1. Dynamic Memory Management Winter 2013 COMP 2130 Intro Computer Systems Computing Science Thompson Rivers University

2. TRU-COMP2130 DMM2 Course Objectives The better knowledge of computer systems, the better programing. Computer SystemC Programming Language Computer architecture CPU (Central Processing Unit) IA32 assembly language Introduction to C language Compiling, linking, loading, executing Physical main memory MMU (Memory Management Unit) Virtual memory space Memory hierarchy Cache Dynamic memory management Better coding – locality Reliable and efficient programming for power programmers (to avoid strange errors, to optimize codes, to avoid security holes, …) Your vision? Seek with all your heart?

3. TRU-COMP2130 DMM3 Course Contents Introduction to computer systems: B&O 1 Introduction to C programming: K&R 1 – 4 Data representations: B&O 2.1 – 2.4 C: advanced topics: K&R 5.1 – 5.10, 6 – 7 Introduction to IA32 (Intel Architecture 32): B&O 3.1 – 3.8, 3.13 Compiling, linking, loading, and executing: B&O 7 (except 7.12) Dynamic memory management – Heap: B&O 9.1–2, 9.4–5, 9.9.1–2, 9.9.4–5, 9.11 Code optimization: B&O 5.1 – 5.6, 5.13 Memory hierarchy, locality, caching: B&O 5.12, 6.1 – 6.3, 6.4.1 – 6.4.2, 6.5, 6.6.2 – 6.6.3, 6.7 Virtual memory (if time permits): B&O 9.4 – 9.5 Your vision? Seek with all your heart?

4. TRU-COMP2130 DMM4 Unit Learning Objectives Which type of addresses are used by machine instructions? Virtual addresses, or physical addresses? List the three advantages of using virtual memory. What hardware component translates virtual addresses to physical addresses? Explain how virtual memory support memory protection? Use of malloc() and free() in C programs. Identify memory-related problems in given C code. Your vision? Seek with all your heart?

5. TRU-COMP2130 DMM5 Unit Contents 1. Physical and Virtual Addressing 2. Address Spaces 3. VM as a Tool for Memory Management 4. VM as a Tool for Memory Protection 5. Dynamic Memory Management 6. Common Memory-Related Bugs in C Programs Your vision? Seek with all your heart?

6. TRU-COMP2130 DMM6 9.1 Physical and Virtual Addressing Your vision? Seek with all your heart?

7. A System Using Physical Addressing Used in “simple” systems like embedded microcontrollers in devices like cars, elevators, and digital picture frames Instructions use physical addresses. Programmers need to think of main memory. 0: 1: M-1: Main memory CPU 2: 3: 4: 5: 6: 7: Physical address (PA) Data word 8:... 4 Carnegie Mellon [Q] Do instructions use PAs or VAs?

8. A System Using Virtual Addressing Used in all modern servers, desktops, and laptops. One of the great ideas in computer science. Instructions use virtual addresses. Programmer do not have to think of main memory. 0: 1: M-1: Main memory MMU 2: 3: 4: 5: 6: 7: Physical address (PA) Data word 8:... CPU Virtual address (VA) CPU Chip 4 4100 Carnegie Mellon [Q] Do instructions use PAs or VAs? (Memory Management Unit: VAs are translated to PAs.)

9. TRU-COMP2130 DMM9 9.2 Address Spaces Your vision? Seek with all your heart?

10. Address Spaces Linear address space: Ordered set of contiguous non-negative integer addresses: {0, 1, 2, 3 … } Virtual address space: Set of N = 2 n virtual addresses {0, 1, 2, 3, …, N-1} [Q] For each process ??? Yes. Uniform view for every process. Physical address space: Set of M = 2 m physical addresses {0, 1, 2, 3, …, M-1} [Q] For each process ??? Clean distinction between data (bytes) and their attributes (addresses) Every byte in main memory: one physical address, one (or more) virtual addresses Carnegie Mellon [Q] M >= N ??? PP 2 m-p -1 Physical memory Empty Uncached VP 0 VP 1 VP 2 n-p -1 Virtual memory Unallocated Cached Uncached Unallocated Cached Uncached PP 0 PP 1 Empty Cached 0 N-1 M-1 0 Virtual Pages (VP's) stored on disk Physical Pages (PP's) cached in DRAM Through MMU

