Binghamton University CS-220 Spring 2015 Binghamton University CS-220 Spring 2015 Heap Management

Binghamton University CS-220 Spring 2015 Binghamton University CS-220 Spring 2015 Abstract I call malloc… the system quickly, and correctly determines if it can satisfy my request, and returns a pointer to the memory. I call free… the system quickly returns.

Binghamton University CS-220 Spring 2015 Binghamton University CS-220 Spring 2015 Concrete The system heap management routines must trade-off between: Efficiency – how fast are malloc and free requests honored Correctness – If a chunk exists in heap memory, you will get it Sustainability – If the system grants my request now, will that cause it to refuse valid requests later (e.g. fragmentation) Result: Sophisticated Heap Management Algorithms

Binghamton University CS-220 Spring 2015 Binghamton University CS-220 Spring 2015 Leaky Abstract: Why we learn concrete Identify bugs which have bizarre side effects Bugs can corrupt system information When that happens, what are the results? When that happens, what might the causes be? Optimize malloc/free invocations e.g. order of invocation may not make a difference to program logic, but may make a big difference to performance! Leverage knowledge for debugging Use system tools to identify logic errors

Binghamton University CS-220 Spring 2015 Binghamton University CS-220 Spring 2015 Implementation Detail : Prefixes Need to keep some information about chunks of memory on the heap For instance, how long is this chunk of memory Accepted practice… keep 4 bytes BEFORE the memory for book- keeping 20 int * numbers=(int *)malloc(4*sizeof(int)); numbers prefix

Binghamton University CS-220 Spring 2015 Binghamton University CS-220 Spring 2015 Implementation Detail: Alignment For most hardware, it is faster to retrieve 4 bytes which start at an address divisible by 4 rather than 4 bytes at an odd address malloc doesn’t know how you are going to use your data, so aligns your data on an address divisible by 4 (or 8 or 16) 0x0804c004 0x0804c003

Binghamton University CS-220 Spring 2015 Binghamton University CS-220 Spring 2015 Heap Management V1: Simple Free List Prefix for allocated blocks… length of block (or pointer to next) System keeps a list of free heap memory Each entry contains : Start address and Length of free block malloc calls are satisfied by finding the first entry on the free list which is at least as large as the requested size When malloc finds a free entry, requests are taken from the front of the free block, and the free entry is updated with a new address/length. Free calls create a new free list entry at the end of the free list

Binghamton University CS-220 Spring 2015 Binghamton University CS-220 Spring 2015 Simple Free List Example Free List LocationLength 0x08c bytes “chunks” m1=malloc(20); /* 20=0x14 */

Binghamton University CS-220 Spring 2015 Binghamton University CS-220 Spring 2015 Simple Free List Example 18 Free List LocationLength 0x08c m1=malloc(20); /* m1= 0x08c06004 */ m2=malloc(12);

Binghamton University CS-220 Spring 2015 Binghamton University CS-220 Spring 2015 Simple Free List Example 1810 Free List LocationLength 0x08c m1=malloc(20); /* m1= 0x08c06004 */ m2=malloc(12); /* m2 = 0x08c0601c */ free(m1);

Binghamton University CS-220 Spring 2015 Binghamton University CS-220 Spring 2015 Simple Free List Example 10 Free List LocationLength 0x08c x08c m1=malloc(20); m2=malloc(12); /* m2 = 0x08c0601c */ free(m1); m1=malloc(40); /* 40=0x28 */

Binghamton University CS-220 Spring 2015 Binghamton University CS-220 Spring 2015 Simple Free List Example 102c Free List LocationLength 0x08c x08c m1=malloc(20); m2=malloc(12); /* m2 = 0x08c0601c */ free(m1); m1=malloc(40); /* m1= 0x08c0602c */ m3=malloc(12);

Binghamton University CS-220 Spring 2015 Binghamton University CS-220 Spring 2015 Simple Free List Example 10 2c Free List LocationLength 0x08c x08c m1=malloc(20); m2=malloc(12); /* m2 = 0x08c0601c */ free(m1); m1=malloc(40); /* m1= 0x08c0602c */ m3=malloc(12); /* m3= 0x08c06004 */ free(m2);

Binghamton University CS-220 Spring 2015 Binghamton University CS-220 Spring 2015 Simple Free List Example 102c Free List LocationLength 0x08c x08c x08c m1=malloc(20); m2=malloc(12); free(m1); m1=malloc(40); /* m1= 0x08c0602c */ m3=malloc(12); /* m3= 0x08c06004 */ free(m2); m2=malloc(16); /* 16=0x10 */

