%% LyX 1.6.4 created this file.  For more info, see http://www.lyx.org/.
%% Do not edit unless you really know what you are doing.
\documentclass[english]{beamer}
\usepackage[T1]{fontenc}
\usepackage[cp1255]{inputenc}
\usepackage{listings}
\setcounter{secnumdepth}{3}
\setcounter{tocdepth}{3}
\usepackage{url}
\usepackage{graphicx}

\makeatletter

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% LyX specific LaTeX commands.
\newcommand{\noun}[1]{\textsc{#1}}
%% Because html converters don't know tabularnewline
\providecommand{\tabularnewline}{\\}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% Textclass specific LaTeX commands.
 % this default might be overridden by plain title style
 \newcommand\makebeamertitle{\frame{\maketitle}}%
 \AtBeginDocument{
   \let\origtableofcontents=\tableofcontents
   \def\tableofcontents{\@ifnextchar[{\origtableofcontents}{\gobbletableofcontents}}
   \def\gobbletableofcontents#1{\origtableofcontents}
 }
 \makeatletter
 \long\def\lyxframe#1{\@lyxframe#1\@lyxframestop}%
 \def\@lyxframe{\@ifnextchar<{\@@lyxframe}{\@@lyxframe<*>}}%
 \def\@@lyxframe<#1>{\@ifnextchar[{\@@@lyxframe<#1>}{\@@@lyxframe<#1>[]}}
 \def\@@@lyxframe<#1>[{\@ifnextchar<{\@@@@@lyxframe<#1>[}{\@@@@lyxframe<#1>[<*>][}}
 \def\@@@@@lyxframe<#1>[#2]{\@ifnextchar[{\@@@@lyxframe<#1>[#2]}{\@@@@lyxframe<#1>[#2][]}}
 \long\def\@@@@lyxframe<#1>[#2][#3]#4\@lyxframestop#5\lyxframeend{%
   \frame<#1>[#2][#3]{\frametitle{#4}#5}}
 \makeatother
 \def\lyxframeend{} % In case there is a superfluous frame end

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% User specified LaTeX commands.
\usetheme{Copenhagen}
\usepackage{hyperref}
% or ...

%\setbeamercovered{transparent}
% or whatever (possibly just delete it)
%\usepackage{listings}
%\usetheme{Madrid}
%\usepackage{ae,aecompl}

\makeatother

\usepackage{babel}

\begin{document}

\title{Valgrind}


\subtitle{From Magic to Science}


\author{Shachar Raindel }


\institute{The Technion}


\date{Haifux, 2010}

\makebeamertitle

\lyxframeend{}\lyxframe{Outline}

	\tableofcontents[% 
% 		currentsection, % causes all sections but the current to be shown in a semi-transparent way. 
% 		currentsubsection, % causes all subsections but the current subsection in the current section to ... 
% 		hideallsubsections, % causes all subsections to be hidden.
% 		hideothersubsections, % causes the subsections of sections other than the current one to be hidden. 
% 		part=, % part number causes the table of contents of part part number to be shown 		
       pausesections, % causes a \pause command to be issued before each section. This is useful if you 
% 		pausesubsections, %  causes a \pause command to be issued before each subsection. 
% 		sections={ overlay specification }, 
	] 


\lyxframeend{}


\lyxframeend{}\section{Magic - Valgrind at Work}


\lyxframeend{}\subsection{Background}


\lyxframeend{}\lyxframe{Valgrind}
\begin{quote}%{}
{}``Valgrind is an award-winning instrumentation framework for building
dynamic analysis tools'' - Valgrind's front page\end{quote}%{}
\begin{itemize}
\item Mostly known for Memcheck, which pinpoint many common problems in
C/C++ code
\item Extremely useful tool for the novice C/C++ programmer
\item Also useful for experienced ones
\item Similar to Purify, Bounds-Checker, CodeGuard and Insure++
\item Supports X86/Linux, AMD64/Linux, PPC32/Linux, PPC64/Linux and X86/Darwin
(Mac OS X)
\item ARM/Linux and MIPS/Linux ports are in progress, some versions for
{*}BSD
\item Supports wine - test your windows code with Valgrind!
\item Available for X86/Linux since \textasciitilde{}2003, actively developed
\end{itemize}