11. Why Virtual Memory (VM)? Uses main memory efficiently Use DRAM as a cache for the parts of a virtual address space [Q] Should all the parts of an executable file be loaded into DRAM? Simplifies memory management Each process gets the same uniform linear address space -> easy jobs for compilers, linkers and loaders Isolates address spaces -> memory protection One process can’t interfere with another’s memory User program cannot access privileged kernel information [Q] How? By software, or hardware? Carnegie Mellon PP 2 m-p -1 Empty Uncached VP 0 VP 1 VP 2 n-p -1 Unallocated Cached Uncached Unallocated Cached Uncached PP 0 PP 1 Empty Cached 0 N-1 M-1 0 Through MMU

12. TRU-COMP2130 DMM12 9.4 VM for Memory Management Your vision? Seek with all your heart?

13. VM as a Tool for Memory Management Key idea: Each process has its own virtual address space. It can view memory as a simple linear array. Mapping function scatters addresses through physical memory Well chosen mappings simplify memory allocation and management. [Q] Is a VP-PP mapping table used for each process, or one common table for all processes? Each process Virtual Address Space for Process 1: Physical Address Space (DRAM) 0 N-1 (e.g., read-only library code) Virtual Address Space for Process 2: VP 1 VP 2... 0 N-1 VP 1 VP 2... PP 2 PP 6 PP 8... 0 M-1 Address translation [Q] by what? Carnegie Mellon

14. Memory allocation Each virtual page can be mapped to any physical page. A virtual page can be stored in different physical pages at different times. Sharing code and data among processes Map virtual pages to the same physical page (here: PP 6). Virtual Address Space for Process 1: Physical Address Space (DRAM) 0 N-1 (e.g., read-only library code) Virtual Address Space for Process 2: VP 1 VP 2... 0 N-1 VP 1 VP 2... PP 2 PP 6 PP 8... 0 M-1 Carnegie Mellon Address translation [Q] by what?

15. Simplifying Linking and Loading Linking Each program has similar virtual address space Code, stack, and shared libraries always start at the same address Loading [Q] Does each process use its own VP-PP mapping table? execve() allocates virtual pages for.text and.data sections = creates PTEs (Page Table Entries) marked as invalid The.text and.data sections are copied, page by page, on demand by the virtual memory system Kernel virtual memory Memory-mapped region for shared libraries Run-time heap (created by malloc ) User stack (created at runtime) Unused 0 %esp (stack pointer) Memory invisible to user code brk 0xc0000000 0x08048000 0x40000000 Read/write segment (. data,. bss ) Read-only segment (.init,. text,.rodata ) Loaded from the executable file Carnegie Mellon

16. TRU-COMP2130 DMM16 9.5 VM for Memory Protection Your vision? Seek with all your heart?

17. VM as a Tool for Memory Protection Extend PTEs (Page Table Entries) with permission bits Page fault handler checks these before remapping If violated, send process SIGSEGV (segmentation fault). [Q] To what? [Q] Is segmentation fault detected by software, or hardware? Process i: AddressREADWRITE PP 6YesNo PP 4Yes PP 2Yes VP 0: VP 1: VP 2: Process j: Yes SUP No Yes AddressREADWRITE PP 9YesNo PP 6Yes PP 11Yes SUP No Yes No VP 0: VP 1: VP 2: Physical Address Space PP 2 PP 4 PP 6 PP 8 PP 9 PP 11 Carnegie Mellon SUP indicates whether the process must be running in kernel (supervisor) mode to access the page. MMU

18. TRU-COMP2130 DMM18 9.9 Dynamic Memory Allocation Your vision? Seek with all your heart?

19. Dynamic Memory Allocation Programmers use dynamic memory allocators (such as malloc ) to acquire VM at run time. For data structures whose size is only known at runtime. Dynamic memory allocators manage an area of process virtual memory known as the heap. Heap (via malloc ) Program text (.text ) Initialized data (.data ) Uninitialized data (. bss ) User stack 0 Top of heap ( brk ptr) Application Dynamic Memory Allocator Heap Carnegie Mellon

20. Allocator maintains heap as collection of variable sized blocks, which are either allocated or free Types of allocators Explicit allocator: application allocates and frees space E.g., malloc() and free() in C Implicit allocator: application allocates, but does not free space E.g. garbage collection in Java, ML, and Lisp Will discuss simple explicit memory allocation Carnegie Mellon

