虚拟机解释器与bytecode对接
2019-07-05 23:27 chen.simon 阅读(557) 评论(0) 编辑 收藏 举报心头一直有个疑问，jvm虚拟是如何对接class中的字节码的？或者说在未进入
JIT优化阶段时，解释器是如何对接的？
大概阐述
hotspot通过C++代码在堆上申请一块空间，向里面填充一组指令，然后把这块空间当成一个函数，通过函数指针去调用刚生成的代码。是不是666，是不是哇超酷毙了。
关键代码
generate_call_stub
address generate_call_stub(address& return_address) { // TODO: 需要一路仔细调试 c++方法 返回无符号char
assert((int)frame::entry_frame_after_call_words == -(int)rsp_after_call_off + 1 &&
(int)frame::entry_frame_call_wrapper_offset == (int)call_wrapper_off,
"adjust this code");
StubCodeMark mark(this, "StubRoutines", "call_stub");
// address start = __ pc(); // SimonNote: 这个方法最终返回的就是这个start 宏展开 ： _masm->pc()
address start = _masm-> pc(); // SimonNote: _code_section 的end 是pc() 也是此处的start
// same as in generate_catch_exception()!
const Address rsp_after_call(rbp, rsp_after_call_off * wordSize); // 这些adress都是准备工作 真正在内存区域生成汇编指令的事情是在下面的做的
const Address call_wrapper (rbp, call_wrapper_off * wordSize);
const Address result (rbp, result_off * wordSize);
const Address result_type (rbp, result_type_off * wordSize);
const Address method (rbp, method_off * wordSize);
const Address entry_point (rbp, entry_point_off * wordSize);
const Address parameters (rbp, parameters_off * wordSize);
const Address parameter_size(rbp, parameter_size_off * wordSize);
// same as in generate_catch_exception()!
const Address thread (rbp, thread_off * wordSize);
const Address r15_save(rbp, r15_off * wordSize);
const Address r14_save(rbp, r14_off * wordSize);
const Address r13_save(rbp, r13_off * wordSize);
const Address r12_save(rbp, r12_off * wordSize);
const Address rbx_save(rbp, rbx_off * wordSize);
// stub code
__ enter(); //SimonNote: macroAssembler_x86.cpp MacroAssembler::enter() push(rbp); mov(rbp, rsp); 真正在内存区域生成汇编指令！其实就是把指令等opcode写入内存区域
__ subptr(rsp, -rsp_after_call_off * wordSize);
// save register parameters
#ifndef _WIN64
__ movptr(parameters, c_rarg5); // parameters
__ movptr(entry_point, c_rarg4); // entry_point
#endif
__ movptr(method, c_rarg3); // method
__ movl(result_type, c_rarg2); // result type
__ movptr(result, c_rarg1); // result
__ movptr(call_wrapper, c_rarg0); // call wrapper
// save regs belonging to calling function
__ movptr(rbx_save, rbx);
__ movptr(r12_save, r12);
__ movptr(r13_save, r13);
__ movptr(r14_save, r14);
__ movptr(r15_save, r15);
#ifdef _WIN64
for (int i = 6; i <= 15; i++) {
__ movdqu(xmm_save(i), as_XMMRegister(i));
}
const Address rdi_save(rbp, rdi_off * wordSize);
const Address rsi_save(rbp, rsi_off * wordSize);
__ movptr(rsi_save, rsi);
__ movptr(rdi_save, rdi);
#else
const Address mxcsr_save(rbp, mxcsr_off * wordSize);
{
Label skip_ldmx;
__ stmxcsr(mxcsr_save);
__ movl(rax, mxcsr_save);
__ andl(rax, MXCSR_MASK); // Only check control and mask bits
ExternalAddress mxcsr_std(StubRoutines::addr_mxcsr_std());
__ cmp32(rax, mxcsr_std);
__ jcc(Assembler::equal, skip_ldmx);
__ ldmxcsr(mxcsr_std);
__ bind(skip_ldmx);
}
#endif
// Load up thread register
__ movptr(r15_thread, thread);
__ reinit_heapbase();
#ifdef ASSERT
// make sure we have no pending exceptions
{
Label L;