\lyxframeend{}

\begin{frame}[fragile]
\frametitle{Sample (Bad) Code}
\begin{itemize}
\item We will use the following code for demonstration purposes:\label{frame:codeSample}



\begin{lstlisting}[language=C,numbers=left]
#include <stdio.h>
#include <stdlib.h>
#define SIZE 100
int main() {
    int i, sum = 0;
    int *a = malloc(SIZE);
    for( i=0; i < SIZE; ++i ) sum += a[i];
    a[26] = 1;
    a = NULL;
    if(sum > 0) printf("Hi!\n");
    return 0;
}
\end{lstlisting}


\item Contains many bugs. Compiles without warnings or errors.
\end{itemize}
\end{frame}


\lyxframeend{}\subsection{Live Demo}


\lyxframeend{}\lyxframe{Live Demo}
\begin{itemize}
\item We are going to:

\begin{itemize}
\item compile the code

\begin{quotation}%{}
gcc -Wall -ansi -pedantic -g -o sample sample.c
\end{quotation}%{}
\item run the bare code

\begin{quotation}%{}
./sample
\end{quotation}%{}
\item run the program with valgrind

\begin{quotation}%{}
valgrind $--$leak-check=full ./sample
\end{quotation}%{}
\end{itemize}
\item Results analysis will follow shortly after
\end{itemize}

\lyxframeend{}


\lyxframeend{}\lyxframe{Invalid Reads}
\begin{example}%{}
==8990== Invalid read of size 4

==8990== at 0x804844A: main (\hyperlink{frame:codeSample}{sample.c:7})

==8990== Address 0x417e08c is 0 bytes after a block of size 100 alloc'd 

==8990== at 0x4024C1C: malloc (vg\_replace\_malloc.c:195) 

==8990== by 0x8048430: main (sample.c:6) \end{example}%{}
\begin{itemize}
\item We read past the end of the allocated array
\item Trying to read from area which we are not allowed to access
\item Could result in a SEGFAULT and surely doesn't do what we want
\item Valgrind provides enough details to find the problem.
\end{itemize}

\lyxframeend{}


\lyxframeend{}\lyxframe{Invalid Writes}
\begin{example}%{}
==8990== Invalid write of size 4 

==8990== at 0x8048463: main (\hyperlink{frame:codeSample}{sample.c:8}) 

==8990== Address 0x417e090 is 4 bytes after a block of size 100 alloc'd 

==8990== at 0x4024C1C: malloc (vg\_replace\_malloc.c:195) 

==8990== by 0x8048430: main (sample.c:6) \end{example}%{}
\begin{itemize}
\item Similar to invalid read
\item Details provided by valgrind:

\begin{itemize}
\item Location of fault (addresses, line number if debug-information present)
\item Stack-trace to fault (you can get more using \emph{$--$num$-$callers=30}
)
\item Relevant blocks details and allocation/de-allocation stack-trace
\end{itemize}
\end{itemize}

\lyxframeend{}


\lyxframeend{}\lyxframe{Memory Leaks}
\begin{itemize}
\item At the end of the run, Valgrind does {}``Garbage Collection''
\item Unreferenced memory in C/C++ $\Rightarrow$ memory leak\end{itemize}
\begin{example}%{}
==8990== 100 bytes in 1 blocks are definitely lost in loss record
1 of 1 

==8990== at 0x4024C1C: malloc (vg\_replace\_malloc.c:195) 

==8990== by 0x8048430: main (\hyperlink{frame:codeSample}{sample.c:6}) \end{example}%{}
\begin{itemize}
\item Valgrind provides stack-trace for the allocation point
\item 3 kinds:

\begin{itemize}
\item Definitely lost (no pointers to allocation)
\item Probably lost (pointers only to the middle of the allocation)
\item Still reachable (block hasn't been free'd before exit, but pointers
to it still exists)
\end{itemize}
\end{itemize}

