow process, in time monitors the field data that data manipulation is crossed the border that reads or writes to specified memory.Handle by pitching pile is carried out in the operation of application in the routine package and release specified memory, can make things convenient for the assignment information that writes down specified memory timely.Under normal conditions, with respect to read and write data manipulation in the routine package, the operation of application and release specified memory is very a spot of in the routine package, therefore, even if adopt the pitching pile processing mode of program coding in the update routine bag, index word to the program coding of routine package also is considerably less, thereby occurs the compiling problem easily when having avoided program compilation to a certain extent, cause the heavy construction performance to reduce and problem such as execute file is huge.In addition, in to the routine package compilation process, carry out the pitching pile processing mode, then can avoid the phenomenon that the program coding of routine package is made amendment fully if adopt.By destination address and the Memory Allocation information that reads or writes data manipulation is compared, even if 1 byte is arranged in the destination address not in the address realm of the memory block shown in the Memory Allocation information, also can capture the behavior of crossing the border of internal storage access operation accurately.Because MMU visit protection can relate to all internal memories, therefore, the internal memory monitoring of present embodiment one can not be subjected to the restriction of memory size.
The embodiment of the invention two provides a kind of internal memory monitoring method, and this internal memory monitoring method comprises two parts content, and a part is record Memory Allocation information flow, specifically as shown in Figure 2; Another part is the field data flow process of record memory accessing outside, specifically as shown in Figure 3.
Among Fig. 2, step 200, the memory setting MMU that needs are monitored visit protection, and routine package such as function application or release are provided with the internal memory of MMU visit protection.
If above-mentioned steps 200 and step 210 begin to carry out, can guarantee that then all application and release conditions at the internal memory that is provided with MMU visit protection all can record in the Memory Allocation table in the routine package when the network equipment system initialization.
Among Fig. 3, step 300, routine package such as function carry out read data operation or data writing operation; this read data or data writing operation relate to the internal memory that is provided with MMU visit protection, and promptly routine package carries out read data operation or data writing operation to the internal memory that is provided with MMU visit protection.
The embodiment of the invention three provides the method that internal memory monitoring is set in a kind of os starting process, and the flow process of this method as shown in Figure 4.Embodiment three is that example describes to be applied in certain electronic equipment, electronic equipment here such as computing machine etc.
Among Fig. 4, step 400, os starting flow process begin.
Function is carried out the special identifier set operation as being set to 1 in the porch of function special identifier, in the exit of function with special identifier clear 0.
But the function in the various maintenance storage allocations district of some above-mentioned function such as operating system.But the function of safeguarding the storage allocation district is as the function of revising internal memory reference count function and other internal memory checking tools etc.
Embodiment four provides a kind of internal memory monitoring device, and this device can be called the internal memory monitoring instrument.The structure of internal memory monitoring device as shown in Figure 5.
Internal memory monitoring device among Fig. 5 comprises: the visit protection is provided with module 500, Memory Allocation and release monitoring module 510 and aborted module 520.Optionally, this internal memory monitoring device can also comprise: pitching pile module 530, visit protection control module 540, mark module 550 and alarm module 560.
The visit protection is provided with module 500, is used to the memory setting memory management unit visit protection that needs monitoring.Need the internal memory of monitoring can be all internal memories in the network equipment, also can be the partial memory in the network equipment.Need the internal memory of monitoring to determine according to actual needs, for example, can determine according to actual needs that all internal memories all need to monitor; Again for example, the internal memory in the definite according to actual needs sector address scope need be monitored.The visit protection is provided with module 500 can be carried out MMU visit protection after the internal storage management system initialization of operating system setting operation.
Memory Allocation and release monitoring module 510 are used at routine package being provided with application and the releasing operation record Memory Allocation information that MMU visits the internal memory of protection.Because the routine package has here carried out handling at the pitching pile of application and releasing memory, therefore, Memory Allocation can record Memory Allocation information with release monitoring module 510 in operational process for routine package.
Aborted module 520 is used for handling operation in the back execute exception that is triggered.Aborted module 520 be carried out routine package that pitching pile handles carry out to the internal memory that is provided with MMU visit protection read or write data manipulation the time, be triggered based on MMU visit protection.
