Java 黑科技——Serviceability Agent

<dependency>    <groupId>jdk</groupId>    <artifactId>sa-jdi</artifactId>    <version>1.8</version></dependency>

struct mm_struct {    struct vm_area_struct * mmap;       //指向虚拟区间(VMA)的链表    struct rb_root mm_rb; /* 指向vma组成的红黑树跟节点 */     //start_code 可执行代码的起始地址     //end_code 可执行代码的最后地址     //start_data已初始化数据的起始地址     //end_data已初始化数据的最后地址    unsigned long start_code, end_code, start_data, end_data;     //start_stack堆的起始位置     //brk堆的当前的最后地址     //用户堆栈的起始地址    unsigned long start_brk, brk, start_stack;    ...

package com.qunar.sa;
/** * Date:Create at 2020/12/16 17:36 * Description:目标进程代码，目的是观察类及对象内存分布， * 主要逻辑： * 1）创建一个Student对象，并调用setId设置id值 * @author zhichao.pan */public class TargetProcess {    public static void main(String[] args) throws Exception{        int id = 1;        Student student = new Student();        student.setId(id);        //为方便通过SA观察结果，睡眠10000000        Thread.sleep(10000000 * 1000);    }    static class Student{        private static int type = 10;        private int id;        public void setId(int id) {            this.id = id;        }        void JITTest1(){            System.out.println(this.id);        }        void JITTest2(){            System.out.println(this.id);        }        void JITTest3(){            System.out.println(this.id);        }    }}

volatile markOop  _mark; //对象头中的mark world union _metadata { //类指针，当JVM工作在64位机器且开启指针压缩之后，则使用的指针为压缩指针   Klass*      _klass;   narrowKlass _compressed_klass; } _metadata; // field addresses in oop void*     field_base(int offset)        const; //实例数据基础方法，每个field在oop中都有一个对应的偏移量（offset），oop通过该偏移量得到该field的地址，再根据地址得到具体数据。...

E:\jdk8u261\bin\java -cp E:\jdk8u261\lib\sa-jdi.jar sun.jvm.hotspot.HSDB

代码片段1：  private:                             // bit no: |31  3|  2  | 1 0 |  unsigned int _counter;               // format: [count|carry|state]

  enum State {    wait_for_nothing,                            // do nothing when count() > limit()    wait_for_compile,                            // introduce nmethod when count() > limit()    number_of_states                             // must be <= state_limit  };

代码片段2：inline void InvocationCounter::decay() {//热度衰减  int c = count();  int new_count = c >> 1;  // prevent from going to zero, to distinguish from never-executed methods  if (c > 0 && new_count == 0) new_count = 1;  set(state(), new_count);}

public class TestSum{        public static void main(String[] args) {            int sum = 0;            for(int i=0 ; i< 100; i++){                sum += i;            }        }}

public static void main(java.lang.String[]);  descriptor: ([Ljava/lang/String;)V  flags: ACC_PUBLIC, ACC_STATIC  Code:    stack=2, locals=3, args_size=1       0: iconst_0             将常量0放到栈顶       1: istore_1             将栈顶的int变量放到本地变量表中索引为1的位置,即将0赋值给sum       2: iconst_0             将常量0放到栈顶       3: istore_2             将栈顶的int变量放到本地变量表中索引为2的位置,即将0赋值给i       4: iload_2              将本地变量表中索引为2的变量放到栈顶，即将i=1放入栈顶       5: bipush        100    将byte类型100放到栈顶       7: if_icmpge     20     会比较栈顶的两个值，如果变量i>=100时会跳转到偏移量是20的指令处,否则继续执行下一条字节码      10: iload_1              将本地变量表中索引为1的变量放到栈顶，即将sum放入栈顶      11: iload_2              将本地变量表中索引为2的变量放到栈顶，即将i放入栈顶      12: iadd                 将栈顶两个元素求和，将结果放入栈顶，即sum+i放入栈顶      13: istore_1             将栈顶的int变量放到本地变量表中索引为1的位置,即将sum+i赋值给sum      14: iinc          2, 1   将本地变量中索引为2的变量自增1，即变量i的自增      17: goto          4      跳转到偏移量是4的指令处      20: return               方法返回

代码片段1：      CASE(_goto):      {          int16_t offset = (int16_t)Bytes::get_Java_u2(pc + 1);          address branch_pc = pc;          UPDATE_PC(offset);          DO_BACKEDGE_CHECKS(offset, branch_pc);          CONTINUE;      }代码片段2：#define DO_BACKEDGE_CHECKS(skip, branch_pc)                                                         \        ...                                                       \        mcs->backedge_counter()->increment();                                                       \回边统计数+1        if (do_OSR) do_OSR = mcs->backedge_counter()->reached_InvocationLimit();                    \判断是否到达回边技术编译阈值        if (do_OSR) {                                                                               \          nmethod*  osr_nmethod;                                                                    \          OSR_REQUEST(osr_nmethod, branch_pc);                                                      \达到阈值则执行提交OSR编译请求          if (osr_nmethod != NULL && osr_nmethod->osr_entry_bci() != InvalidOSREntryBci) {          \            intptr_t* buf = SharedRuntime::OSR_migration_begin(THREAD);                             \            istate->set_msg(do_osr);                                                                \            istate->set_osr_buf((address)buf);                                                      \            istate->set_osr_entry(osr_nmethod->osr_entry());                                        \            return;                                                                                 \          }                                                                                         \        }                                                                                           \      ...                                                                               \    }