\lyxframeend{}


\lyxframeend{}\lyxframe{Use of Uninitialized Value}
\begin{example}%{}
==8990== Conditional jump or move depends on uninitialised value(s) 

==8990== at 0x8048476: main (\hyperlink{frame:codeSample}{sample.c:10}) \end{example}%{}
\begin{itemize}
\item Valgrind checks and make sure the program flow is deterministic
\item Usage of values which haven't been initialized in conditions is reported
\item Also if they are passed as parameters for syscalls
\item Valgrind will detail location in which the uninitialized data was
used
\item To get trace to the source of it, add {}``\emph{$--$track$-$origins=yes}''
to the command-line
\end{itemize}

\lyxframeend{}


\lyxframeend{}\subsection{Potential Pitfalls}


\lyxframeend{}\lyxframe{Outline}

	\tableofcontents[% 
 		currentsection, % causes all sections but the current to be shown in a semi-transparent way. 
 		currentsubsection, % causes all subsections but the current subsection in the current section to ... 
% 		hideallsubsections, % causes all subsections to be hidden.
% 		hideothersubsections, % causes the subsections of sections other than the current one to be hidden. 
% 		part=, % part number causes the table of contents of part part number to be shown 		
%         pausesections, % causes a \pause command to be issued before each section. This is useful if you 
% 		pausesubsections, %  causes a \pause command to be issued before each subsection. 
% 		sections={ overlay specification }, 
	] 


\lyxframeend{}


\lyxframeend{}\lyxframe{Danger, Will Robinson}
\begin{itemize}
\item \url{http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0166}
\item Most of the time Valgrind's errors describe latent flaws in the program
\item However, sometimes Valgrind is wrong
\item Cryptography related code requires special attention
\item A debian developer commented out code that valgrind didn't like
\item Resulting in a latent bug
\item With massive security implications
\item All because valgrind claimed a value is used uninitialized
\item Was intentionally used so, to collect more entropy
\end{itemize}

\lyxframeend{}

\begin{frame}[fragile]
\label{frame:memcheckLimits}
\frametitle{Problems that Valgrind doesn't Detect}
\begin{itemize}
\item Buffer overflows which ends up accessing valid memory:\end{itemize}
\begin{example}%{}



\begin{lstlisting}
char *p = malloc(1024); /* block 1 */
char *q = malloc(1024); /* block 2 */
p += 1200; /* "p" now points into block 2 */
*p = 'a';  /* invalid write - undetected */ 
\end{lstlisting}


\end{example}%{}
\begin{itemize}
\item Accesses to stack variables and global variables are not checked
\item Business logic/algorithmic problems are not detected
\item Checks only code that was executed
\item Doesn't work well with statically-linked code
\end{itemize}
\end{frame}


\lyxframeend{}\section{More Magic - Advanced Valgrind Usage}


\lyxframeend{}\subsection{Other Tools in Valgrind}


\lyxframeend{}\lyxframe{Outline}

	\tableofcontents[% 
 		currentsection, % causes all sections but the current to be shown in a semi-transparent way. 
 		currentsubsection, % causes all subsections but the current subsection in the current section to ... 
% 		hideallsubsections, % causes all subsections to be hidden.
% 		hideothersubsections, % causes the subsections of sections other than the current one to be hidden. 
% 		part=, % part number causes the table of contents of part part number to be shown 		
%         pausesections, % causes a \pause command to be issued before each section. This is useful if you 
% 		pausesubsections, %  causes a \pause command to be issued before each subsection. 
% 		sections={ overlay specification }, 
	] 


\lyxframeend{}


\lyxframeend{}\lyxframe{Other Tools in Valgrind}
\begin{itemize}
\item We talked about Memcheck -- the default tool in Valgrind
\item But Valgrind can do much more than that
\item Contains many tools, some stable, some experimental
\item You can even write your own tools in few days of work
\item Valgrind ships with the following tools:\end{itemize}
\begin{columns}%{}


