Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

Java Debuggers: A Peek Under the Hood [JavaOne 2016 CON1503]

presentation video: https://www.youtube.com/watch?v=buUkXFx9ao8

Ever wonder how the JVM “knows” how to stop at the breakpoint you set? Curious about how the various debug flags affect your application? This session examines the HotSpot’s support for debugging Java code (JVMTI and related APIs) and takes a deep dive into the implementations of some of the more interesting features used by debuggers, profilers, and other tools.

  • Login to see the comments

Java Debuggers: A Peek Under the Hood [JavaOne 2016 CON1503]

  1. 1. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | Java Debuggers A Peek Under the Hood David Buck Principal Member of Technical Staff Java SE Sustaining Engineering September, 2016
  2. 2. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | Safe Harbor Statement The following is intended to outline our general product direction. It is intended for information purposes only, and may not be incorporated into any contract. It is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decisions. The development, release, and timing of any features or functionality described for Oracle’s products remains at the sole discretion of Oracle. 4
  3. 3. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | About Me David Buck • Java SE Sustaining Engineering • Mostly JRockit fixes • OpenJDK 8 Updates Project Maintainer • Hobbies: Programming 5
  4. 4. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | Program Agenda Introduction Java Platform Debug Architecture Java Debug Wire Protocol JVM Tool Interface Wrap-up 1 2 3 4 5 6
  5. 5. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | Introduction 7
  6. 6. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | The Elephant in the Room 8
  7. 7. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | • 2 JavaOne Debugger “under the hood talks” this year 9 The Elephant in the Room By Peter H. Wrege (Own work) [CC BY-SA 3.0 (http://creativecommons.org/licenses/by-sa/3.0) or GFDL (http://www.gnu.org/copyleft/fdl.html)], via Wikimedia Commons
  8. 8. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | • 2 JavaOne Debugger “under the hood talks” this year • Martin’s talk is really good! 10 The Elephant in the Room By Peter H. Wrege (Own work) [CC BY-SA 3.0 (http://creativecommons.org/licenses/by-sa/3.0) or GFDL (http://www.gnu.org/copyleft/fdl.html)], via Wikimedia Commons
  9. 9. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | 11 Buck’s Talk Martin’s talk
  10. 10. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | 12 JVM TI JDWP JDI
  11. 11. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | 13 JVM TI JDWP JDI
  12. 12. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | • Both talks needed for full picture • Video and slides from a past version of Martin’s talk are available online • No particular order to the content 14 JDI AKA Martin’s Talk
  13. 13. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | 15 JDI JVM TI JDWP
  14. 14. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | 16 JDI? JVM TI? JDWP?
  15. 15. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | 17 JDI? JVM TI? JDWP? Java Platform Debugger Architecture
  16. 16. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | Java Platform Debugger Architecture 18
  17. 17. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | Java Platform Debugger Architecture • Facilitate writing a debugger in Java • Impact Debuggee application as little as possible • Allow native-level / in-process tooling 19
  18. 18. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | Heisenbugs Bug Heisenberg Heisenbug picture: Bundesarchiv, Bild 183-R57262 / Unknown / CC-BY-SA 3.0 [CC BY-SA 3.0 de (http://creativecommons.org/licenses/by-sa/3.0/de/deed.en)]
  19. 19. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | Observer Effect picture: Christian Schirm (Own work) [CC0]
  20. 20. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | • Debugging, at the same level of abstraction (Java), in the same process, will cause problems – Stop-the-world – debugger heap overhead 22 Strange Loop Problems Picture By Maurizio Codogno, it:Utente:.mau. (Own work) [GFDL (http://www.gnu.org/copyleft/fdl.html), CC-BY-SA-3.0 (http://creativecommons.org/licenses/by-sa/3.0/) or CC BY 2.5 (http://creativecommons.org/licenses/by/2.5)], via Wikimedia Commons
  21. 21. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | Java Platform Debugger Architecture • Facilitate writing a debugger in Java – Java API • Impact Debuggee application as little as possible – Out-of-process debugger • Allow native-level / in-process tooling – Native in-process debugger 23
  22. 22. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | 24 Java vs. Native
  23. 23. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | 25 In-process vs. Out-of-process
  24. 24. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | 26 Why not both?
  25. 25. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | 27 By Libertinus (http://www.flickr.com/photos/libertinus/5807760586) [CC BY-SA 2.0 (http://creativecommons.org/licenses/by-sa/2.0)], via Wikimedia Commons
  26. 26. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | Java Platform Debugger Architecture 28 Target JVM Debugger JVM Events JDI Debugger Target Application (Debuggee) JVM TI Agent JDWP