__ cmpptr(Address(r15_thread, Thread::pending_exception_offset()), (int32_t)NULL_WORD);
__ jcc(Assembler::equal, L);
__ stop("StubRoutines::call_stub: entered with pending exception");
__ bind(L);
}
#endif
// pass parameters if any
BLOCK_COMMENT("pass parameters if any");
Label parameters_done;
__ movl(c_rarg3, parameter_size);
__ testl(c_rarg3, c_rarg3);
__ jcc(Assembler::zero, parameters_done);
Label loop;
__ movptr(c_rarg2, parameters); // parameter pointer
__ movl(c_rarg1, c_rarg3); // parameter counter is in c_rarg1
__ BIND(loop);
__ movptr(rax, Address(c_rarg2, 0));// get parameter
__ addptr(c_rarg2, wordSize); // advance to next parameter
__ decrementl(c_rarg1); // decrement counter
__ push(rax); // pass parameter
__ jcc(Assembler::notZero, loop);
// call Java function
__ BIND(parameters_done);
__ movptr(rbx, method); // get Method*
__ movptr(c_rarg1, entry_point); // get entry_point
__ mov(r13, rsp); // set sender sp
BLOCK_COMMENT("call Java function");
__ call(c_rarg1);
BLOCK_COMMENT("call_stub_return_address:");
return_address = __ pc();
// store result depending on type (everything that is not
// T_OBJECT, T_LONG, T_FLOAT or T_DOUBLE is treated as T_INT)
__ movptr(c_rarg0, result);
Label is_long, is_float, is_double, exit;
__ movl(c_rarg1, result_type);
__ cmpl(c_rarg1, T_OBJECT);
__ jcc(Assembler::equal, is_long);
__ cmpl(c_rarg1, T_LONG);
__ jcc(Assembler::equal, is_long);
__ cmpl(c_rarg1, T_FLOAT);
__ jcc(Assembler::equal, is_float);
__ cmpl(c_rarg1, T_DOUBLE);
__ jcc(Assembler::equal, is_double);
// handle T_INT case
__ movl(Address(c_rarg0, 0), rax);
__ BIND(exit);
// pop parameters
__ lea(rsp, rsp_after_call);
#ifdef ASSERT
// verify that threads correspond
{
Label L, S;
__ cmpptr(r15_thread, thread);
__ jcc(Assembler::notEqual, S);
__ get_thread(rbx);
__ cmpptr(r15_thread, rbx);
__ jcc(Assembler::equal, L);
__ bind(S);
__ jcc(Assembler::equal, L);
__ stop("StubRoutines::call_stub: threads must correspond");
__ bind(L);
}
#endif
// restore regs belonging to calling function
#ifdef _WIN64
for (int i = 15; i >= 6; i--) {
__ movdqu(as_XMMRegister(i), xmm_save(i));
}
#endif
__ movptr(r15, r15_save);
__ movptr(r14, r14_save);
__ movptr(r13, r13_save);
__ movptr(r12, r12_save);
__ movptr(rbx, rbx_save);
#ifdef _WIN64
__ movptr(rdi, rdi_save);
__ movptr(rsi, rsi_save);
#else
__ ldmxcsr(mxcsr_save);
#endif
// restore rsp
__ addptr(rsp, -rsp_after_call_off * wordSize);
// return
__ pop(rbp);
__ ret(0);
// handle return types different from T_INT
__ BIND(is_long);
__ movq(Address(c_rarg0, 0), rax);
__ jmp(exit);
__ BIND(is_float);
__ movflt(Address(c_rarg0, 0), xmm0);
__ jmp(exit);
__ BIND(is_double);
__ movdbl(Address(c_rarg0, 0), xmm0);
__ jmp(exit);
return start;
}
上述函数是在JVM启动初始化会调用这个。函数返回的是adress，其类型定义如下：
typedef unsigned char u_char;
typedef u_char* address;
关于adress
C++中是可以将对象this转换成unsigned char指针的。adress的值就是对象this的地址。示例程序参见《C++中将对象this转换成unsigned char指针》
address start = _masm-> pc(); // SimonNote: _code_section 的end 是pc() 也是此处的start
_masm
关于_masm
__是一个宏，展开后是 _masm->
_masm变量的初始化在stubCodeGenerator.cpp中的StubCodeGenerator::StubCodeGenerator函数里