Binghamton University CS-220 Spring 2015 Binghamton University CS-220 Spring 2015 Simple Free List Advantages Very fast free malloc speed depends on size of free list Good for many requests of the same size Disadvantages Adjacent free blocks never consolidated FRAGMENTATION! (Sustainability) Free list size grows over time malloc performance gets worse over time Space for free list + prefix

Binghamton University CS-220 Spring 2015 Binghamton University CS-220 Spring 2015 Free List: Consolidating Blocks Requires free list sorted by start address Period “sort/merge” (expensive, unpredictable performance) or Keep free list sorted by address, merge on free Increases expense of free Reduces randomness in malloc search for free block

Binghamton University CS-220 Spring 2015 Binghamton University CS-220 Spring 2015 Free List Consolidation Example 102c Free List LocationLength 0x08c x08c x08c

Binghamton University CS-220 Spring 2015 Binghamton University CS-220 Spring 2015 Free List Consolidation Example 102c Free List LocationLength 0x08c x08c m1=malloc(20); m2=malloc(12); free(m1); m1=malloc(40); /* m1= 0x08c0602c */ m3=malloc(12); /* m3= 0x08c06004 */ free(m2); m2=malloc(16); /* 16=0x10 */

Binghamton University CS-220 Spring 2015 Binghamton University CS-220 Spring 2015 Free List with Binning Keep multiple free lists for different free block sizes malloc request goes directly to correct bin free entry may move to different bin when malloc subtracts from it Consolidate when bin is full

Binghamton University CS-220 Spring 2015 Binghamton University CS-220 Spring 2015 Free List with Binning Advantages Short search for malloc, even when free list is large Consolidate before space is required – enables “background” consolidation Disadvantages More work for malloc move entry to new bin More work for free find right bin Consolidation needs to occur across bins

Binghamton University CS-220 Spring 2015 Binghamton University CS-220 Spring 2015 Heap Management V2: Linked Blocks Blocksize always multiple of 4 Prefix: Blocksize (or pointer to next) Low order bit used as flag: 1=“used”, 0=“free” malloc walks block list until it find the first free block with size large enough to satisfy request Splits block into used request size and free remainder free – unsets used bit and merges block with subsequent free blocks

Binghamton University CS-220 Spring 2015 Binghamton University CS-220 Spring 2015 Simple Linked Block Example 60 m1=malloc(20); /* 20=0x14 */

Binghamton University CS-220 Spring 2015 Binghamton University CS-220 Spring 2015 Simple Linked Block Example 1948 m1=malloc(20); /* m1 = 0x08c06004 */ m2=malloc(12);

Binghamton University CS-220 Spring 2015 Binghamton University CS-220 Spring 2015 Simple Linked Block Example m1=malloc(20); /* m1 = 0x08c06004 */ m2=malloc(12); /* m2 = 0x08c0601c */ free(m1);

Binghamton University CS-220 Spring 2015 Binghamton University CS-220 Spring 2015 Simple Linked Block Example m1=malloc(20); m2=malloc(12); /* m2 = 0x08c0601c */ free(m1); m1=malloc(40); /* 40=0x28 */

Binghamton University CS-220 Spring 2015 Binghamton University CS-220 Spring 2015 Simple Linked Block Example 18112d0c m1=malloc(20); m2=malloc(12); /* m2 = 0x08c0601c */ free(m1); m1=malloc(40); /* m1 = 0x08c0602c */ m3=malloc(12);

Binghamton University CS-220 Spring 2015 Binghamton University CS-220 Spring 2015 Simple Linked Block Example d0c m1=malloc(20); m2=malloc(12); /* m2 = 0x08c0601c */ free(m1); m1=malloc(40); /* m1 = 0x08c0602c */ m3=malloc(12); /* m3 = 0x08c06004 */ free(m2);

Binghamton University CS-220 Spring 2015 Binghamton University CS-220 Spring 2015 Simple Linked Block Example d0c m1=malloc(20); m2=malloc(12); free(m1); m1=malloc(40); /* m1 = 0x08c0602c */ m3=malloc(12); /* m3 = 0x08c06004 */ free(m2); m2=malloc(16);

Binghamton University CS-220 Spring 2015 Binghamton University CS-220 Spring 2015 Simple Linked Block Advantages malloc is relatively quick depends on size of heap free is quick Solves half the consolidation problem No space for free list required Disadvantages Still fragments Need to walk through both allocated and free blocks on malloc Need to consolidate with previous free block!

Binghamton University CS-220 Spring 2015 Binghamton University CS-220 Spring 2015 Linked Block Consolidation: v1 On free, find preceding block Start at beginning of heap Walk forward, keeping track of where you came from If this block is block being freed and preceding block is free merge preceding block with this block If next block is free merge this block with next block Makes free performance dependent on size of heap!