\column{140pt}

\setbeamercolor{block title}{bg=orange}
\setbeamercolor{block body}{bg=orange!40}
\begin{block}
{Memory Error Checkers}

\begin{tabular}{ll}
-- Ptrcheck  & -- Memcheck\tabularnewline
\end{tabular}

\end{block}
\setbeamercolor{block title}{bg=brown}
\setbeamercolor{block body}{bg=orange!40}
\begin{block}{Profilers}

\begin{tabular}{ll}
-- Cachegrind & -- Callgrind\tabularnewline
-- Massif & \tabularnewline
\end{tabular}

\end{block}

\column{140pt}

\setbeamercolor{block title}{bg=red}
\setbeamercolor{block body}{bg=orange!40}
\begin{block}
{Thread Error Detectors}

\begin{tabular}{ll}
-- Helgrind & -- DRD\tabularnewline
\end{tabular}

\end{block}
\setbeamercolor{block title}{bg=yellow}
\setbeamercolor{block body}{bg=orange!30}
\begin{block}{Sample Tools and others}

\begin{tabular}{ll}
-- Lackey & -- None\tabularnewline
-- BBV & \tabularnewline
\end{tabular}

\setbeamercolor{block title}{bg=blue}
\setbeamercolor{block body}{bg=blue!30}
\end{block}
\end{columns}%{}

\lyxframeend{}


\lyxframeend{}\lyxframe{Ptrcheck}
\begin{itemize}
\item Activate by adding $--$\emph{tool=exp-ptrcheck}
\item Similar in goals to Memcheck
\item Still experimental
\item Uses very different approach than Memcheck
\item Can detect failures Memcheck doesn't detect (like the code we \hyperlink{frame:memcheckLimits}{\beamergotobutton{saw}}
)
\item Has got false positives (different than the ones Memcheck gets)
\item Slower than Memcheck
\item Doesn't check for memory leakage and validity of accesses
\item Use alongside Memcheck for better coverage
\end{itemize}

\lyxframeend{}


\lyxframeend{}\lyxframe{Profiling Tools}
\begin{itemize}
\item Cachegrind

\begin{itemize}
\item Traces the code memory accesses and jump patterns
\item Simulates a 2-level cache and branch predictor
\item Provide details about cache misses and their source
\item Can help optimizing performance critical code
\end{itemize}
\item Callgrind

\begin{itemize}
\item Extends Cachegrind
\item Propagates the costs along the call-tree
\item Has a KDE front-end -- KCacheGrind
\end{itemize}
\item Massif

\begin{itemize}
\item Memory allocations profiler
\item Keeps stack-trace of every memory allocation/deallocation
\item Print memory usage status in peak times and upon specific intervals
\end{itemize}
\end{itemize}

\lyxframeend{}


\lyxframeend{}\lyxframe{Thread Error Detectors}
\begin{itemize}
\item Functionality similar to Intel's ThreadChecker
\item Detects a variety of threading related problems:

\begin{itemize}
\item Threading API misuse
\item Lock order problems (potential dead-locks)
\item Data-Races
\end{itemize}
\item Two similar implementations in Valgrind

\begin{itemize}
\item Helgrind

\begin{itemize}
\item The Internet claims it produces many false positives
\item Supposedly catches more errors too
\end{itemize}
\item DRD
\end{itemize}
\end{itemize}

\lyxframeend{}


\lyxframeend{}\subsection{Fine Tuning and Client Requests}


\lyxframeend{}\lyxframe{Outline}

	\tableofcontents[% 
 		currentsection, % causes all sections but the current to be shown in a semi-transparent way. 
 		currentsubsection, % causes all subsections but the current subsection in the current section to ... 
% 		hideallsubsections, % causes all subsections to be hidden.
% 		hideothersubsections, % causes the subsections of sections other than the current one to be hidden. 
% 		part=, % part number causes the table of contents of part part number to be shown 		
%         pausesections, % causes a \pause command to be issued before each section. This is useful if you 
% 		pausesubsections, %  causes a \pause command to be issued before each subsection. 
% 		sections={ overlay specification }, 
	] 