StubCodeGenerator::StubCodeGenerator(CodeBuffer* code, bool print_code) {
_masm = new MacroAssembler(code);
_first_stub = _last_stub = NULL;
_print_code = print_code;
}
贴一下到初始化_masm的调用栈
StubCodeGenerator::StubCodeGenerator() at stubCodeGenerator.cpp:72 0x7ffff69d60d8
ICacheStubGenerator::ICacheStubGenerator() at icache.hpp:91 0x7ffff65da534
AbstractICache::initialize() at icache.cpp:39 0x7ffff65da324
icache_init() at icache.cpp:105 0x7ffff65da4f0
CodeCache::initialize() at codeCache.cpp:572 0x7ffff63d09f8
codeCache_init() at codeCache.cpp:582 0x7ffff63d0a34
init_globals() at init.cpp:98 0x7ffff65e93c5
Threads::create_vm() at thread.cpp:3,424 0x7ffff6a471c8
JNI_CreateJavaVM() at jni.cpp:5,166 0x7ffff66a156d
InitializeJVM() at java.c:1,145 0x7ffff7bc1b1f
JavaMain() at java.c:371 0x7ffff7bbf9e8
start_thread() at pthread_create.c:463 0x7ffff73ab6db
clone() at clone.S:95 0x7ffff78e888f
往上翻几个栈不难看出：
_masm(MacroAssembler需要的code是CodeBuffer，
CodeBuffer又需要BufferBlob
这段逻辑在icache.cpp的 void AbstractICache::initialize()中
void AbstractICache::initialize() {
// Making this stub must be FIRST use of assembler
ResourceMark rm;
BufferBlob* b = BufferBlob::create("flush_icache_stub", ICache::stub_size);
CodeBuffer c(b);
ICacheStubGenerator g(&c);
g.generate_icache_flush(&_flush_icache_stub);
// The first use of flush_icache_stub must apply it to itself.
// The StubCodeMark destructor in generate_icache_flush will
// call Assembler::flush, which in turn will call invalidate_range,
// which will in turn call the flush stub. Thus we don't need an
// explicit call to invalidate_range here. This assumption is
// checked in invalidate_range.
}
BufferBlob* b = BufferBlob::create("flush_icache_stub", ICache::stub_size);做了空间分配，下面讲；
空间分配
分配的栈
HeapBlock::allocated_space() at heap.hpp:54 0x7ffff65c26e4
CodeHeap::allocate() at heap.cpp:219 0x7ffff65c1a25
CodeCache::allocate() at codeCache.cpp:186 0x7ffff63cf5d8
BufferBlob::operator new() at codeBlob.cpp:249 0x7ffff63c8a0b
BufferBlob::create() at codeBlob.cpp:218 0x7ffff63c884e
AbstractICache::initialize() at icache.cpp:36 0x7ffff65da2eb
icache_init() at icache.cpp:105 0x7ffff65da4f0
CodeCache::initialize() at codeCache.cpp:572 0x7ffff63d09f8
codeCache_init() at codeCache.cpp:582 0x7ffff63d0a34
init_globals() at init.cpp:98 0x7ffff65e93c5
Threads::create_vm() at thread.cpp:3,424 0x7ffff6a471c8
JNI_CreateJavaVM() at jni.cpp:5,166 0x7ffff66a156d
InitializeJVM() at java.c:1,145 0x7ffff7bc1b1f
JavaMain() at java.c:371 0x7ffff7bbf9e8
start_thread() at pthread_create.c:463 0x7ffff73ab6db
clone() at clone.S:95 0x7ffff78e888f
有一段代码一开始没读懂，在同事帮助下才看明白：
BufferBlob* BufferBlob::create(const char* name, int buffer_size) {
ThreadInVMfromUnknown __tiv; // get to VM state in case we block on CodeCache_lock
BufferBlob* blob = NULL;
unsigned int size = sizeof(BufferBlob);
// align the size to CodeEntryAlignment
size = align_code_offset(size);
size += round_to(buffer_size, oopSize);
assert(name != NULL, "must provide a name");
{
MutexLockerEx mu(CodeCache_lock, Mutex::_no_safepoint_check_flag);
