Patent Publication Number: US-8122454-B2

Title: Managing memory resources in a shared memory system

Description:
RELATED APPLICATIONS 
     This application is a continuation of U.S. patent application Ser. No. 10/383,302 filed Mar. 6, 2003, now issued as U.S. Pat. No. 7,370,327, which claims priority to United Kingdom patent application number 0229670.5 filed Dec. 19, 2002. This continuation claims benefit of the earlier filing date of U.S. patent application Ser. No. 10/383,302 under 35 U.S.C. §120. 
    
    
     BACKGROUND 
     The inventive subject matter relates to shared memory systems and particularly (though not exclusively) to shared usage of memory resources by many remote users. 
     It is known that in a JVM shared by many remote users, anyone of the users could individually exhaust all the memory available to the JVM. The JVM itself imposes limits on the memory usage by all users of that JVM. These limits are imposed by specifying a maximum heap size limit. 
     A ‘garbage collector’ analyses the live memory within the heap by starting from a set of root references on the stacks (in global references such as class statics) and by proceeding to mark all objects thus referenced. 
     However, this approach has the disadvantage(s) that the single JVM limit constrains all the potential users of a multi-user JVM to the same level and makes it possible for one user to mount a denial of service attack simply by over-consuming memory. 
     The techniques used by garbage collection to mark the live memory are effective but are not sufficient to identify the objects created by a given user and thus determine which user or users are over-consuming memory. 
     One possible solution to this problem would be to define the concept of an ‘Isolate’ which can be given some set of resources and allowed to consume them until it fails. If the isolate is implemented as a separate JVM then the scale of any resultant damage can be obviously limited. However, defining multiple ‘isolates’ would lead to poor utilization of resources since each isolate must be allowed to grow individually to the resource limits. 
     SUMMARY 
     Embodiments include a machine-readable media having instructions stored therein executable by a set of one or more processors. When the instructions are executed, the set of one or more processors detect a monitoring event that indicates use of a shared memory by an executing one of a plurality of users should be analyzed. The set of processors identify a principal object that represents the executing user, and identify a set of objects related to the identified principal object. The set of objects represent at least one of an active connection of the executing user and an active thread of the executing user. The set of one or more processors quantify with the identified principal object and the identified set of objects an amount of the shared memory owned by the executing user. The set of one or more processors constrain use of the shared memory by the executing user based on the quantified amount of the shared memory owned by the executing user. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
       Embodiments will now be described, by way of example only, with reference to the accompanying drawings, in which: 
         FIG. 1  shows a block schematic diagram illustrating steps of a method for memory allocation in a shared memory system. 
         FIG. 2  shows an illustrative block diagram showing objects identified by the method of  FIG. 1 . 
     
    
    
