This paper presents a novel technique for the automatic type identification of arbitrary memory objects from a memory dump. Our motivating application is debugging memory corruption problems in optimized, production systems — a problem domain largely unserved by extant methodologies. We describe our algorithm as applicable to any typed language, and we discuss it with respect to the formidable obstacles posed by C. We describe the heuristics that we have developed to overcome these difficulties and achieve effective type identification on C-based systems. We further describe the implementation of our heuristics on one Cbased system — the Solaris operating system kernel — and describe the extensions that we have added to the Solaris postmortem debugger to allow for postmortem type identification. We show that our implementation yields a sufficiently high rate of type identification to be useful for debugging memory corruption problems. Finally, we discuss some of the novel automated debugging mechanisms that can be layered upon postmortem type identification.
Some memory allocators have addressed debugging problems in production by allowing their behavior to be dynamically changed to provide greater debugging support @cite_13 . This allows optimal allocators to be deployed into production, while still allowing their debugging features to be later enabled should problems arise. A common way for these allocators to detect buffer overruns is to optionally place red zones around allocated memory. However, this only provides for immediate identification of the errant code if stores to the red zone induce a synchronous fault. Such faults are typically achieved by coopting the virtual memory system in some way --- either by surrounding a buffer with unmapped regions, or by performing a check on each access. The first has enormous cost in terms of space, and the second in terms of time --- neither can be acceptably enabled at all times. Thus, these approaches are still only useful for reproducible memory corruption problems.
@cite_13
1746694335
This paper presents a comprehensive design overview of the SunOS 5.4 kernel memory allocator. This allocator is based on a set of object-caching primitives that reduce the cost of allocating complex objects by retaining their state between uses. These same primitives prove equally effective for managing stateless memory (e.g. data pages and temporary buffers) because they are space-efficient and fast. The allocator's object caches respond dynamically to global memory pressure, and employ an object-coloring scheme that improves the system's overall cache utilization and bus balance. The allocator also has several statistical and debugging features that can detect a wide range of problems throughout the system.