Binghamton University CS-220 Spring 2015 Binghamton University CS-220 Spring 2015 Linked Block Consolidation: V2 Put a suffix at the end of each block with the length of the block Word before this block’s prefix is previous block’s suffix Use previous block’s suffix to get back to previous block’s prefix Consolidate with previous block if free

Binghamton University CS-220 Spring 2015 Binghamton University CS-220 Spring 2015 Linked Block Suffix Example 60 m1=malloc(20); /* 20=0x14 */

Binghamton University CS-220 Spring 2015 Binghamton University CS-220 Spring 2015 Linked Block Suffix Example 1d1c44 m1=malloc(20); /* m1 = 0x08c06004 */ m2=malloc(12);

Binghamton University CS-220 Spring 2015 Binghamton University CS-220 Spring 2015 Linked Block Suffix Example 1d1c m1=malloc(20); /* m1 = 0x08c06004 */ m2=malloc(12); /* m2 = 0x08c06020 */ free(m1);

Binghamton University CS-220 Spring 2015 Binghamton University CS-220 Spring 2015 Linked Block Suffix Example 1c m1=malloc(20); m2=malloc(12); /* m2 = 0x08c06020 */ free(m1); m1=malloc(40); /* 40=0x28 */

Binghamton University CS-220 Spring 2015 Binghamton University CS-220 Spring 2015 Linked Block Suffix Example 1c m1=malloc(20); m2=malloc(12); /* m2 = 0x08c06020 */ free(m1); m1=malloc(40); /* m1= 0x08c06038 */ m3=malloc(12);

Binghamton University CS-220 Spring 2015 Binghamton University CS-220 Spring 2015 Linked Block Suffix Example m1=malloc(20); m2=malloc(12); /* m2 = 0x08c06020 */ free(m1); m1=malloc(40); /* m1= 0x08c06038 */ m3=malloc(12); /* m3 = 0x08c06004 */ free(m2);

Binghamton University CS-220 Spring 2015 Binghamton University CS-220 Spring 2015 Linked Block Suffix Example 15141c 3130 m1=malloc(20); m2=malloc(12); /* m2 = 0x08c06020 */ free(m1); m1=malloc(40); /* m1= 0x08c06038 */ m3=malloc(12); /* m3 = 0x08c06004 */ free(m2); m2=malloc(16);

Binghamton University CS-220 Spring 2015 Binghamton University CS-220 Spring 2015 Linked Block Suffix Example ??3130 m1=malloc(20); m2=malloc(12); /* m2 = 0x08c06020 */ free(m1); m1=malloc(40); /* m1= 0x08c06038 */ m3=malloc(12); /* m3 = 0x08c06004 */ free(m2); m2=malloc(16); /* Remainder block must be 2 words! */

Binghamton University CS-220 Spring 2015 Binghamton University CS-220 Spring 2015 Linked Block Suffix Example 15141d1c3130 m1=malloc(20); m2=malloc(12); /* m2 = 0x08c06020 */ free(m1); m1=malloc(40); /* m1= 0x08c06038 */ m3=malloc(12); /* m3 = 0x08c06004 */ free(m2); m2=malloc(16); /* m2 = 0x08c06020 */

Binghamton University CS-220 Spring 2015 Binghamton University CS-220 Spring 2015 Linked Block Suffix Example m1=malloc(20); m2=malloc(12); /* m2 = 0x08c06020 */ free(m1); m1=malloc(40); /* m1= 0x08c06038 */ m3=malloc(12); /* m3 = 0x08c06004 */ free(m2); m2=malloc(16); /* m2 = 0x08c06020 */

Binghamton University CS-220 Spring 2015 Binghamton University CS-220 Spring 2015 Linked Block Suffix Advantages Enables consolidation of preceding and following blocks Reduces fragmentation free occurs in linear time Disadvantages Doubles overhead 8 bytes per block instead of 4

Binghamton University CS-220 Spring 2015 Binghamton University CS-220 Spring 2015 Other Considerations Error Resistance What happens when you overwrite past malloc’ed area? Can errors be detected? Can errors be corrected? Debug Capabilities Can debug tool determine used/allocated blocks? Can programmer detect corrupted prefix/suffix in debugger?

Binghamton University CS-220 Spring 2015 Binghamton University CS-220 Spring 2015 Debugging Storage Manager Keeps constant tags around prefix/suffix When tag value changes, tags are likely to be corrupted! Keeps return address of last malloc and free in tag / free list If a problem occurred, which memory is it? Enables walk through heap to verify current state is valid Significant extra cost – performance and memory Used only when bug is suspected