The abnormality processing operation that aborted module 520 is carried out comprises: obtain the above-mentioned destination address that reads or writes data to internal memory, then, the Memory Allocation information of this destination address and above-mentioned record is compared, if determine that according to comparative result this destination address does not belong to the memory address range that writes down in the Memory Allocation information, determine that then this destination address crosses the border (the internal storage access operation that promptly reads or writes data manipulation is crossed the border), writes down the field data that this internal storage access that reads or writes data operation is crossed the border; If determine that according to comparative result this destination address belongs to the memory address range that writes down in the Memory Allocation information, then definite internal storage access operation that this reads or writes data manipulation is not crossed the border, and does not need to write down the field data that this internal storage access that reads or writes data operation is crossed the border; And no matter whether judged result is for crossing the border, and aborted module 520 all allows this routine package to continue to carry out follow-up process flow operation according to its program coding that comprises.That is to say that the operation that the aborted module 520 in the present embodiment is carried out can not influence the normal operation of routine package.
The above-mentioned destination address that reads or writes data is if start address, and then aborted module 520 also needs to consider to read or write the length of data in the deterministic process of crossing the border; If the above-mentioned destination address that reads or writes data is an address realm, then aborted module 520 can not consider to read or write the length of data in the deterministic process of crossing the border.
The field data of aborted module 520 records comprises: any one in call stack information, internal storage state, register value and the Memory Allocation situation or a plurality of, and can comprise other information as required.
If carrying out the mode of pitching pile when the application of the internal memory that is provided with MMU visit protection and releasing operation trigger recording Memory Allocation information operating are moved by routine package, routine package realizes that then the internal memory monitoring device also needs to comprise pitching pile module 530.
Pitching pile module 530 is used at the routine package operational process, carries out pitching pile at application in the routine package and release specified memory, to realize that the Memory Allocation information that is provided with MMU visit protection is carried out record.Pitching pile module 530 does not need the program coding in the routine package is made amendment.
If only need the read data or the data writing operation of subprogram bag are carried out the memory overwriting monitoring, then the internal memory monitoring device can comprise visit protection control module 540 and visit protection control module 550.When the internal memory monitoring device comprises visit protection control module 540 and visit protection control module 550, be to realize whether carrying out the memory overwriting monitoring by the triggering of whether carrying out the abnormality processing operation.
Visit protection control module 540, be used for the routine package that does not need to trigger the abnormality processing operation carry out to internal memory read or write data manipulation the time, control MMU visit protection is in closed condition, otherwise control MMU visit protection is in open mode.
Visit protection control module 540 can adopt the mode of pitching pile to realize that above-mentioned MMU visits closing with open mode of protection and controls.Promptly 540 pairs of control modules of the visit protection internal memory that the is provided with MMU visit protection routine package that reads or writes data manipulation and do not need to trigger the abnormality processing operation carries out pitching pile and handles; this pitching pile handle be at: routine package carry out to the internal memory that is provided with MMU visit protection read or write data manipulation the time; make MMU visit protection be in closed condition; otherwise, make MMU visit protection be in open mode and carry out.
Routine package after pitching pile is handled can be realized: when the internal memory that is provided with MMU visit protection is read or write data manipulation, make MMU visit protection be in closed condition, otherwise make MMU visit protection be in open mode.
The read data of subprogram bag or data writing operation are carried out under the situation of memory overwriting monitoring only needing; the internal memory monitoring device also can not comprise visit protection control module 540; but comprise mark module 550; at this moment, aborted module 520 comprises judgement submodule and aborted submodule.
Mark module 550 is used for that the internal memory that is provided with MMU visit protection is read or write data manipulation and does not need to judge whether that the routine package that crosses the border carries out mark, carries out mark as the porch at routine package.Do not need to judge whether the routine package etc. of the memory management operation of the routine package that crosses the border such as operating system.Mark module 550 can also be removed this mark in the exit of routine package, as with this mark clear 0.
Mark is set can be handled by pitching pile and realize.When the visit in present embodiment protection control module 540 and mark module 550 all adopt the pitching pile processing mode, visit protection control module 540 and pitching pile module 530 together or mark module 550 and pitching pile module 530 can be called the pitching pile unit together.
