MemTracker: An accelerator for memory debugging and monitoring

ABSTRACT

Memory bugs are a broad class of bugs that is becoming increasingly common with increasing software complexity, and many of these bugs are also security vulnerabilities. Existing software and hardware approaches for finding and identifying memory bugs have a number of drawbacks including considerable performance overheads, target only a specific type of bug, implementation cost, and inefficient use of computational resources.

This article describes MemTracker, a new hardware support mechanism that can be configured to perform different kinds of memory access monitoring tasks. MemTracker associates each word of data in memory with a few bits of state, and uses a programmable state transition table to react to different events that can affect this state. The number of state bits per word, the events to which MemTracker reacts, and the transition table are all fully programmable. MemTracker's rich set of states, events, and transitions can be used to implement different monitoring and debugging checkers with minimal performance overheads, even when frequent state updates are needed. To evaluate MemTracker, we map three different checkers onto it, as well as a checker that combines all three. For the most demanding (combined) checker with 8 bits state per memory word, we observe performance overheads of only around 3%, on average, and 14.5% worst-case across different benchmark suites. Such low overheads allow continuous (always-on) use of MemTracker-enabled checkers, even in production runs.

REFERENCES

• 1: Periklis Akritidis , Cristian Cadar , Costin Raiciu , Manuel Costa , Miguel Castro, Preventing Memory Error Exploits with WIT, Proceedings of the 2008 IEEE Symposium on Security and Privacy, p.263-277, May 18-21, 2008 [doi>10.1109/SP.2008.30]
• 2: Boletta, J. 2002. Security Focus Newsletter #172. http://citadelle.intrinsec.com/mailing/current/HTML/ml_securityfocus_news/0067.html.
• 3: Shimin Chen , Michael Kozuch , Theodoros Strigkos , Babak Falsafi , Phillip B. Gibbons , Todd C. Mowry , Vijaya Ramachandran , Olatunji Ruwase , Michael Ryan , Evangelos Vlachos, Flexible Hardware Acceleration for Instruction-Grain Program Monitoring, Proceedings of the 35th International Symposium on Computer Architecture, p.377-388, June 21-25, 2008
• 4: Marc L. Corliss , E. Christopher Lewis , Amir Roth, DISE: a programmable macro engine for customizing applications, Proceedings of the 30th annual international symposium on Computer architecture, June 09-11, 2003, San Diego, California
• 5: Crispin Cowan , Calton Pu , Dave Maier , Heather Hintony , Jonathan Walpole , Peat Bakke , Steve Beattie , Aaron Grier , Perry Wagle , Qian Zhang, StackGuard: automatic adaptive detection and prevention of buffer-overflow attacks, Proceedings of the 7th conference on USENIX Security Symposium, p.5-5, January 26-29, 1998, San Antonio, Texas
• 6: Jedidiah R. Crandall , Frederic T. Chong, Minos: Control Data Attack Prevention Orthogonal to Memory Model, Proceedings of the 37th annual IEEE/ACM International Symposium on Microarchitecture, p.221-232, December 04-08, 2004, Portland, Oregon [doi>10.1109/MICRO.2004.26]
• 7: Joe Devietti , Colin Blundell , Milo M. K. Martin , Steve Zdancewic, Hardbound: architectural support for spatial safety of the C programming language, ACM SIGARCH Computer Architecture News, v.36 n.1, March 2008
• 8: Hinton, G., Sager, D., Upton, M., Boggs, D., Carmean, D., Kyker, A., and Roussel, P. 2001. The micro-architecture of the Pentium 4 Processor. Intel. Tech. J. First Quarter.
• 9: IBM Corporation. 2005. IBM Rational Purify. http://www.ibm.com/software/awdtools/purify/.
• 10: Jouppi, N. P. et al. 2006. Cacti 4.2. http://quid.hpl.hp.com:9081/cacti/
• 11: J. T. Kuehn , B. J. Smith, The horizon supercomputing system: architecture and software, Proceedings of the 1988 ACM/IEEE conference on Supercomputing, p.28-34, November 12-17, 1988, Orlando, Florida, United States
• 12: McDonald, R. G., Burger, D., and Keckler, S. 2005. The design and implementation of the TRIPS prototype chip. http://www.hotchips.org/archives/hc17.
• 13: Nicholas Nethercote , Julian Seward, How to shadow every byte of memory used by a program, Proceedings of the 3rd international conference on Virtual execution environments, June 13-15, 2007, San Diego, California, USA [doi>10.1145/1254810.1254820]
• 14: Newsome, J. and Song, D. 2005. Dynamic taint analysis for automatic detection, analysis, and signature generation of exploits on commodity software. In Proceedings of the 12th Annual Network and Distributed System Security Symposium (NDSS). Internet Society.
