My Unsafe - Unsafe Interceptor, Native Memory Leak Tracker and Access Checker on the JVM MySafe intercepts (instruments) sun.misc.Unsafe calls and keeps records of allocated memories. So it can give the allocated memory informations, detect the invalid memory accesses and find origins of native memory leaks.

1. MYSAFE
github.com/serkan-ozal/mysafe
SERKAN ÖZAL

2. AGENDA
● WHAT IS MYSAFE?
● MOTIVATION
● STATE OF ART
● HOW TO USE?
● FEATURES & DEMO
● ROADMAP

3. WHAT IS MYSAFE?
● Intercepts “sun.misc.Unsafe” calls
● Can track memory allocations and frees
● Can track memory accesses (reads/writes)
● Can align memory accesses (reads/writes)
● Can track custom memory allocations/frees
○ Ex. your custom memory manager implementation
● Can track memory allocation paths
○ Find the origins of leaked (non-free) memories

4. MOTIVATION
● Debugging memory allocations and frees
○ Checking native memory leaks over “Unsafe”
○ Detecting causes of native memory leaks
● Debugging memory accesses (reads/writes)
○ Finding the causes of illegal memory accesses
● Handle unaligned memory accesses (causes SIGBUS)
○ SPARC
○ ...

5. STATE OF ART
● Inspect application classes while loading
○ At “ClassFileTransformer” level
○ At “Classloader” level
● Redirect “Unsafe” calls to MySafe
● MySafe handles the call
● Proceeds to “Unsafe”

6. WHY NOT JUST INST. UNSAFE?
● Use “java.lang.Instrument#setNativeMethodPrefix”
● Add new wrapper methods for native methods
● Requires new method addition
● So class redefinition is not an option
● Hook into “Unsafe” classloading process
● “Unsafe” is already loaded before
○ Java agent
○ User classloader
● Use native JVMTI agent at startup (on the roadmap)

7. HOW TO USE?
● Java Agent Based Usage by VM Argument
○ -javaagent:<path_to_jillegal_agent><jillegal_agent_jar>=
"-p tr.com.serkanozal.mysafe.impl.processor.MySafeProcessor".
● Java Agent Based Usage Programmatically
○ MySafe.youAreMine();
● ClassLoader Based Usage by VM Argument
○ -Djava.system.class.loader=
tr.com.serkanozal.mysafe.impl.classloader.MySafeClassLoader

8. FEATURES & DEMO
● Memory Explorer API & Demo
● Memory Listener API & Demo
● Illegal Memory Access Listener API & Demo
● Custom Memory Management & Demo
● Tracing Allocation Path & Demo

9. Memory Explorer API
● Iterate on allocated memories
● Dump allocated memories
● MemoryExplorerDemo.java

10. Memory Listener API
● Be notified before/after allocate
● Be notified before/after reallocate
● Be notified before/after free
● MemoryListenerDemo.java

11. Illegal Mem. Acc. Listener API
● Be notified on illegal memory accesses (reads/writes)
● Be notified on un-allocated memory reallocations/frees
● Throws “IllegalArgumentException”
● IllegalMemoryAccessListenerDemo.java

12. Custom Memory Management
● Tracks custom memory mng. points instead of “Unsafe”
● Memory management points refers to methods which
○ allocate
○ reallocate
○ free
● Custom memory mng. points can be configured by:
○ @AllocationPoint
○ @FreePoint
○ @ReallocationPoint
● CustomMemoryManagementDemo.java

13. Tracing Allocation Path
● Alloc. path = stack trace of caller which allocates memory
● Dump active allocation paths
● Generate diagram of active allocation paths
● Alloc. paths are provided via “AllocPathManager” API
○ Instrumentation based (currently in use)
■ Pros: Very fast, low CPU and GC overhead
■ Cons: Not detailed, might be trashed
○ Java 9’s StackWalker API based (on the roadmap)
■ Pros: Detailed, no need to be trashed
■ Cons: Not fast as much as Inst. based one
● NativeMemoryLeakHuntingDemo.java

15. Inst. Based Alloc. Path Manager
● Identify each method which exist in the any alloc. path
● Inject code into methods to provide them as alloc. path
○ Push method identifier to thread-local call stack
○ Proceed actual call
○ Pop method identifier from thread-local call stack
● Generate alloc. path id from alloc. point (method) ids
○ Each alloc. point id is 2 bytes short number
○ Whole alloc. path is represented with 8 bytes long number
○ There can be at most 4 alloc. points, old ones are evicted

16. foo1 [1]
1

17. foo1 [1]
bar1 [2]
1 2

18. foo1 [1]
bar1 [2]
foo2 [3]
1 2 3

19. foo1 [1]
bar1 [2]
foo2 [3]
bar2 [4]
1 2 3 4

20. foo1 [1]
bar1 [2]
foo2 [3]
bar2 [4]
foo3 [5]
2 3 4 5

21. foo1 [1]
bar1 [2]
foo2 [3]
bar2 [4]
foo3 [5]
bar3 [6]
3 4 5 6

22. foo1 [1]
bar1 [2]
foo2 [3]
bar2 [4]
foo3 [5]
bar3 [6]
malloc
3 4 5 6
foo2 => bar2 => foo3 => bar3

23. ROADMAP
● Ability to track line numbers also
● More detailed and accurate allocation path detection
● Ability to inspect “Unsafe” directly
● Java 9 support
● Allocation path detection via Java 9’s StackWalker API
● Flame graph support

24. THANKS