  27. 27. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | Java Platform Debugger Architecture • Since Java 1.3 • Modular design • 3 components – JVM Tool Interface – Java Debug Wire Protocol – Java Debug Interface 29
  28. 28. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | Java Platform Debugger Architecture 30 Target JVM Debugger JVM JDI Debugger Target Application (Debuggee) JVM TI Agent JDWP Commands Events
  29. 29. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | Java Platform Debugger Architecture 31 Target JVM Debugger JVM JDI Debugger Target Application (Debuggee) JVM DI Agent JDWP Commands Events
  30. 30. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | Java Platform Debugger Architecture 32 Target JVM Native Debugger Tool Target Application (Debuggee) JVM TI Agent JDWP Commands Events
  31. 31. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | Java Platform Debugger Architecture 33 Target JVM Debugger JVM JDI Debugger Target Application (Debuggee) JVM TI Agent JDWP Commands Events
  32. 32. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | Java Platform Debugger Architecture 34 Target JVM Target Application (Debuggee) JVM TI Agent
  33. 33. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | Java Platform Debugger Architecture 35 Target JVM Debugger JVM JDI Debugger Target Application (Debuggee) JVM TI Agent JDWP Commands Events
  34. 34. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | Java Platform Debugger Architecture 36 Target JVM Debugger JVM JDI JShell Target Application (Debuggee) JVM TI Agent JDWP Commands Events
  35. 35. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | Java Debug Interface (JDI) • Reference implementation lives in – tools.jar (JDK 6/7/8) – jdk.jdi module (JDK 9) • Pure Java implementation • “speaks” JDWP on behalf of Java client code 37
  36. 36. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | Java Debug Wire Protocol 38
  37. 37. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | Java Debug Wire Protocol (JDWP) • Binary protocol between target JVM and debugger processes • Does not specify transport • Asynchronous • Tailored to JDI 39
  38. 38. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | Java Debug Wire Protocol 40 Target JVM Debugger JVM JDI Debugger Target Application (Debuggee) JVM TI Agent JDWP Commands Events
  39. 39. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | Java Debug Wire Protocol 41 Target JVM Debugger Target Application (Debuggee) JDWP Commands Events
  40. 40. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | JDWP Handshake 42 Target JVM Debugger Target Application (Debuggee)
  41. 41. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | JDWP Handshake 43 Target JVM Debugger Target Application (Debuggee) JDWP- Handshake
  42. 42. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | JDWP Handshake 44 Target JVM Debugger Target Application (Debuggee) JDWP- Handshake
  43. 43. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | JDWP Java Debug Wire Protocol 45 Target JVM Debugger Target Application (Debuggee)
  44. 44. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | Java Debug Wire Protocol • All Packets have 11 byte header • Some packets have data – Optional – Variable length 46 Header Data
  45. 45. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | • Command • Reply 47 JDWP Packets Length ID Flags Command set Command Data (optional, variable length) Length ID Flags Error Code Data (optional, variable length)
  46. 46. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | JDWP Header Fields • length (4 bytes) • id (4 bytes) • flags (1 byte) • command set (1 byte) • command (1 byte) • error code (2 bytes) 48
  47. 47. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | JDWP Length Field • 32-bit value • Size of entire packet in bytes (including header) • Up to a 4GB packet size! 49
  48. 48. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | JDWP ID Field • 32-bit value • Only used to match command and reply packets • Each “direction” (debugger <-> target) has it’s own ID-space • Over 4 billion in flight packets per direction 50
  49. 49. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | JDWP Flags Field • 8-bit value (but only one bit currently used) • Only used to distinguish between Command / Reply packets – 0x80 == Reply Packet – 0x00 == Command Packet • Additional flags may be added in the future 51
  50. 50. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | JDWP Command Fields • Only in command packets • Command Set Field – 8 bit – Each set corresponds to a JDI class • 0 - 63 debugger -> target VM • 64 - 127 target VM -> debugger • 128 - 256 Vendor-defined • Command Field – 8 bit – Each command corresponds to a JDI method 52
  51. 51. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | JDWP Error Code Field • 16 bit value • Only in reply packets 53
  52. 52. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | JDWP Data • Variable size • Optional • Examples: – Requested field ID (command) – Requested field vale (reply) 54
  53. 53. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | JDWP Commands 55