blob = new (size) BufferBlob(name, size); // 这行是什么意思？怎么有这种写法？
}
// Track memory usage statistic after releasing CodeCache_lock
MemoryService::track_code_cache_memory_usage();
return blob;
}
BufferBlob* blob = new (size) BufferBlob(name, size); 这种写法是placement new的写法，在《The C++ Programming Language, 4th Edition》中11.2.4 Overloading new有讲解。按我粗浅的不严谨的写法理解成：
在创建对象时，给对象指定分配在哪个内存地址上，place object of size sz at p。
不过这里的写法，跟最简单的placement new写法还是有点差异，它做了重载，最原始的写法是：
void∗ buf = reinterpret_cast<void∗>(0xF00F); // significant address
X∗ p2 = new(buf) X; // construct an X at buf;
// invokes: operator new(sizeof(X),buf)
// The ‘‘placement’’ operator new() is the simplest such allocator. It is defined in the standard header <new>:
void∗ operator new (size_t sz, void∗ p) noexcept; // place object of size sz at p
对于operator new的第一个参数size_t sz在调用时不用传送，由编译器在编译时决定并送进来，使用者只要送void* p就可以了
上面BufferBlob的代码对operator new还做了重载，(这也是通常的做法，自定义内存分配逻辑，并返回分配的指针)：
void* BufferBlob::operator new(size_t s, unsigned size, bool is_critical) throw() {
void* p = CodeCache::allocate(size, is_critical);
return p;
}
字节码翻译成汇编指令
将字节码翻译成汇编指令的调用栈：
以new为例：
TemplateTable::_new() at templateTable_x86_64.cpp:3,250 0x7ffff6a39ed6
Template::generate() at templateTable.cpp:63 0x7ffff6a267c7
TemplateInterpreterGenerator::generate_and_dispatch() at templateInterpreter.cpp:530 0x7ffff6a1c392
TemplateInterpreterGenerator::set_vtos_entry_points() at templateInterpreter_x86_64.cpp:2,039 0x7ffff6a25dfc
TemplateInterpreterGenerator::set_short_entry_points() at templateInterpreter.cpp:498 0x7ffff6a1c179
TemplateInterpreterGenerator::set_entry_points() at templateInterpreter.cpp:464 0x7ffff6a1bcb3
TemplateInterpreterGenerator::set_entry_points_for_all_bytes() at templateInterpreter.cpp:421 0x7ffff6a1b974
TemplateInterpreterGenerator::generate_all() at templateInterpreter.cpp:402 0x7ffff6a1b8d6
InterpreterGenerator::InterpreterGenerator() at templateInterpreter_x86_64.cpp:2,051 0x7ffff6a25e3b
TemplateInterpreter::initialize() at templateInterpreter.cpp:52 0x7ffff6a19aab
interpreter_init() at interpreter.cpp:118 0x7ffff664c2fe
init_globals() at init.cpp:107 0x7ffff65e93ef
Threads::create_vm() at thread.cpp:3,424 0x7ffff6a471c8
JNI_CreateJavaVM() at jni.cpp:5,166 0x7ffff66a156d
InitializeJVM() at java.c:1,145 0x7ffff7bc1b1f
JavaMain() at java.c:371 0x7ffff7bbf9e8
start_thread() at pthread_create.c:463 0x7ffff73ab6db
clone() at clone.S:95 0x7ffff78e888f
这个栈很重要！ 子节码都会按这个套路生成汇编指令模板。
在解释汇编指令时再用跳转指令跳转到指令模板入口处的地址。
可以通过在调试TemplateTable::_new()代码时，按如下路线查下_masm对应的_code_section对应的_start内存地址，然后通过CDT的Disassembly视图定位到相应的内存地址，并查看生成的指令，一目了然。此办法同样适用于generate_call_stub生成模板指令的地方的调试：
MacroAssembler MacroAssembler {...}
Assembler Assembler {...}
AbstractAssembler AbstractAssembler {...}
ResourceObj ResourceObj {...}
_code_section CodeSection * 0x7ffff7fdd5e0
_start address 0x7fffe10449e0 "Pé*"
[inside hotspot] 汇编模板解释器(Template Interpreter)和字节码执行
参考
[讨论] HotSpot 解释器是怎样执行bytecode 的
[讨论] 请教：Java 字节码如何执行的
[讨论] java_main的汇编入口在哪里
运行时对代码操纵的一个小demo
JVM 模板解释器之如何根据字节码生成汇编码？
