<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<div>
<div>
<div style="font-family:Calibri,sans-serif; font-size:11pt">Hi,<br>
<br>
This sounds like it could be a double-free problem, or a memory trampling problem. That would explain a lot of odd behaviour.<br>
<br>
If you've not already then its worth checking:<br>
<br>
- The sizes passed to malloc are correct, particularly making sure that you allocate sizeof(foo) where needed and not sizeof(foo*).<br>
<br>
- None of the accesses through computed pointers or array indexes are out of bounds.<br>
<br>
- Check the addresses passed to free are identical to those passed to malloc, and there is no double-freeing going on.<br>
<br>
At a high level, what you're doing sounds fine -- so it looks like a low level C problem rather than something specific to Barrelfish.<br>
<br>
How big is the actual code? Happy to take a look, in case a second pair of eyes would help.
<br>
<br>
--Tim <br>
<br>
Sent from my Windows Phone<br>
</div>
</div>
<hr>
<span style="font-family:Tahoma,sans-serif; font-size:10pt; font-weight:bold">From:
</span><span style="font-family:Tahoma,sans-serif; font-size:10pt">Georgios Varisteas</span><br>
<span style="font-family:Tahoma,sans-serif; font-size:10pt; font-weight:bold">Sent:
</span><span style="font-family:Tahoma,sans-serif; font-size:10pt">07/12/2011 00:05</span><br>
<span style="font-family:Tahoma,sans-serif; font-size:10pt; font-weight:bold">To:
</span><span style="font-family:Tahoma,sans-serif; font-size:10pt">barrelfish-users@lists.inf.ethz.ch</span><br>
<span style="font-family:Tahoma,sans-serif; font-size:10pt; font-weight:bold">Subject:
</span><span style="font-family:Tahoma,sans-serif; font-size:10pt">[Barrelfish-users] FW: Memorry allocation weirdness</span><br>
<br>
</div>
<font size="2"><span style="font-size:10pt;">
<div class="PlainText">So, given the scenario I described in the first email, but disregarding the crashes I mention, assume the following structures:<br>
<br>
<br>
typedef struct bdis_client_tbl {<br>
bdis_core_usage_t *core_usg; // ARRAY of core usages, one entry per core.<br>
bdis_num_cores_t num_cores; // number of cores in the System<br>
hash_table **process_state; //<br>
} *bdis_client_tbl_t;<br>
<br>
typedef struct bdis_process_state {<br>
...<br>
bdis_coreid_t *cores; // collection of allotted cores<br>
bdis_num_cores_t num_cores; // number of allotted cores<br>
...<br>
} *bdis_process_state_t;<br>
<br>
typedef struct bdis_core_usage {<br>
bdis_core_usage_p_t *pids; // array of processes using this core<br>
bdis_sz_t count; // counter<br>
} *bdis_core_usage_t;<br>
<br>
<br>
The first is the main strctures used by the server to keep all information.<br>
The second stores the state of each client. These are stored in the hash table of the first structure.<br>
The first field of the first structure (core_usg) is meant to be an array of the third structure.<br>
<br>
Now cleaning up after an application disconnects, the server might free the "pids" field of each instance of the third structure. In my example I'm using single-threaded applications so that would be only one.<br>
<br>
Then the second application comes, I allocate a new process state and put it in the hash table. Then the server terminates with a page fault while trying to access the "cores" field of the process state. This is again manually allocated memory meant to be used
as an array.<br>
By the way I do check each allocation and they all succeed.<br>
<br>
However, if "pids" is not freed, the server wont crash. It will continue running normally accepting more clients.<br>
<br>
Normally these two (client_tbl->core_usg[0]->pids and an entry in the process_state hash table) would be totally unrelated data structures and should not affect each other. In any case I cannot understand what is wrong here. Please help.<br>
<br>
cheers,<br>
Georgios Varisteas<br>
<br>
________________________________________<br>
From: Georgios Varisteas [yorgos@kth.se]<br>
Sent: Wednesday, December 07, 2011 00:46<br>
To: barrelfish-users@lists.inf.ethz.ch<br>
Subject: [Barrelfish-users] FW: Memorry allocation weirdness<br>
<br>
Actually what I wrote in the previous email is not totally true. After 12 hours of debugging I got very confused. Please disregard it until I write a more correct and technical version.<br>
<br>
--Georgios<br>
<br>
________________________________________<br>
From: Georgios Varisteas [yorgos@kth.se]<br>
Sent: Wednesday, December 07, 2011 00:31<br>
To: barrelfish-users@lists.inf.ethz.ch<br>
Subject: [Barrelfish-users] Memorry allocation weirdness<br>
<br>
Hello,<br>
<br>
What guarantees does barrelfish provide for memory allocated by applications? Does the kernel clean up the memory when the application terminates? If yes does that extend to all of its domain? And what kind of consistency checks does malloc() provide? Is the
allocated memory fragmented?<br>
<br>
I'm only asking because of some very weird behavior I witness. Let me give the most recent example:<br>
<br>
I have a server client design. I'm also interested for the server to handle multiple instances of applications simultaneously or not.<br>
Let's assume server S on core 0. After it starts I execute client application A1 on core 0 and I wait for it to finish. S of course allocates memory to keep the status of A1. After A1 terminates it signals S which cleans up that memory, aka it calls free()
on the related structures.<br>
Everything looks fine to this point.<br>
Then I start a new instance of the same application, lets call it A2.<br>
A2 will crash with a page fault. If I do not free the memory that S allocates, A2 will NOT crash.<br>
A2 will not crash if I span it to more cores and/or if I start it on a different core.<br>
<br>
I have checked my code character by character and I cannot understand how freeing memory on the Server can cause the client to crash. Especially since the client executes after the free() command on S has finished. My only guess is that I assume free() to work
in a very different way than it does.<br>
<br>
Please shed some light to all of this...<br>
<br>
Best regards,<br>
Georgios<br>
<br>
<br>
_______________________________________________<br>
Barrelfish-users mailing list<br>
Barrelfish-users@lists.inf.ethz.ch<br>
<a href="https://lists.inf.ethz.ch/mailman/listinfo/barrelfish-users">https://lists.inf.ethz.ch/mailman/listinfo/barrelfish-users</a><br>
<br>
_______________________________________________<br>
Barrelfish-users mailing list<br>
Barrelfish-users@lists.inf.ethz.ch<br>
<a href="https://lists.inf.ethz.ch/mailman/listinfo/barrelfish-users">https://lists.inf.ethz.ch/mailman/listinfo/barrelfish-users</a><br>
<br>
_______________________________________________<br>
Barrelfish-users mailing list<br>
Barrelfish-users@lists.inf.ethz.ch<br>
<a href="https://lists.inf.ethz.ch/mailman/listinfo/barrelfish-users">https://lists.inf.ethz.ch/mailman/listinfo/barrelfish-users</a><br>
<br>
</div>
</span></font>
</body>
</html>