\lyxframeend{}


\lyxframeend{}\lyxframe{Client Requests}
\begin{itemize}
\item Valgrind provides communication channel for tested programs
\item Good for unit-test harnesses
\item Also good if you are doing weird stuff in your code

\begin{itemize}
\item A special memory allocator, such as object-pool

\begin{itemize}
\item Use VALGRIND\_CREATE\_MEMPOOL to mark a memory area as an object-pool
\item Use VALGRIND\_MEMPOOL\_ALLOC to mark an object as allocated
\item Use VALGRIND\_MEMPOOL\_FREE to mark an object as free
\end{itemize}
\item Self-Modifying code, i.e. JIT compiler

\begin{itemize}
\item Use VALGRIND\_DISCARD\_TRANSLATIONS to report about areas in which
code has been changed
\end{itemize}
\end{itemize}
\item Useful also for hunting bugs

\begin{itemize}
\item For example, check for memory leaks, using \noun{VALGRIND\_DO\_LEAK\_CHECK}
\end{itemize}
\end{itemize}

\lyxframeend{}


\lyxframeend{}\lyxframe{Suppression Files}
\begin{itemize}
\item Valgrind tends to be very noisy
\item Most of the times it is indicating bugs that should be fixed

\begin{itemize}
\item But not always the one we want to fix right now
\end{itemize}
\item Sometimes it is correct code, which Valgrind failed to understand

\begin{itemize}
\item Mostly in sophisticated/extremely optimized library code
\item Also possible when having unusual interactions with the kernel 
\end{itemize}
\item Valgrind includes a mechanism to silent a specific error

\begin{itemize}
\item Works with all tools that report errors
\item Simple file format, see documentation for details
\item Valgrind includes suppression for many common libs
\end{itemize}
\end{itemize}

\lyxframeend{}


\lyxframeend{}\section{Science - How does Valgrind do that?}


\lyxframeend{}\subsection{The Core - Stuff all Valgrind Tools Share}


\lyxframeend{}\lyxframe{Outline}

	\tableofcontents[% 
 		currentsection, % causes all sections but the current to be shown in a semi-transparent way. 
 		currentsubsection, % causes all subsections but the current subsection in the current section to ... 
% 		hideallsubsections, % causes all subsections to be hidden.
% 		hideothersubsections, % causes the subsections of sections other than the current one to be hidden. 
% 		part=, % part number causes the table of contents of part part number to be shown 		
%         pausesections, % causes a \pause command to be issued before each section. This is useful if you 
% 		pausesubsections, %  causes a \pause command to be issued before each subsection. 
% 		sections={ overlay specification }, 
	] 


\lyxframeend{}


\lyxframeend{}\lyxframe{VEX - Binary Translation}
\begin{itemize}
\item We want to inspect all memory accesses in the code
\item Straight forward solution - CPU emulation
\item But this is really slow
\item Treat the program binary as {}``source-code''
\item Allow the tools to modify the code being compiled
\item VEX's front-end translates X86 opcodes into Intermediate Representation
code
\item VEX's back-end translates IR code back to X86 code
\item Tools can manipulate the IR code in the middle
\end{itemize}

\lyxframeend{}


\lyxframeend{}\lyxframe{IR code}
\begin{itemize}
\item VEX translates each guest opcode into a block of IR code
\item IR code is similar to assembly for a RISC-style machine
\item IR code assumes machine with infinite number of variables
\item The {}``guest state'' is stored in a special memory area\end{itemize}
\begin{exampleblock}
{ IR translation of ``addl \%eax, \%ebx'' }

