linux-kernel - Debugging COW (copy on write) memory after fork: Is it possible to dump only the private anonymous memory of a process?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <515E9F0C.1000204@biovista.com>
Date:	Fri, 05 Apr 2013 12:53:16 +0300
From:	Vassilis Virvilis <v.virvilis@...vista.com>
To:	linux-kernel@...r.kernel.org
Subject: Debugging COW (copy on write) memory after fork: Is it possible to
 dump only the private anonymous memory of a process?

Hello, sorry if this is off topic. Just point me to the right direction. 
Please cc me also in the reply.

Question
--------

Is it possible to dump only the private anonymous memory of a process?

Background
----------

I have a process where it reads and it initializes a large portion of 
the memory (around 2.3GB). This memory is effectively read only from 
that point and on. After the initialization I fork the process to 
several children in order to take advantage of the multicore 
architecture of modern cpus. The problem is that finally the program 
ends up requiring number_of_process * 2.3GB memory effectively entering 
swap thrashing and destroying the performance.

Steps so far
------------

The first thing I did is to monitor the memory. I found about 
/proc/$pid/smaps and the http://wingolog.org/pub/mem_usage.py.

What happens is the following

     The program starts reads from disk and has 2.3GB of private mappings
     The program forks. Immediately the 2.3GB become shared mapping 
between the parent and the child. Excellent so far.
     As the time goes and the child starts performing its tasks the 
shared memory is slowly migrating to the private mappings of each 
process effectively blowing up the memory requirements.

I thought that if I could see (dump) the private mappings of each 
process I could see from the data why the shared mappings are being 
touched so I tried to dump the core with gcore and by playing with 
/proc/$pid/coredump_filter like this

echo 0x1 > /proc/$pid/coredump_filter
gcore $pid

Unfortunately it always dumps 2.3GB despite the setting in 
/proc/$pid/coredump_filter which says private anonymous mappings.

I have researched the question in google.

I even posted it in stack overflow.

Any other ideas?

Thanks in advance

	Vassilis Virvilis

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/