  54. 54. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | What about transport?! • In practice, this somewhat couples debugger / debuggee • Socket transport – All Oracle JDK supported platforms – Supports remote debugging – JVM TI agent currently only support IPv4 • Shared memory transport – Only on Windows • Service provider interface available for implementing your own transport / connectors 56
  55. 55. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | Security Implications of JDWP • Zero Authentication • JDWP access == Remote Code Execution • As of yesterday www.shodan.io reports two IP sending JDWP handshake • Many more are passively waiting for incoming connections 57
  56. 56. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | JVM Tool Interface 58
  57. 57. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | • JVM Debug Interface (JVM DI) • JDK 1.1 ~ JDK 1.5 JVM Profiler Interface (JVM PI) • JDK 1.1 ~ JDK 1.5 • Never officially supported • Stability issues (esp. with HS) • Hard to use with JNI • Very invasive – Not all GC supported – Performance impact 59 A Tail of Two APIs
  58. 58. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | • JVM Debug Interface (JVM DI) • JDK 1.1 ~ JDK 1.5 JVM Profiler Interface (JVM PI) • JDK 1.1 ~ JDK 1.5 • Never officially supported • Stability issues (esp. with HS) • Hard to use with JNI • Very invasive – Not all GC supported – Performance impact 60 A Tail of Two APIs
  59. 59. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | JVM Tool Interface (JVM TI) • Introduced in JDK 5 • Replaced – JVM PI (Removed in JDK 6) – JVM DI (Removed in JDK 6) • Many use cases outside of JPDA • Fully supported • Pay-as-you-go performance impact • Based on JNI 61
  60. 60. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | JVM TI Agents • Native code that runs in JVM’s address space • Multiple concurrent agents supported • Can be – Statically linked into JVM – Loaded at startup – Loaded during runtime • Can take command line arguments -agentlib:<agent_lib_name>=<name1>[=<value1>],<name2>[=<value2>]... 62
  61. 61. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | Native Agent • JVM TI • Command line options: – agentlib – agentpath Java Agent • java.lang.instrument • Comand line option: – javaagent 63 A note about “agents”
  62. 62. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | Native Agent • JVM TI • Command line options: – agentlib – agentpath Java Agent • java.lang.instrument • Comand line option: – javaagent 64 A note about “agents”
  63. 63. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | Java Platform Debugger Architecture 65 Target JVM Debugger JVM JDI Debugger Target Application (Debuggee) JVM TI Agent JDWP Commands Events
  64. 64. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | Java Platform Debugger Architecture 66 Target JVM Debugger JVM JDI Debugger Target Application (Debuggee) JVM TI Agent JDWP Commands Events libjdwp.so jdwp.dll libjdwp.dylib
  65. 65. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | JVM TI based on Java Native Interface • JVM TI Callbacks have JNI environment pointer • Very hard to make a useful JVM TI agent without JNI calls • JNI data types used (e.g. jint, jdouble) • Same “modified UTF-8” for strings • Not simply an extension of JNI, many important differences 67
  66. 66. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | Java Native Interface 68
  67. 67. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | Java Native Interface jdouble Java_pkg_Cls_f__ILjava_lang_String_2 (JNIEnv *env, jobject obj, jint i, jstring s) { const char *str = (*env)->GetStringUTFChars(env, s, 0); ... (*env)->ReleaseStringUTFChars(env, s, str); return ... } 69
  68. 68. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | Java Native Interface jdouble Java_pkg_Cls_f__ILjava_lang_String_2 (JNIEnv *env, jobject obj, jint i, jstring s) { const char *str = (*env)->GetStringUTFChars(env, s, 0); ... (*env)->ReleaseStringUTFChars(env, s, str); return ... } 70
  69. 69. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | JVM TI Environment • event callbacks • enabled events • enabled capabilities • memory allocation/deallocation hooks 71
  70. 70. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | JVM TI Created dynamically and works across threads JNI One environment per thread 72 JVM TI Environment vs. JNI Environment
  71. 71. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | Capabilities • Flags that represent JVM TI functionality • Allows “negotiation” between agent and JVM – Lets agent tell JVM what it needs – Lets JVM tell agent what it supports 73 Picture: David Monniaux / Mai-Linh Doan (GFDL / cc-by-sa-2.0-fr)
  72. 72. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | • Only “pay” for the features you want / use • Can be set dynamically – Some can only be enabled before startup • 2 levels of cost – Enabling – Using 74 Capabilities Picture: David Monniaux / Mai-Linh Doan (GFDL / cc-by-sa-2.0-fr)
  73. 73. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | Bytecode Insertion (BCI) • Many JVM PI use-cases replaced by BCI in JVM TI • Instrumentation at the bytecode level is automatically compatible with all JVM technologies. – Allows instrumented code to be JIT-compiled – Use any GC collector 75
  74. 74. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | JVM TI Agent Lifecycle • Initialize – Agent_OnLoad() – Agent_OnAttach() • Probe / request capabilities • Set callback functions • Enable events • Process events via callbacks • Shutdown on Agent_OnUnload() 76
