-
Notifications
You must be signed in to change notification settings - Fork 5.8k
8307478: Implementation of Prepare to Restrict The Dynamic Loading of Agents #13899
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
👋 Welcome back alanb! A progress list of the required criteria for merging this PR into |
@AlanBateman The following labels will be automatically applied to this pull request:
When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing lists. If you would like to change these labels, use the /label pull request command. |
/label remove build |
@AlanBateman |
@AlanBateman |
@AlanBateman Unknown command |
@AlanBateman Unknown command |
/label add hotspot-runtime |
@AlanBateman |
@AlanBateman |
Webrevs
|
Mailing list message from Remi Forax on serviceability-dev: ----- Original Message -----
I believe the flag should mention that what is traced is just the dynamic instrumentation, static instrumentation is not an issue, R?mi |
Mailing list message from Alan Bateman on serviceability-dev: On 11/05/2023 14:28, Remi Forax wrote:
There is static, load-time, and dynamic instrumentation. The Or maybe you mean how the agent is deployed? The opt-in tracing right -Alan |
Mailing list message from forax at univ-mlv.fr on serviceability-dev: ----- Original Message -----
yes !
R?mi |
src/java.instrument/share/classes/sun/instrument/InstrumentationImpl.java
Outdated
Show resolved
Hide resolved
Thanks for bringing this up. The question is whether dynamically loading the same agent library N times is treated as one or N agents. Similarly, if an agent library is specified on the command line, then later the same agent is dynamically loaded and started in the running VM, is it the same agent or not? Right now, they are treated as different agents, they may have different agent options, they accumulate in the "agent list", each load/start generates a JFR event, and with the changes here, emit a warning. I think we'll need to think a bit more about that scenario as the notion of agent identity doesn't surface in the API docs (the library address or canonical path to the agent library or JAR file might do). I agree it could be annoying to have multiple warnings if the profiler is attaching and loading the same agent library many times. |
Mailing list message from Kirk Pepperdine on serviceability-dev: Hi Andrei,
Call me dumb.. but? I would have the say that the most puzzling piece of this entire JEP/proposal is that I?m failing to make the connect between how an agent is loaded and how that strengthens integrity. I keep re-reading this JEP looking for clues but I keep bumping my head again? "Giving free reign to tools would imply giving free reign to libraries, which is tantamount to giving up on integrity by default.?. IMO, this is a false equivalency that is not supported by any other point in the document. IOWs, there is nothing in this document that is giving me a clue as to how turning off dynamic attach improves integrity when I can achieve the same effects with a direct attach. What I do know is that turning off dynamic attach by default will cause grief to those that already having to cope with exceptionally complex deployment. I would argue that the complexity of these deployments have dramatically increased since 2017. Do we really want to add to that complexity or should we be refocusing on adding features that help to reduce that complexity. Kind regards, -------------- next part -------------- |
I've updated the changes to allow it be implementation specific as to whether a warning is printed when attempting to start the same agent a second or subsequent time. I need to sync up with Ron/Alex on this point to see if the description in the JEP needs to say anything on this. For now, attempting to start a JVM TI agent that was previously loaded will not print a warning. We could potentially do the same for Java agents. |
@AlanBateman This change now passes all automated pre-integration checks. ℹ️ This project also has non-automated pre-integration requirements. Please see the file CONTRIBUTING.md for details. After integration, the commit message for the final commit will be:
You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed. At the time when this comment was updated there had been 14 new commits pushed to the
As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details. ➡️ To integrate this PR with the above commit message to the |
Mailing list message from Ron Pressler on serviceability-dev:
You can?t find the answer to your question in 451 because we factored out the motivation for 451 (and several other integrated and future JEPs) into the informational JEP, https://openjdk.org/jeps/8305968, which you must read to understand the motivation. In short, the goal is integrity *by default*, which means that what we seek not an end to ?superpowers" but the explicit granting of superpowers on the command line. The problem is not superpowers, but superpowers that *are not explicitly acknowledged by the application*. Agents loaded at startup have always been explicitly acknowledged by the application, while those loaded after startup have not. The goal is to make them explicitly acknowledged, not ?turned off?, and then you get the same for both ways of loading agents: the application explicitly grants superpowers in both situations. We want the capabilities offered by agents, and we want the application to be able to track them.