21. The malloc Package #include void *malloc(size_t size) Successful: Returns a pointer to a memory block of at least size bytes (typically) aligned to 8-byte boundary If size == 0, returns NULL Unsuccessful: returns NULL (0) and sets errno void free(void *p) Returns the block pointed at by p to pool of available memory p must come from a previous call to malloc or realloc Other functions calloc : Version of malloc that initializes allocated block to zero. realloc: Changes the size of a previously allocated block. brk, sbrk : Used internally by allocators to grow or shrink the heap Carnegie Mellon

22. malloc Example void foo(int n, int m) { int i, *p; /* Allocate a block of n ints */ p = (int *) malloc(n * sizeof(int)); if (p == NULL) { perror("malloc");// [Q] what is it??? exit(0); } /* Initialize allocated block */ for (i=0; i<n; i++) p[i] = i; /* Return p to the heap */ free(p); } Carnegie Mellon

23. TRU-COMP2130 DMM23 9.11 Memory-Related Bugs Your vision? Seek with all your heart?

24. Memory-Related Perils and Pitfalls Dereferencing bad pointers Reading uninitialized memory Overwriting memory Referencing nonexistent variables Freeing blocks multiple times Referencing freed blocks Failing to free blocks

25. C operators OperatorsAssociativity () [] ->. left to right ! ~ ++ -- + - * & (type) sizeof right to left * / % left to right + - left to right > left to right >= left to right == != left to right & left to right ^ left to right | left to right && left to right || left to right ?: right to left = += -= *= /= %= &= ^= != >= right to left, left to right ->, (), and [] have high precedence, with * and & just below Unary +, -, and * have higher precedence than binary forms Source: K&R page 53

26. C Pointer Declarations: Test Yourself! int *p int *p[13] int *(p[13]) int **p int (*p)[13] int *f() int (*f)() p is a pointer to int p is an array[13] of pointer to int p is a pointer to a pointer to an int p is a pointer to an array[13] of int f is a function returning a pointer to int f is a pointer to a function returning int Source: K&R Sec 5.12

27. Dereferencing Bad Pointers The classic scanf bug int val;... scanf(“%d”, val); [Q] What is wrong?

28. Reading Uninitialized Memory Assuming that heap data is initialized to zero /* return y = Ax */ int *matvec(int **A, int *x) { int *y = malloc(N*sizeof(int)); int i, j; for (i=0; i<N; i++) for (j=0; j<N; j++) y[i] += A[i][j]*x[j]; return y; } [Q] What is wrong?

29. Overwriting Memory Allocating the (possibly) wrong sized object int **p; p = malloc(N*sizeof(int)); for (i=0; i<N; i++) { p[i] = malloc(M*sizeof(int)); } [Q] What is wrong?

30. Overwriting Memory Off-by-one error int **p; p = malloc(N*sizeof(int *)); for (i=0; i<=N; i++) { p[i] = malloc(M*sizeof(int)); } [Q] What is wrong?

31. Overwriting Memory Not checking the max string size Basis for classic buffer overflow attacks char s[8]; int i; gets(s); /* reads “123456789” from stdin */ [Q] What is wrong?

32. Overwriting Memory Misunderstanding pointer arithmetic int *search(int *p, int val) { while (*p && *p != val) p += sizeof(int); return p; } [Q] What is wrong?

33. Overwriting Memory Referencing a pointer instead of the object it points to int *BinheapDelete(int **binheap, int *size) { int *packet; packet = binheap[0]; binheap[0] = binheap[*size - 1]; *size--; Heapify(binheap, *size, 0); return(packet); } [Q] What is wrong?

34. Referencing Nonexistent Variables Forgetting that local variables disappear when a function returns int *foo () { int val; return &val; } [Q] What is wrong?

35. Freeing Blocks Multiple Times Nasty! x = malloc(N*sizeof(int)); free(x); y = malloc(M*sizeof(int)); free(x); [Q] What is wrong?

36. Referencing Freed Blocks Evil! x = malloc(N*sizeof(int)); free(x);... y = malloc(M*sizeof(int)); for (i=0; i<M; i++) y[i] = x[i]++; [Q] What is wrong?

37. Failing to Free Blocks (Memory Leaks) Slow, long-term killer! foo() { int *x = malloc(N*sizeof(int));... return; } [Q] What is wrong?

38. Failing to Free Blocks (Memory Leaks) Freeing only part of a data structure struct list { int val; struct list *next; }; foo() { struct list *head = malloc(sizeof(struct list)); head->val = 0; head->next = NULL;... free(head); return; } [Q] What is wrong?