• 15: Feng Qin , Shan Lu , Yuanyuan Zhou, SafeMem: Exploiting ECC-Memory for Detecting Memory Leaks and Memory Corruption During Production Runs, Proceedings of the 11th International Symposium on High-Performance Computer Architecture, p.291-302, February 12-16, 2005 [doi>10.1109/HPCA.2005.29]
• 16: Feng Qin , Cheng Wang , Zhenmin Li , Ho-seop Kim , Yuanyuan Zhou , Youfeng Wu, LIFT: A Low-Overhead Practical Information Flow Tracking System for Detecting Security Attacks, Proceedings of the 39th Annual IEEE/ACM International Symposium on Microarchitecture, p.135-148, December 09-13, 2006 [doi>10.1109/MICRO.2006.29]
• 17: Renau, J. et al. 2006. SESC. http://sesc.sourceforge.net.
• 18: Seward, J. 2004. Valgrind: An open-source memory debugger for 86-GNU/Linux. http://valgrind.kde.org/.
• 19: R. Shetty , M. Kharbutli , Y. Solihin , M. Prvulovic, HeapMon: a helper-thread approach to programmable, automatic, and low-overhead memory bug detection, IBM Journal of Research and Development, v.50 n.2/3, p.261-275, March 2006 [doi>10.1147/rd.502.0261]
• 20: Weidong Shi , Chenghuai Lu , Hsien-Hsin S. Lee, Memory-Centric Security Architecture, Transactions on High-Performance Embedded Architectures and Compilers I, Springer-Verlag, Berlin, Heidelberg, 2007 [doi>10.1007/978-3-540-71528-3_7]
• 21: SPEC. 2006. Standard performance evaluation corporation benchmarks. http://www.spec.org.
• 22: G. Edward Suh , Jae W. Lee , David Zhang , Srinivas Devadas, Secure program execution via dynamic information flow tracking, Proceedings of the 11th international conference on Architectural support for programming languages and operating systems, October 07-13, 2004, Boston, MA, USA
• 23: Symantec. 2002. Microsoft IIS HTR chunked encoding heap overflow allows arbitrary code. http://securityresponse.symantec.com/avcenter/security/Content/2033.html.
• 24: US-CERT. 2001. FedCIRC Advisory FA-2001-19 “code red” worm exploiting buffer overflow in IIS indexing service DLL. http://www.us-cert.gov/federal/archive/advisories/FA-2001-19.html.
• 25: US-CERT. 2004. Buffer overflow in Microsoft Internet Explorer. http://www.us-cert.gov/cas/techalerts/TA04315A.html.
• 26: Valgrind Developers. 2005. The Valgrind Quick Start Guide. http://valgrind.org/docs/manual/quickstart.html.
• 27: Venkataramani, G., Doudalis, I., Solihin, Y., and Prvulovic, M. 2008. Flexitaint: A programmable accelerator for dynamic taint propagation. In Proceedings of the IEEE 14th International Symposium on High-performance Computer Architecture (HPCA'08). IEEE Computer Society, 173--184.
• 28: Guru Venkataramani , Brandyn Roemer , Yan Solihin , Milos Prvulovic, MemTracker: Efficient and Programmable Support for Memory Access Monitoring and Debugging, Proceedings of the 2007 IEEE 13th International Symposium on High Performance Computer Architecture, p.273-284, February 10-14, 2007 [doi>10.1109/HPCA.2007.346205]
• 29: Emmett Witchel , Josh Cates , Krste Asanović, Mondrian memory protection, Proceedings of the 10th international conference on Architectural support for programming languages and operating systems, October 05-09, 2002, San Jose, California
• 30: Steven Cameron Woo , Moriyoshi Ohara , Evan Torrie , Jaswinder Pal Singh , Anoop Gupta, The SPLASH-2 programs: characterization and methodological considerations, Proceedings of the 22nd annual international symposium on Computer architecture, p.24-36, June 22-24, 1995, S. Margherita Ligure, Italy
• 31: Pin Zhou , Wei Liu , Long Fei , Shan Lu , Feng Qin , Yuanyuan Zhou , Samuel Midkiff , Josep Torrellas, AccMon: Automatically Detecting Memory-Related Bugs via Program Counter-Based Invariants, Proceedings of the 37th annual IEEE/ACM International Symposium on Microarchitecture, p.269-280, December 04-08, 2004, Portland, Oregon [doi>10.1109/MICRO.2004.3]
• 32: Pin Zhou , Feng Qin , Wei Liu , Yuanyuan Zhou , Josep Torrellas, iWatcher: Efficient Architectural Support for Software Debugging, Proceedings of the 31st annual international symposium on Computer architecture, p.224, June 19-23, 2004, München, Germany
• 33: Yuanyuan Zhou , Pin Zhou , Feng Qin , Wei Liu , Josep Torrellas, Efficient and flexible architectural support for dynamic monitoring, ACM Transactions on Architecture and Code Optimization (TACO), v.2 n.1, p.3-33, March 2005 [doi>10.1145/1061267.1061269]

INDEX TERMS

Primary Classification:
  C. Computer Systems Organization
  C.1 PROCESSOR ARCHITECTURES

General Terms:
Design, Performance, Reliability

Keywords:
Accelerator, debugging, memory access monitoring