     DESCRIPTION OF EMBODIMENTS 
     Referring to  FIG. 1 , there is shown an illustrative flow chart of the steps involved in limiting memory consumed by a given user. These steps are implemented in a software environment (hereafter referred to as a ‘container’). At box  10 , the identification of the point at which to constrain memory is performed. The ideal point is just prior to a heap growth event but this is not easy to implement in practice. 
     Three possible methods for achieving the function of box  10  are described below. The first involves periodically sampling the value of Runtime.totalMemory( ) and imposing the constraint when it reaches a pre-determined value. The second involves creating a WeakReference which will be queued after a garbage collection cycle in which the heap was expanded. The third alternative is to employ a monitoring event from JVMPI (JVM Performance Interface) or the newly proposed tools interface (JVMTI) to provide an indication that the garbage collector has just done something. 
     The monitoring event would ideally be a ‘heap growth’ event but in the worst case the simple ‘garbage collection’ event would suffice. 
     When that event is generated, Runtime.totalMemory and Runtime.freeMemory would be sampled in order to determine if the JVM is approaching a point at which further analysis of memory usage should be undertaken. 
     In this way, when it becomes necessary to constrain memory, the next step  20  is performed, namely the identification of a first or principal object pertaining to the currently executing user. This is performed using well known techniques. In essence there will exist a set of principal objects representing individual users. These principal objects facilitate the location of all session objects representing active connections which the user may have and also objects representing any active threads which the user has been allowed to create. 
     Typically it is preferable that users do not create threads but that their processing requirements are met using message receive methods of session or conversation objects. 
     In box  30 , a reflection procedure is invoked to find the closure of objects referenced from that principal object. At the first level this will be the set of session objects which represent the connections through which the user is driving work into the JVM. During the identification of this set of objects it is necessary to verify that anyone any one identified object: 
     A) has not already been identified as part of the set; 
     B) has not been assigned to public or other fields in classes which are not directly owned by the user; and, 
     C) is not an instance of one of the container implementation classes, possibly the container itself. 
     These exceptions are illustrated by box  35 . If any of the above conditions are true, the object must be omitted from the set. 
     Case A) above is relatively easy to prevent by maintaining a record of previously identified set members. 
     Case C) is handled by abandoning the trace at that point once this situation has been detected. 
     For Case B), an embodiment leaves untraced any Container implementation classes which the user is intended to extend as part of the user&#39;s implementation and which may contain references to objects not primarily associated with the user. In addition the classfile modification techniques would be employed to prevent the user assigning objects which are personal to the user into static fields of Container or J2SE (Java 2 Standard Edition) classes and 10 thus ‘hiding’ such data from this tracing step. 
     Referring now also to  FIG. 2 , there is shown an illustrative block diagram showing a number of objects relating to a user. A principal object  100  which has a base class inheritance represents the user. ‘X’  105  is an untraced reference from the base class field of the object  100 . This is because references from the base class fields are not traced. 
     Objects  110  and  120  also have base class inheritances, and these are found from tracing the non-base class references of the principal object  100 . 25 ‘X’s  115  and  125  respectively are untraced references from the base class fields of the objects  110  and  120  respectively. 
     Objects  130  and  140  are objects traced via the non-base class references of objects  110  and  120  respectively. Object  150  is a global object and is therefore untraced (shown by ‘X’  135 ). 
     Objects  160  and  170  are multiply traced, object  160  being referenced by objects  130  and  140  respectively, and object  170  being referenced by objects  120  and  140  respectively. This is why it is important for a record to be kept of traced objects, so that no object is counted more than once. 
     By the above means each of the objects relating to the user are identified, and referring again to  FIG. 1 , at box  40 , the sum of the memory owned (used) by the user is quantified from these identified objects. 
     At box  50 , the imposition of resource limits is then selected. The memory usage by the user may be constrained either by terminating incoming sessions from the user or stopping threads running on behalf of the user. 
     Finally, at box  60 , the selected constraint is applied to the user. 
     There are two further problems to handle: threads which may be associated with the user and requests for large amounts of memory. If a user requests a large piece of memory then the above checks may not help. The memory subsystem will be handed the request (for example, for a huge array of long bytes with 2**31 elements). It will attempt to run a garbage collection event but in general the task will fail and it will be forced to give up with an OutOfMemoryError which will be potentially caught by the user code and retried leading to a tight CPU consuming loop; in other words a denial of service opportunity. To avoid this situation it is assumed that the JVM will itself be able to impose limits on the size of large objects allocated by the current thread. This limit will be defined by putting a new method setObjectSizeLimit (long bytes) on a thread sub-class which will prevent the creation of large objects which would otherwise cause this problem. It would also be possible to have the JVM impose some arbitrary limit on all threads in this environment. At the very least a user is prevented from turning this situation into a way to consume endless CPU catching out of memory errors and thus mounting a denial of service attack. 
     If threads are permitted to be associated with a user then the above checks will not suffice since the user can simply define some local variables in the thread and reference any amount of memory from them. In this situation a way is found to either trace these local variables or to make these threads leave their run method during the tracing. The first option will imply the introduction of another new method on the thread sub-class, such as: 
     int findLocalReferences(Object[ ] refs); 
     Such a method would suffice and would be a native method. Obviously that technique requires some involvement from the JVM and is thus not appropriate for a class which will be used with a standard J2SE implementation. 
     A second option is to impose some limit on the length of time a run method can execute. Any thread which fails to complete within that limit could simply be stopped using Thread.stop. Typically all the users threads would be stopped if any of them caused such a problem. 
     Also it should be ensured that threads are not stopped whilst in the process of making updates to shared resources. This model would effectively force the user to break the work into small pieces and pass it from thread to thread until completion. If this method is chosen then it could be optimised for use within the JVM by maintaining a thread pool and using it to drive the successive run methods. The user&#39;s work can be stopped at any point by simply avoiding calling the run methods of the user&#39;s thread objects until after the memory scan is complete. This whole approach makes no change to standard Java syntax but obviously changes the semantics of the run method to include the statement ‘must not run for more than X ms’. It is worth noting that, providing the threads are fairly well behaved and don&#39;t consume large amounts of memory, the JVM heap will stay below some threshold value and none of the checking mentioned so far will be done. 
     Hence for well behaved users the overhead will be zero. The likely outcome is that badly behaved code or users will be quickly identified and prevented from running at all. The intent of all this work is to find a way to identify such ‘rogues’ and a way to deal with them once found. 
     In this way substantially all of the extant objects created by a given user are identified, and a limit is placed both on the number of objects and on the total size. The result will define something akin to a ‘flexible isolate’ in that there will be no need to decide once and for all what the resource limits for a given isolate should be; they can be varied during the lifetime of the JVM as policies change. 
     The memory used by individual users can be tracked and constrained without having to place all the work from individual users into separate JVMs. The net effect is that the ‘bursty’ nature of memory consumption by multiple users can be summed to result in a JVM which exhibits much less bursty memory requirements while at the same time allowing individual users to have relatively relaxed constraints. 
     It will be appreciated by a person skilled in the art that alternative embodiments to those described above are possible. For example the embodiment above relates to a JVM, but other embodiments suitable for other shared memory systems are contemplated, in which objects and processes associated with those systems would be utilised instead of the JVM objects and processes described above.