------ IMark(0x24F275, 7) ------

t3 = GET:I32(0) \# get \%eax, a 32-bit integer 

t2 = GET:I32(12) \# get \%ebx, a 32-bit integer 

t1 = Add32(t3,t2) \# addl 

PUT(0) = t1 \# put \%eax 

\end{exampleblock}

\lyxframeend{}


\lyxframeend{}\lyxframe{IR code - Properties}
\begin{itemize}
\item IR code is fully typed:

\begin{itemize}
\item All variables and results of calculations have type
\item No implicit type conversion
\item VEX performs sanity checks on these types all of the time
\end{itemize}
\item IR code is in a Single Static Assignment form

\begin{itemize}
\item Each variable is assigned only once
\item Simplifies the instrumentation of the code
\item Also simplifies the optimization of the code when running it
\end{itemize}
\item IR code is presented to the tools in semi-parsed form

\begin{itemize}
\item Easy to manipulate lists of instructions
\item Instructions are presented in a convinient data-structure
\item Useful functions for manipulating IR code (add/remove instructions,
etc.)
\end{itemize}
\end{itemize}

\lyxframeend{}


\lyxframeend{}\lyxframe{JIT, VEX and IR}
\begin{itemize}
\item The $X86\rightarrow IR\rightarrow X86$ translation is done in a Just
In Time manner
\item Every basic-block is translated upon its first execution

\begin{definition}%{}
\alert{Basic-Block} - a linear sequence of code, with one entry point,
one exit point and no jump instructions contained within it.
\end{definition}%{}
\item The translation is done so that Valgrind's dispatcher regains control
after each basic-block
\item Caching of translated code blocks improves execution speed
\end{itemize}

\lyxframeend{}\lyxframe{Bootstrap Code}
\begin{itemize}
\item Small, shared launcher - launches the relevant tool 
\item Each tool's binary contains a complete copy of the core code
\item The interesting stuff in bootstrap:

\begin{itemize}
\item Reading the debug information for the target program
\item Initialize VEX - Valgrind's binary-translation mechanism 
\item Call tool-specific init code
\item Load the target program
\item Setup the environment for the target program run
\item Initialize Valgrind's thread-scheduler

\begin{itemize}
\item The scheduler makes sure that only one thread runs at a time
\item Still replicates the entire thread structure to the OS
\item Also handles signals
\end{itemize}
\item Kick-start the {}``guest'' application main thread, using VEX and
Valgrind's dispatcher
\end{itemize}
\end{itemize}

\lyxframeend{}


\lyxframeend{}\lyxframe{Function Call Redirection}
\begin{itemize}
\item Valgrind implements a redirection mechanism
\item This mechanism can {}``hijack'' various function calls
\item Done in the binary translation level
\item Some examples where this ability is useful:

\begin{itemize}
\item Memory allocation functions
\item Various sys-calls (write/read files, etc.)
\item Loading dynamic-link library
\item Replace some optimized functions with debug versions
\end{itemize}
\item The guest code can request that as well

\begin{itemize}
\item Redirect requests are indicated by a specially mangled function name
\item Special {}``magic-sequance'' to call the original function
\item Nice C macros make it developer friendly
\item See documentation for details
\end{itemize}
\end{itemize}

\lyxframeend{}


\lyxframeend{}\lyxframe{Client Requests - Behind the Scenes}
\begin{itemize}
\item The VEX compiler recognizes few magic-sequances
\item The magic-sequances are a no-op when run on normal CPU
\item In X86, the magic-sequance is {}``roll 3, \%edi ; roll 13, \%edi;
roll 29, \%edi ; roll 19, \%edi;''
\item Followed by {}``xchgl \%reg, \%reg'', where reg indicates the kind
of the magic-sequance
\item Similar style request for the other platforms
\item Used to trigger Valgrind's Client Request mechanism
\item On X86, client request param is passed on EAX, result is returned
on EDX
\item Also used for calling functions without the redirects
\item And for getting the original address of a redirected call
\end{itemize}

\lyxframeend{}


\lyxframeend{}\subsection{Memcheck - Behind the Scenes}


\lyxframeend{}\lyxframe{Outline}

	\tableofcontents[% 
 		currentsection, % causes all sections but the current to be shown in a semi-transparent way. 
 		currentsubsection, % causes all subsections but the current subsection in the current section to ... 
% 		hideallsubsections, % causes all subsections to be hidden.
% 		hideothersubsections, % causes the subsections of sections other than the current one to be hidden. 
% 		part=, % part number causes the table of contents of part part number to be shown 		
%         pausesections, % causes a \pause command to be issued before each section. This is useful if you 
% 		pausesubsections, %  causes a \pause command to be issued before each subsection. 
% 		sections={ overlay specification }, 
	] 