Judge submodule, be used to judge the routine package mark whether underlined module 550 is provided with that the internal memory that is provided with MMU visit protection is read or write data manipulation.
The aborted submodule, be used in the judged result of judging submodule when being provided with mark, directly allow this routine package to continue to carry out follow-up flow process according to its program coding that comprises, in the judged result of judging submodule when mark not being set, obtain the destination address that reads or writes data, judge according to this destination address and Memory Allocation information whether this internal storage access that reads or writes data operation crosses the border, if cross the border, then write down the field data that this internal storage access operation is crossed the border, allow this routine package to continue to carry out follow-up flow process according to its program coding that comprises, if do not cross the border, then directly allow this routine package to continue to carry out follow-up flow process according to its program coding that comprises.
That is to say, at markd routine package is set, if this routine package has triggered the abnormality processing operation, then the aborted submodule does not obtain destination address and the operation that judges whether to cross the border to this routine package in the abnormality processing operation, but directly allow this routine package to continue to carry out follow-up flow process according to its program coding that comprises, withdraw from the abnormality processing operating process.
Alarm module 560 is used for the field data outputting alarm information according to aborted module 520 records.For example, alarm module 560 triggering stand by lamps are bright; For another example, alarm module 560 is to output field datas such as display screen or printers.
From the description of the foregoing description four as can be known; by the visit protection 500 pairs of specified memories of module are set MMU visit protection is set; and aborted module 520 adopts amended abnormality processing operation; program code that can read and write operation in need not be at routine package is made amendment and is not influenced under the situation of routine package normal process flow process, in time monitors the field data that data manipulation is crossed the border that reads or writes to specified memory.Carry out pitching pile by the operation of application in 530 pairs of routine packages of pitching pile module and release specified memory and handle, make Memory Allocation and discharge monitoring module 510 to make things convenient for the assignment information that writes down specified memory timely.Under normal conditions, with respect to read and write data manipulation in the routine package, the operation of application and release specified memory is very a spot of in the routine package, therefore, even if adopt the pitching pile processing mode of program coding in the update routine bag, index word to the program coding of routine package also is considerably less, thereby occurs the compiling problem easily when having avoided program compilation to a certain extent, cause the heavy construction performance to reduce and problem such as execute file is huge.In addition, in to the routine package compilation process, carry out the pitching pile processing mode, then can avoid the phenomenon that the program coding of routine package is made amendment fully if adopt.Aborted module 520 is by comparing destination address and the Memory Allocation information that reads or writes data manipulation, even if 1 byte is arranged in the destination address not in the address realm of the memory block shown in the Memory Allocation information, aborted module 520 also can capture the behavior of crossing the border of internal storage access operation accurately.Because MMU visit protection can relate to all internal memories, therefore, the memory size that the internal memory monitoring device of present embodiment four can be monitored can be unrestricted.
Through the above description of the embodiments, those skilled in the art can be well understood to the present invention and can realize by the mode that software adds essential hardware platform, can certainly all implement, but the former is better embodiment under a lot of situation by hardware.Based on such understanding, all or part of can the embodying that technical scheme of the present invention contributes to background technology with the form of software product, this computer software product can be stored in the storage medium, as ROM/RAM, magnetic disc, CD etc., comprise that some instructions are with so that a computer equipment (can be a personal computer, server, the perhaps network equipment etc.) carry out the described method of some part of each embodiment of the present invention or embodiment.
Though described the present invention by embodiment, those of ordinary skills know, the present invention has many distortion and variation and do not break away from spirit of the present invention, and the claim of application documents of the present invention comprises these distortion and variation.
Claims (11)
1, a kind of internal memory monitoring method is characterized in that, comprising:
Memory setting memory management unit visit protection for the needs monitoring;
At application and the releasing operation of routine package to described internal memory, record Memory Allocation information;
Routine package carry out to described internal memory read or write data manipulation the time, based on described memory management unit visit protection and trigger the abnormality processing operation;
Described abnormality processing operation comprises: obtain the described destination address that reads or writes data, judge according to described destination address and described Memory Allocation information whether the described internal storage access operation that reads or writes data crosses the border, if cross the border, then write down the field data that described internal storage access operation is crossed the border, allow described routine package to continue to carry out follow-up flow process according to its program coding that comprises, if do not cross the border, then allow described routine package to continue to carry out follow-up flow process according to its program coding that comprises.