  75. 75. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | JVM TI Example • Agent_OnLoad() – Setup global data for agent’s private use – Probe/request capabilities – Modify JRE environment – Set callback functions – Enable few events, including VMInit • VMInit callback – Enable rest of events • Process events via callbacks • Cleanup on Agent_OnUnload() 77
  76. 76. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | Peaking under the hood of JVM TI: 78 -XX:TraceJVMTI
  77. 77. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | Peaking under the hood of JVM TI: 79 -XX:TraceJVMTI XX:TraceJVMTI= desc {, desc } ...
  78. 78. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | Peaking under the hood of JVM TI: 80 -XX:TraceJVMTI XX:TraceJVMTI= desc {, desc } ... domain action kind
  79. 79. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | Peaking under the hood of JVM TI: 81 -XX:TraceJVMTI XX:TraceJVMTI= desc {, desc } ... domain action kind name a particular function or event name all all functions and events func all major functions allfunc all functions event all events ec event controller
  80. 80. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | Peaking under the hood of JVM TI: 82 -XX:TraceJVMTI XX:TraceJVMTI= desc {, desc } ... domain action kind + add - remove
  81. 81. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | Peaking under the hood of JVM TI: 83 -XX:TraceJVMTI XX:TraceJVMTI= desc {, desc } ... domain action kind i input parameters e error returns o output t event triggered (posted) s event sent
  82. 82. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | Full Speed Debugging 84
  83. 83. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | Full Speed Debugging 85 • 1.4.0 with client (c1) JIT compiler • 1.4.1 with both client (c1) and server (c2) JIT compilers
  84. 84. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | Full Speed Debugging 86 O RLY? By pe_ha45 - originally posted to Flickr as Snowy Owl - Schnee-Eule, CC BY 2.0, https://commons.wikimedia.org/w/index.php?curid=11400326
  85. 85. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | Full Speed Debugging Depends on your definition of “Full Speed”… Pre-1.4: -Xdebug == -Xint 87 By Charles Homler - Own work, CC BY 3.0, https://commons.wikimedia.org/w/index.php?curid=29896748
  86. 86. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | Required can_access_local_variables can_generate_single_step_events can_generate_exception_events can_generate_frame_pop_events can_generate_breakpoint_events can_suspend can_generate_method_entry_events can_generate_method_exit_events can_generate_garbage_collection_events can_maintain_original_method_order can_generate_monitor_events can_tag_objects can_get_source_debug_extension can_get_source_file_name can_get_line_numbers Optional can_force_early_return can_force_early_return can_generate_field_modification_events can_generate_field_access_events can_get_bytecodes can_get_synthetic_attribute can_get_owned_monitor_info can_get_current_contended_monitor can_get_monitor_info can_pop_frame can_redefine_classes can_redefine_any_class can_get_owned_monitor_stack_depth_info can_get_constant_pool can_signal_thread 88 Capabilities Used by JDWP Agent
  87. 87. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | Full Speed Debugging • Only methods with breakpoints are required to be interpreted • But JVM TI capabilities used by jdwp agent do have a cost 89
  88. 88. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | Full Speed Debugging • Only methods with breakpoints are required to be interpreted • But JVM TI capabilities used by jdwp agent do have a cost • Usually not a noticeable impact, but YMMV. There is no free lunch. 90
  89. 89. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | Wrap-up 91
  90. 90. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | Takeaways • These APIs are – Stable – Officially supported – Very flexible • There are limitless new tools you can write and still a lot of room for new ideas • Not simply for debugging 92
  91. 91. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | Resources [ Martin Skarsaune’s JDI talk ] video: https://www.youtube.com/watch?v=lNR4bEzYaH4 slides: https://prezi.com/ahspfg2wdkwt/jvm-debugging-under-the-hood-jdays/ [ JDWP Connection and Invocation Details ] https://docs.oracle.com/javase/8/docs/technotes/guides/jpda/conninv.html [ JDWP Specification ] https://docs.oracle.com/javase/8/docs/technotes/guides/jpda/jdwp-spec.html [ JVM TI Specification ] https://docs.oracle.com/javase/8/docs/platform/jvmti/jvmti.html [ Kelly O'Hair's Weblog ] Use the search tool to find posts about “jvmti” https://blogs.oracle.com/kto/ 93
  92. 92. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | 94 Thank You!
  93. 93. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | Safe Harbor Statement The preceding is intended to outline our general product direction. It is intended for information purposes only, and may not be incorporated into any contract. It is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decisions. The development, release, and timing of any features or functionality described for Oracle’s products remains at the sole discretion of Oracle. 95
  94. 94. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | 96

×