package com.qunar.sa;
/** * Date:Create at 2020/12/16 17:36 * Description:目标进程代码，目的是观察方法调用情况 * 主要逻辑： * 1）创建一个Student对象，并调用setId设置id值 * 2）对测试的三个方法执行100、1000、10000次的调用 * @author zhichao.pan */public class TargetProcess {    public static void main(String[] args) throws Exception{        int id = 1;        Student student = new Student();        student.setId(id);        for (int i = 0; i < 100; i++){            student.JITTest1();        }        for (int i = 0; i < 1000; i++){            student.JITTest2();        }        for (int i = 0; i < 100000; i++){            student.JITTest3();        }        //为方便通过SA观察结果，睡眠10000000        Thread.sleep(10000000 * 1000);    }    static class Student{        private static int type = 10;        private int id;        public void setId(int id) {            this.id = id;        }        void JITTest1(){            System.out.println(this.id);        }        void JITTest2(){            System.out.println(this.id);        }        void JITTest3(){            System.out.println(this.id);        }    }}

package com.qunar.sa;......省略import部分代码
/** * Date:Create at 2020/12/16 17:36 * Description:目标进程代码，目的是观察对象内存分布 * 主要逻辑： * 1）创建一个Student对象，并调用setId设置id值 * 2）对测试的三个方法执行100、1000、10000次的调用 * * @author zhichao.pan */public class SAProcess {    public static void main(String[] args) throws ParseException {        int pid = 20408 ;        HotSpotAgent agent = new HotSpotAgent();        //对目标进程执行SA        agent.attach(pid);
        try {            final Set<MethodDefinition> methodResult = new HashSet<>();            VM.getVM().getSystemDictionary().allClassesDo(new InvocationCounterVisitor(methodResult));            System.out.println("SA遍历方法执行信息：" + JacksonSupport.toJson(methodResult));            final Set<MethodDefinition> compiledMethodResult = new HashSet<>();            VM.getVM().getCodeCache().iterate(new CompiledMethodVisitor(compiledMethodResult));            System.out.println("SA遍历热编译数据:" + JacksonSupport.toJson(compiledMethodResult));        } finally {            //释放SA            agent.detach();        }    }
    //SA获取方法调用数据    static class InvocationCounterVisitor implements SystemDictionary.ClassVisitor {        private final Set<MethodDefinition> result;        public InvocationCounterVisitor(Set<MethodDefinition> result) {            this.result = result;        }        @Override        public void visit(Klass klass) {            final String klassName = klass.getName().asString();//类全限定名            if (klassName.contains("Student")) { //此处只关注目标进程的Student类                final MethodArray methods = ((InstanceKlass) klass).getMethods();//该类下的方法                for (int i = 0; i < methods.length(); i++) {                    final Method method = methods.at(i);                    long invocationCount = method.getInvocationCount(); //遍历获取执行次出                    //这个操作很关键，上面介绍过这个点：_counter包括三部分：                    // 第3-31位表示执行次数，第2位表示是否已被编译1为编译，第0位和第1位表示超出阈值时的处理，默认情况为01即超出阈值执行编译                    // 右移三位的目的是统计出执行次数信息                    invocationCount = invocationCount >> 3;                    result.add(                            new MethodDefinition(klassName, method.getName().asString(),                                    method.getSignature().asString(),                                    invocationCount));                }            }        }    }
    //SA获取已被JIT编译的类及方法信息    static class CompiledMethodVisitor implements CodeCacheVisitor {        private final Set<MethodDefinition> result;        @Override        public void visit(CodeBlob codeBlob) {//codeBlob为jit编译后的代码在内存中的对象表示            final NMethod nMethod = codeBlob.asNMethodOrNull();            if(nMethod == null ) return;            final Method method = nMethod.getMethod();            final String className = method.getMethodHolder().getName().asString();//类名            final String name = method.getName().asString();//方法名            final String signature = method.getSignature().asString();//方法参数            long invocationCount = method.getInvocationCount();//调用次数            //右移三位的目的同InvocationCounterVisitor            invocationCount = invocationCount >> 3;            if(className.contains("Student")){                result.add(new MethodDefinition(StringUtils.replace(className, "/", "."), name,                        SignatureUtils.convertToSourceType(signature), invocationCount));            }        }        @Override        public void epilogue() {        }        public CompiledMethodVisitor(Set<MethodDefinition> result) {            this.result = result;        }        @Override        public void prologue(Address address, Address address1) {        }    }
   static class MethodDefinition {        public String className;//类名        public String methodName;//方法名        public String parameters;//方法参数        public long invocationCount;//方法调用次数
        public MethodDefinition(String className, String methodName, String parameters, long invocationCount) {            this.className = className;            this.methodName = methodName;            this.parameters = parameters;            this.invocationCount = invocationCount;        }    }}