2, the method for claim 1 is characterized in that, described routine package is for carrying out the routine package that pitching pile is handled at internal memory application and releasing operation record Memory Allocation information.
3, the method for claim 1 is characterized in that, the described field data that crosses the border comprises: any one in call stack information, internal storage state, register value and the Memory Allocation situation or a plurality of.
4, as claim 1 or 2 or 3 described methods, it is characterized in that described method also comprises:
The routine package that does not need to trigger described abnormality processing operation carry out to described internal memory read or write data manipulation the time, control described memory management unit visit protection and be in closed condition, otherwise, control described memory management unit visit protection and be in open mode.
5, as claim 1 or 2 or 3 described methods, it is characterized in that described method also comprises:
Described internal memory is read or write data manipulation do not need to judge whether that the routine package that crosses the border carries out mark;
And described abnormality processing operation also comprises:
At the routine package that described mark is arranged, do not carry out described obtain destination address and described judgement of whether crossing the border, directly allow described routine package to continue to carry out follow-up flow process according to its program coding that comprises.
6, method as claimed in claim 5 is characterized in that, the described routine package that carries out mark comprises: the routine package of the memory management operation of operating system.
7, a kind of internal memory monitoring device is characterized in that, comprising:
The visit protection is provided with module, is used to the memory setting memory management unit visit protection that needs monitoring;
Memory Allocation and release monitoring module are used at application and the releasing operation of routine package to described internal memory, record Memory Allocation information;
The aborted module; be used for described routine package carry out to described internal memory read or write data manipulation the time; be triggered based on described memory management unit visit protection; execute exception is handled operation; described abnormality processing operation comprises: obtain the described destination address that reads or writes data; judge according to described destination address and described Memory Allocation information whether the described internal storage access operation that reads or writes data crosses the border; if cross the border; then write down the field data that described internal storage access operation is crossed the border; allow described routine package to continue to carry out follow-up flow process according to its program coding that comprises; if do not cross the border, then allow described routine package to continue to carry out follow-up flow process according to its program coding that comprises.
8, device as claimed in claim 7 is characterized in that, described device also comprises:
The pitching pile module is used at described routine package operational process, carries out pitching pile at application in the routine package and release specified memory.
9, device as claimed in claim 7 is characterized in that, described device also comprises:
Visit protection control module; be used for the routine package that does not need to trigger described abnormality processing operation carry out to described internal memory read or write data manipulation the time; control described memory management unit visit protection and be in closed condition, otherwise, control described memory management unit visit protection and be in open mode.
10, device as claimed in claim 7 is characterized in that, described device also comprises:
Mark module is used for that described internal memory is read or write data manipulation and does not need to judge whether that the routine package that crosses the border carries out mark;
And described aborted module comprises:
Judge submodule, be used to judge whether the routine package that described internal memory is read or write data manipulation has described mark;
The aborted submodule, be used in the judged result of described judgement submodule when described mark is arranged, directly allow described routine package to continue to carry out follow-up flow process according to its program coding that comprises, in the judged result of described judgement submodule when not having described mark, obtain the described destination address that reads or writes data, judge according to described destination address and described Memory Allocation information whether the described internal storage access operation that reads or writes data crosses the border, if cross the border, then write down the field data that described internal storage access operation is crossed the border, allow described routine package to continue to carry out follow-up flow process according to its program coding that comprises, if do not cross the border, then allow described routine package to continue to carry out follow-up flow process according to its program coding that comprises.