\lyxframeend{}


\lyxframeend{}\lyxframe{Memcheck Basics, A-bits}
\begin{itemize}
\item Memcheck tracks what memory the guest application may access
\item Two levels of allowed access:

\begin{itemize}
\item Write to / read from the memory 
\item Use the value in memory for anything serious
\end{itemize}
\item The first one is tracked with {}``A'' bits (Access)

\begin{itemize}
\item One bit per byte of memory
\item Set to 0 if guest is not allowed to access (i.e. free'd block)
\item Set to 1 upon memory allocation
\item Report an error if guest code touched memory with A == 0
\end{itemize}
\end{itemize}

\lyxframeend{}


\lyxframeend{}\lyxframe{V-bits}
\begin{itemize}
\item The second access level is tracked with {}``V'' bits (Valid)

\begin{itemize}
\item One bit per bit of memory
\item Set to 1 if the original memory bit haven't been defined yet
\item Set to zero once the memory bit is set
\item State is transitive

\begin{example}%{}
If $c$ is not defined, evaluating $a=b+c$ will get $a$ to be undefined
too 
\end{example}%{}
\item Reports an error when conditional jumps and syscalls are given undefined
values
\end{itemize}
\end{itemize}

\lyxframeend{}


\lyxframeend{}\lyxframe{Leak Check}
\begin{itemize}
\item Memcheck does leak check in the end of a run of a program
\item It is possible to trigger it through a client request as well
\item Very similar in concept to garbage--collection
\item Chases pointers from globals and stack variables
\item Only considers pointers which are defined (V-bit = 0)
\item If there are no pointers to a block, it is {}``definitely lost''
\item If there are still valid pointers to a block, it is {}``still reachable''
\item If there is a pointer to somewhere in the middle of a block, it is
{}``possibly lost''
\item If the only pointers to a block are from definitely lost blocks, it
is {}``indirectly lost''
\item Valgrind keeps the stack-trace of the allocation point for each block
\end{itemize}

\lyxframeend{}


\lyxframeend{}\subsection{Stuff I use Valgrind for}


\lyxframeend{}\lyxframe{Outline}

	\tableofcontents[% 
 		currentsection, % causes all sections but the current to be shown in a semi-transparent way. 
 		currentsubsection, % causes all subsections but the current subsection in the current section to ... 
% 		hideallsubsections, % causes all subsections to be hidden.
% 		hideothersubsections, % causes the subsections of sections other than the current one to be hidden. 
% 		part=, % part number causes the table of contents of part part number to be shown 		
%         pausesections, % causes a \pause command to be issued before each section. This is useful if you 
% 		pausesubsections, %  causes a \pause command to be issued before each subsection. 
% 		sections={ overlay specification }, 
	] 


\lyxframeend{}


\lyxframeend{}\lyxframe{My Research (So Far)}
\begin{itemize}
\item In my research, I'm looking into memory allocation schemes
\item My claim is that with proper hinting from the application these can
be improved significantly
\item I use valgrind to measure the current situation
\item Attempting to quantify possible improvement
\item A new tool, which I call mtrace
\item Practically merges parts of lackey and of massif
\item Traces all allocations and memory accesses
\item Post-processing scripts for gathering statistics and data
\item Nice plots of memory access patterns in Matlab (next slides)
\end{itemize}

\lyxframeend{}


\lyxframeend{}\lyxframe{Memory Access Patern of Xvnc}

\includegraphics[scale=0.45]{myResearch-bigpic}


\lyxframeend{}


\lyxframeend{}\lyxframe{Memory Access Patern of Xvnc (Detail)}

\includegraphics[scale=0.45]{myResearch-detail}


\lyxframeend{}


\lyxframeend{}\lyxframe{Questions?}

\begin{center}
{\Huge ?}
\par\end{center}{\Huge \par}


\lyxframeend{}
\end{document}