SA遍历方法执行信息：[    {        "className":"com/qunar/sa/TargetProcess$Student",        "methodName":"<init>",        "parameters":"()V",        "invocationCount":1    },    {        "className":"com/qunar/sa/TargetProcess$Student",        "methodName":"JITTest1",        "parameters":"()V",        "invocationCount":100    },    {        "className":"com/qunar/sa/TargetProcess$Student",        "methodName":"JITTest3",        "parameters":"()V",        "invocationCount":275    },    {        "className":"com/qunar/sa/TargetProcess$Student",        "methodName":"JITTest2",        "parameters":"()V",        "invocationCount":512    },    {        "className":"com/qunar/sa/TargetProcess$Student",        "methodName":"setId",        "parameters":"(I)V",        "invocationCount":1    }]SA遍历热编译数据:[    {        "className":"com.qunar.sa.TargetProcess$Student",        "methodName":"JITTest3",        "parameters":"",        "invocationCount":275    },    {        "className":"com.qunar.sa.TargetProcess$Student",        "methodName":"JITTest2",        "parameters":"",        "invocationCount":512    }]

/* * This class is the main class for the JMap utility. It parses its arguments * and decides if the command should be satisfied using the VM attach mechanism * or an SA tool. At this time the only option that uses the VM attach mechanism * is the -dump option to get a heap dump of a running application. All other * options are mapped to SA tools. */public class JMap {    // Options handled by the attach mechanism    private static String HISTO_OPTION = "-histo";    private static String LIVE_HISTO_OPTION = "-histo:live";    private static String DUMP_OPTION_PREFIX = "-dump:";
    // These options imply the use of a SA tool    private static String SA_TOOL_OPTIONS =      "-heap|-heap:format=b|-clstats|-finalizerinfo";
    // The -F (force) option is currently not passed through to SA    private static String FORCE_SA_OPTION = "-F";

7f4dfc945000-7f4dfd603000 r-xp 00000000 fc:07 1183253                    /home/q/java/jdk1.8.0_60/jre/lib/amd64/server/libJVM.so7f4dfd603000-7f4dfd802000 ---p 00cbe000 fc:07 1183253                    /home/q/java/jdk1.8.0_60/jre/lib/amd64/server/libJVM.so7f4dfd802000-7f4dfd8da000 rw-p 00cbd000 fc:07 1183253                    /home/q/java/jdk1.8.0_60/jre/lib/amd64/server/libJVM.so

struct vm_area_struct {    struct mm_struct * vm_mm;   /* 属于地址空间 */    unsigned long vm_start;     /* 开始地址（虚拟） */    unsigned long vm_end;       /* 结束地址（虚拟）*/    struct vm_area_struct *vm_next;/* linked list of VM areas per task, sorted by address */    pgprvm_page_ot;     /* Access permissions of this VMA. */    unsigned long vm_flags;     /* Flags, listed below. */... 此处省略部分源码    struct file * vm_file;      /* 该vma映射的文件 */};

示例代码：class SystemDictionary {  // Hashtable holding loaded classes.  static Dictionary*            _dictionary;    VMStructEntry和VMTypeEntry结构体中的注释以上面示例代码作为分析对象：typedef struct {  const char* typeName;            // 当前变量所属的类名称，如SystemDictionary  const char* fieldName;           // 当前变量名称，如_dictionary  const char* typeString;          // 当前变量类型名称，如Dictionary  int32_t  isStatic;               // 当前变量是否为静态变量，如 是  uint64_t offset;                 // 当前变量在所属对象的偏移量，仅用于非静态变量，下方示例代码中该字段无意义  void* address;                   // 当前变量所在的虚拟地址，仅用于静态变量，如 0000000000f8c4e8为该变量所在的绝对地址} VMStructEntry; typedef struct {  const char* typeName;            // 当前类型类名称，如SystemDictionary  const char* superclassName;      // 当前类型父类名称，如果没有父类，则为null  int32_t isOopType;               // 当前类型是否是否是一个对象类型  int32_t isIntegerType;           // 当前类型是否是否是一个Integer类型  int32_t isUnsigned;              // 当前类型如果是一个Integer类型，是否无符号数  uint64_t size;                   // 当前类型占用字节数} VMTypeEntry;

注释1：// NOTE: there is an interdependency between this file and// HotSpotTypeDataBase.java, which parses the type strings.  注释2：// This list enumerates all of the fields the serviceability agent// needs to know about. 代码：      static_field(SystemDictionary,            _dictionary,                                   Dictionary*)                          \      ...

private static synchronized void initialize(TypeDataBase db) {//db即为sun.JVM.hotspot.HotSpotTypeDataBase  Type type = db.lookupType("SystemDictionary"); dictionaryField = type.getAddressField("_dictionary");