11, as the described device of arbitrary claim in the claim 7 to 10, it is characterized in that described device also comprises:
Alarm module is used for the field data outputting alarm information according to described aborted module records.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN200910084008XA CN101561775B (en) | 2009-05-12 | 2009-05-12 | Method and device for monitoring memory |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN200910084008XA CN101561775B (en) | 2009-05-12 | 2009-05-12 | Method and device for monitoring memory |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN101561775A true CN101561775A (en) | 2009-10-21 |
| CN101561775B CN101561775B (en) | 2010-09-15 |
Family
ID=41220587
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN200910084008XA Expired - Fee Related CN101561775B (en) | 2009-05-12 | 2009-05-12 | Method and device for monitoring memory |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN101561775B (en) |
Cited By (31)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102207913A (en) * | 2011-06-09 | 2011-10-05 | 中兴通讯股份有限公司 | Write protection control method and device in embedded system |
| CN102216912A (en) * | 2011-05-28 | 2011-10-12 | 华为终端有限公司 | Configuring method and apparatus for memory capacity |
| WO2011107046A3 (en) * | 2011-04-19 | 2011-10-27 | 华为技术有限公司 | Memory access monitoring method and device |
| CN102388368A (en) * | 2011-09-20 | 2012-03-21 | 华为技术有限公司 | Method and device for monitoring memory |
| CN102681909A (en) * | 2012-04-28 | 2012-09-19 | 浪潮电子信息产业股份有限公司 | Server early-warning method based on memory errors |
| CN102880815A (en) * | 2012-08-21 | 2013-01-16 | 上海华御信息技术有限公司 | Application program temporary storage space-based protection method and system |
| CN104239192A (en) * | 2013-06-21 | 2014-12-24 | 中兴通讯股份有限公司 | Memory monitoring and processing method and device |
| WO2015154431A1 (en) * | 2014-08-08 | 2015-10-15 | 中兴通讯股份有限公司 | Method and device for detecting authorized memory access |
| CN105320895A (en) * | 2014-06-16 | 2016-02-10 | 德州仪器公司 | High performance autonomous hardware engine for online encryption processing |
| CN105718357A (en) * | 2016-01-22 | 2016-06-29 | 烽火通信科技股份有限公司 | Memory monitoring method |
| CN105988921A (en) * | 2015-02-06 | 2016-10-05 | 中兴通讯股份有限公司 | Method and device for detecting out of range problem of memory |
| CN106294089A (en) * | 2015-06-23 | 2017-01-04 | 阿里巴巴集团控股有限公司 | The method and apparatus assisting the access monitoring to monitored memory headroom |
| CN106484580A (en) * | 2016-10-21 | 2017-03-08 | 腾讯科技（深圳）有限公司 | A kind of internal-memory detection method, apparatus and system |
| CN103914366B (en) * | 2013-01-05 | 2017-05-31 | 腾讯科技（深圳）有限公司 | A kind of automatic monitoring application program carries out the method and device of memory information |
| CN106997316A (en) * | 2017-04-11 | 2017-08-01 | 上海联彤网络通讯技术有限公司 | Detecting system and method that memory abnormal increases |
| CN107797864A (en) * | 2017-10-19 | 2018-03-13 | 浪潮金融信息技术有限公司 | Process resource method and device, computer-readable recording medium, terminal |
| CN108073441A (en) * | 2016-11-14 | 2018-05-25 | 阿里巴巴集团控股有限公司 | A kind of virutal machine memory monitoring and managing method and equipment |
| CN108345789A (en) * | 2017-04-01 | 2018-07-31 | 清华大学 | Record the method and device of accessing operation information |
| CN108388814A (en) * | 2018-02-09 | 2018-08-10 | 清华大学 | Method, detection device and the detecting system of measurement processor |
| CN109086193A (en) * | 2017-06-13 | 2018-12-25 | 阿里巴巴集团控股有限公司 | Monitoring method, apparatus and system |
| CN109446755A (en) * | 2018-09-30 | 2019-03-08 | 龙芯中科技术有限公司 | The guard method of kernel hooking function, device, equipment and storage medium |
| CN109799992A (en) * | 2018-12-05 | 2019-05-24 | 交控科技股份有限公司 | A kind of city rail traffic signal system software buffer area range check method |