As the informational JEP explains, not having integrity BY DEFAULT, causes grief too. Do or don?t, someone gets grief. Given that the vast majority of Java programs never require or want agents ? attached dynamically or otherwise ? given that many current uses of dynamically loaded agents are better served by agents loaded at startup, and given that we have adding a command line flag on the one hand vs not having integrity by default that makes it impossible for applications to know the ?map? of their codebase (see the informational JEP), we believe that, when integrated over the entire ecosystem, more grief is caused by not restricting dynamically loaded agents than by restricting it. ? Ron |
Mailing list message from Kirk Pepperdine on serviceability-dev: Hi Ron, Thank you for the response. I?d read the JEP you?ve linked also.From what I?ve been able to discern, this change will affect a small majority of our customers as it will change how they deploy observability and diagnostics. I?ve spoken to the some of the product owners and they feel that this represents a one-off pain point that they can adjust to. The principal CS that have to deal directly with helping customers deploy had a completely different view point on the subject. As I sift through the noise the filter I?m applying is that I?m generally more interested in easing customer concerns over engineering ones. I?ve read the relevant JEPs several times and I believe I understand the arguments being forth. I?m sorry but I just don?t agree that on by default dynamic loading of an agent has any connection to better code integrity. As someone who had to sit through 2 days of meetings trying to get a call to System.gc() that was happening every 2 minutes resulting in system failures turned off by setting a flag I can tell you that getting an agent dynamically loaded into a runtime isn?t easy to being with. While this experience may seem extreme, it is more common than you?d imagine. As such it is my opinion that this JEP that seems to have more importance to engineers than end users/customers. More over, I feel that it is inflicting an unnecessary change to deployments that is adding to complexity rather than easing it. Other than that, I don?t feel I have anything more of use to add to the conversation except thank you for answering my questions. Kind regards,
|
test/jdk/com/sun/tools/attach/warnings/DynamicLoadWarningTest.java
Outdated
Show resolved
Hide resolved
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The update looks good to me.
Posted one nit though.
Thanks,
Serguei
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The update looks good.
Thanks,
Serguei
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Except for the possible addition of some comments regarding what is meant by "loaded", the changes look good.
/integrate |
Going to push as commit 5bd2af2.
Your commit was automatically rebased without conflicts. |
@AlanBateman Pushed as commit 5bd2af2. 💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored. |
This is the implementation for JEP 451. There are two parts to this:
A multi-line warning is printed when a JVM TI or Java agent is loaded into a running VM. For JVM TI, the message is printed to stderr from JvmtiAgent::load. For Java agents, it is printed to System.err (as that may be redirected) in the JPLIS (j.l.instrumentation) implementation. This part includes an update to the JVM TI spec and API docs to require the warning.
If running with -Djdk.instrument.traceUsage or -Djdk.instrument.traceUsage=true, the calls to the Instrumentation API print a trace message and stack trace.
Testing: tier1-6
Progress
Issues
Reviewers
Reviewing
Using
git
Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk.git pull/13899/head:pull/13899
$ git checkout pull/13899
Update a local copy of the PR:
$ git checkout pull/13899
$ git pull https://git.openjdk.org/jdk.git pull/13899/head
Using Skara CLI tools
Checkout this PR locally:
$ git pr checkout 13899
View PR using the GUI difftool:
$ git pr show -t 13899
Using diff file
Download this PR as a diff file:
https://git.openjdk.org/jdk/pull/13899.diff
Webrev
Link to Webrev Comment