| CN110597707A (en) * | 2019-08-02 | 2019-12-20 | 华为技术有限公司 | Memory out-of-range fault detection method and terminal equipment |
| CN110895499A (en) * | 2018-09-13 | 2020-03-20 | 北京奇虎科技有限公司 | Program overflow protection method and device |
| CN111124921A (en) * | 2019-12-25 | 2020-05-08 | 北京字节跳动网络技术有限公司 | Memory out-of-range detection method, device, equipment and storage medium |
| CN111240870A (en) * | 2019-12-30 | 2020-06-05 | 锐捷网络股份有限公司 | Memory management method and device of Linux operating system |
| CN111338794A (en) * | 2020-02-18 | 2020-06-26 | 苏州洞察云信息技术有限公司 | Memory out-of-range monitoring method and device and storage medium |
| CN111913875A (en) * | 2014-10-24 | 2020-11-10 | 谷歌有限责任公司 | Method and system for automatic tagging based on software execution tracking |
| CN113391974A (en) * | 2021-05-25 | 2021-09-14 | 龙芯中科技术股份有限公司 | Memory monitoring method, device, processor and storage medium |
| CN114064212A (en) * | 2021-11-16 | 2022-02-18 | 摩尔线程智能科技(北京)有限责任公司 | Access address tracking method and device for PCI device and computer readable storage medium |
| CN117724985A (en) * | 2024-02-08 | 2024-03-19 | 此芯科技(武汉)有限公司 | Memory access behavior monitoring method and device, storage medium and electronic equipment |
-
2009
- 2009-05-12 CN CN200910084008XA patent/CN101561775B/en not_active Expired - Fee Related
Cited By (58)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102362464B (en) * | 2011-04-19 | 2013-01-30 | 华为技术有限公司 | Memory access monitoring method and device |
| WO2011107046A3 (en) * | 2011-04-19 | 2011-10-27 | 华为技术有限公司 | Memory access monitoring method and device |
| CN102362464A (en) * | 2011-04-19 | 2012-02-22 | 华为技术有限公司 | Memory access monitoring method and device |
| US8713275B2 (en) | 2011-04-19 | 2014-04-29 | Huawei Technologies Co., Ltd. | Memory access monitoring method and device |
| CN102216912A (en) * | 2011-05-28 | 2011-10-12 | 华为终端有限公司 | Configuring method and apparatus for memory capacity |
| CN102207913B (en) * | 2011-06-09 | 2019-05-31 | 中兴通讯股份有限公司 | The control method and device of write-protect in embedded system |
| CN102207913A (en) * | 2011-06-09 | 2011-10-05 | 中兴通讯股份有限公司 | Write protection control method and device in embedded system |
| WO2012119446A1 (en) * | 2011-09-20 | 2012-09-13 | 华为技术有限公司 | Memory monitoring method and device |
| CN102388368A (en) * | 2011-09-20 | 2012-03-21 | 华为技术有限公司 | Method and device for monitoring memory |
| CN102681909A (en) * | 2012-04-28 | 2012-09-19 | 浪潮电子信息产业股份有限公司 | Server early-warning method based on memory errors |
| CN102681909B (en) * | 2012-04-28 | 2016-07-27 | 浪潮电子信息产业股份有限公司 | A kind of server method for early warning based on EMS memory error |
| CN102880815A (en) * | 2012-08-21 | 2013-01-16 | 上海华御信息技术有限公司 | Application program temporary storage space-based protection method and system |
| CN102880815B (en) * | 2012-08-21 | 2016-02-03 | 上海华御信息技术有限公司 | Based on means of defence and the system of application program temporary memory space |
| CN103914366B (en) * | 2013-01-05 | 2017-05-31 | 腾讯科技（深圳）有限公司 | A kind of automatic monitoring application program carries out the method and device of memory information |
| CN104239192A (en) * | 2013-06-21 | 2014-12-24 | 中兴通讯股份有限公司 | Memory monitoring and processing method and device |
| WO2014201939A1 (en) * | 2013-06-21 | 2014-12-24 | 中兴通讯股份有限公司 | Memory monitoring and processing method and device |
| CN110825672B (en) * | 2014-06-16 | 2023-11-28 | 德州仪器公司 | High performance autonomous hardware engine for online encryption processing |
| CN105320895A (en) * | 2014-06-16 | 2016-02-10 | 德州仪器公司 | High performance autonomous hardware engine for online encryption processing |
| CN105320895B (en) * | 2014-06-16 | 2019-11-15 | 德州仪器公司 | High-performance autonomic hardware engine for on-line encryption processing |
| CN110825672A (en) * | 2014-06-16 | 2020-02-21 | 德州仪器公司 | High performance autonomous hardware engine for online cryptographic processing |
| WO2015154431A1 (en) * | 2014-08-08 | 2015-10-15 | 中兴通讯股份有限公司 | Method and device for detecting authorized memory access |
| CN105373488A (en) * | 2014-08-08 | 2016-03-02 | 中兴通讯股份有限公司 | A detection method and device for legitimate memory access |
| US10210103B2 (en) | 2014-08-08 | 2019-02-19 | Xi'an Zhongxing New Software Co. Ltd. | Method and device for checking validity of memory access |
| CN111913875A (en) * | 2014-10-24 | 2020-11-10 | 谷歌有限责任公司 | Method and system for automatic tagging based on software execution tracking |
| CN111913875B (en) * | 2014-10-24 | 2024-04-26 | 谷歌有限责任公司 | Method and system for tracking automatic tagging based on software execution |
| CN105988921A (en) * | 2015-02-06 | 2016-10-05 | 中兴通讯股份有限公司 | Method and device for detecting out of range problem of memory |
| CN106294089A (en) * | 2015-06-23 | 2017-01-04 | 阿里巴巴集团控股有限公司 | The method and apparatus assisting the access monitoring to monitored memory headroom |
| CN105718357B (en) * | 2016-01-22 | 2018-12-28 | 烽火通信科技股份有限公司 | A kind of method of internal memory monitoring |
| CN105718357A (en) * | 2016-01-22 | 2016-06-29 | 烽火通信科技股份有限公司 | Memory monitoring method |
| CN106484580A (en) * | 2016-10-21 | 2017-03-08 | 腾讯科技（深圳）有限公司 | A kind of internal-memory detection method, apparatus and system |
| CN106484580B (en) * | 2016-10-21 | 2019-10-18 | 腾讯科技（深圳）有限公司 | A kind of internal-memory detection method, apparatus and system |
| CN108073441B (en) * | 2016-11-14 | 2022-05-10 | 阿里巴巴集团控股有限公司 | Virtual machine memory supervision method and equipment |
| CN108073441A (en) * | 2016-11-14 | 2018-05-25 | 阿里巴巴集团控股有限公司 | A kind of virutal machine memory monitoring and managing method and equipment |
| CN108345789B (en) * | 2017-04-01 | 2019-02-22 | 清华大学 | Record the method and device of accessing operation information |
| CN108345789A (en) * | 2017-04-01 | 2018-07-31 | 清华大学 | Record the method and device of accessing operation information |
| CN106997316B (en) * | 2017-04-11 | 2020-02-21 | 上海联彤网络通讯技术有限公司 | System and method for detecting abnormal increase of memory |
| CN106997316A (en) * | 2017-04-11 | 2017-08-01 | 上海联彤网络通讯技术有限公司 | Detecting system and method that memory abnormal increases |
| CN109086193A (en) * | 2017-06-13 | 2018-12-25 | 阿里巴巴集团控股有限公司 | Monitoring method, apparatus and system |
| CN107797864A (en) * | 2017-10-19 | 2018-03-13 | 浪潮金融信息技术有限公司 | Process resource method and device, computer-readable recording medium, terminal |
| CN108388814A (en) * | 2018-02-09 | 2018-08-10 | 清华大学 | Method, detection device and the detecting system of measurement processor |
| US11062020B2 (en) | 2018-02-09 | 2021-07-13 | Tsinghua University | Processor checking method, checking device and checking system |
| CN110895499A (en) * | 2018-09-13 | 2020-03-20 | 北京奇虎科技有限公司 | Program overflow protection method and device |
| CN109446755B (en) * | 2018-09-30 | 2021-03-30 | 龙芯中科技术股份有限公司 | Kernel hook function protection method, device, equipment and storage medium |
| CN109446755A (en) * | 2018-09-30 | 2019-03-08 | 龙芯中科技术有限公司 | The guard method of kernel hooking function, device, equipment and storage medium |
| CN109799992B (en) * | 2018-12-05 | 2022-07-19 | 交控科技股份有限公司 | Method for checking software buffer area range of urban rail transit signal system |
| CN109799992A (en) * | 2018-12-05 | 2019-05-24 | 交控科技股份有限公司 | A kind of city rail traffic signal system software buffer area range check method |
| CN110597707A (en) * | 2019-08-02 | 2019-12-20 | 华为技术有限公司 | Memory out-of-range fault detection method and terminal equipment |
| CN111124921A (en) * | 2019-12-25 | 2020-05-08 | 北京字节跳动网络技术有限公司 | Memory out-of-range detection method, device, equipment and storage medium |
| CN111124921B (en) * | 2019-12-25 | 2023-09-26 | 抖音视界有限公司 | Method, device, equipment and storage medium for detecting memory boundary crossing |
| CN111240870A (en) * | 2019-12-30 | 2020-06-05 | 锐捷网络股份有限公司 | Memory management method and device of Linux operating system |
| CN111240870B (en) * | 2019-12-30 | 2022-10-14 | 锐捷网络股份有限公司 | Memory management method and device of Linux operating system |
| CN111338794A (en) * | 2020-02-18 | 2020-06-26 | 苏州洞察云信息技术有限公司 | Memory out-of-range monitoring method and device and storage medium |
| CN113391974B (en) * | 2021-05-25 | 2023-04-07 | 龙芯中科技术股份有限公司 | Memory monitoring method, device, processor and storage medium |
| CN113391974A (en) * | 2021-05-25 | 2021-09-14 | 龙芯中科技术股份有限公司 | Memory monitoring method, device, processor and storage medium |
| CN114064212B (en) * | 2021-11-16 | 2022-07-29 | 摩尔线程智能科技(北京)有限责任公司 | Access address tracking method and device for PCI device and computer readable storage medium |
| CN114064212A (en) * | 2021-11-16 | 2022-02-18 | 摩尔线程智能科技(北京)有限责任公司 | Access address tracking method and device for PCI device and computer readable storage medium |
| CN117724985A (en) * | 2024-02-08 | 2024-03-19 | 此芯科技(武汉)有限公司 | Memory access behavior monitoring method and device, storage medium and electronic equipment |
| CN117724985B (en) * | 2024-02-08 | 2024-04-30 | 此芯科技(武汉)有限公司 | Memory access behavior monitoring method and device, storage medium and electronic equipment |
Also Published As
| Publication number | Publication date |
|---|---|
| CN101561775B (en) | 2010-09-15 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN101561775B (en) | Method and device for monitoring memory | |
| US10514903B2 (en) | Method and device for updating software executed from non-volatile memory | |
| CN100375060C (en) | Embedded system and real-time monitoring and processing method thereof | |
| JP6306578B2 (en) | Memory protection device and protection method | |
| CN101351774B (en) | Method, device and system for coloring page of memory and page associated pages with programs | |
| CN100487658C (en) | Method for detecting memory accessing outside | |
| KR100843701B1 (en) | Confirmation method of API by the information at Call-stack | |
| TW201937393A (en) | Systems and methods for policy compilation for secure initialization | |
| DE102006015106A1 (en) | Provide extended memory protection | |
| CN102930185A (en) | Method and device for verifying integrity of security critical data of program in process of running | |
| JP2016133874A (en) | Information processor and flash memory control method | |
| US20240095174A1 (en) | Method for detecting error of operating system kernel memory in real time | |
| CN100432955C (en) | Detecting method for illegal memory reading and writing | |
| JP5464226B2 (en) | Information processing apparatus, information processing apparatus control method, and information processing apparatus control program | |
| CN1808402A (en) | Memory access monitoring method | |
| CN113987507A (en) | Heap memory vulnerability detection method and device, storage medium and electronic equipment | |
| CN107368739A (en) | A kind of monitoring method and apparatus of kernel-driven | |
| KR20200123799A (en) | Apparatus and method for accessing metadata when debugging a device | |
| US11048617B2 (en) | Method of accessing metadata when debugging a program to be executed on processing circuitry | |
| US10503702B2 (en) | Information processing device, information processing method, and program | |
| US8321668B2 (en) | Control of data access by dynamically verifying legal references | |
| US8042176B2 (en) | Computer readable medium on which is stored a program for preventing the unauthorized use of program data | |
| CN100465980C (en) | Method for improving operation system safety through incompatiblity of process behavour | |
| CN1289968A (en) | Method and architecture for controlling access attributes of memory pages | |
| CN113157513B (en) | Heap memory damage detection method and device, electronic equipment and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant | ||
| C17 | Cessation of patent right | ||
| CF01 | Termination of patent right due to non-payment of annual fee |
Granted publication date: 20100915 Termination date: 20120512 |