虚拟机解释器与bytecode对接

心头一直有个疑问，jvm虚拟是如何对接class中的字节码的？或者说在未进入

JIT优化阶段时，解释器是如何对接的？

大概阐述

hotspot通过C++代码在堆上申请一块空间，向里面填充一组指令，然后把这块空间当成一个函数，通过函数指针去调用刚生成的代码。是不是666，是不是哇超酷毙了。

关键代码

generate_call_stub

 address generate_call_stub(address& return_address) { // TODO: 需要一路仔细调试  c++方法  返回无符号char

    assert((int)frame::entry_frame_after_call_words == -(int)rsp_after_call_off + 1 &&

           (int)frame::entry_frame_call_wrapper_offset == (int)call_wrapper_off,

           "adjust this code");

    StubCodeMark mark(this, "StubRoutines", "call_stub");

//    address start = __ pc(); // SimonNote: 这个方法最终返回的就是这个start  宏展开 ： _masm->pc()

    address start = _masm-> pc(); // SimonNote: _code_section 的end 是pc() 也是此处的start

    // same as in generate_catch_exception()!

    const Address rsp_after_call(rbp, rsp_after_call_off * wordSize); // 这些adress都是准备工作  真正在内存区域生成汇编指令的事情是在下面的做的

    const Address call_wrapper  (rbp, call_wrapper_off   * wordSize);

    const Address result        (rbp, result_off         * wordSize);

    const Address result_type   (rbp, result_type_off    * wordSize);

    const Address method        (rbp, method_off         * wordSize);

    const Address entry_point   (rbp, entry_point_off    * wordSize);

    const Address parameters    (rbp, parameters_off     * wordSize);

    const Address parameter_size(rbp, parameter_size_off * wordSize);

    // same as in generate_catch_exception()!

    const Address thread        (rbp, thread_off         * wordSize);

    const Address r15_save(rbp, r15_off * wordSize);

    const Address r14_save(rbp, r14_off * wordSize);

    const Address r13_save(rbp, r13_off * wordSize);

    const Address r12_save(rbp, r12_off * wordSize);

    const Address rbx_save(rbp, rbx_off * wordSize);

    // stub code

    __ enter();  //SimonNote: macroAssembler_x86.cpp MacroAssembler::enter()   push(rbp); mov(rbp, rsp); 真正在内存区域生成汇编指令！其实就是把指令等opcode写入内存区域

    __ subptr(rsp, -rsp_after_call_off * wordSize);

    // save register parameters

#ifndef _WIN64

    __ movptr(parameters,   c_rarg5); // parameters

    __ movptr(entry_point,  c_rarg4); // entry_point

#endif

    __ movptr(method,       c_rarg3); // method

    __ movl(result_type,  c_rarg2);   // result type

    __ movptr(result,       c_rarg1); // result

    __ movptr(call_wrapper, c_rarg0); // call wrapper

    // save regs belonging to calling function

    __ movptr(rbx_save, rbx);

    __ movptr(r12_save, r12);

    __ movptr(r13_save, r13);

    __ movptr(r14_save, r14);

    __ movptr(r15_save, r15);

#ifdef _WIN64

    for (int i = 6; i <= 15; i++) {

      __ movdqu(xmm_save(i), as_XMMRegister(i));

    }

    const Address rdi_save(rbp, rdi_off * wordSize);

    const Address rsi_save(rbp, rsi_off * wordSize);

    __ movptr(rsi_save, rsi);

    __ movptr(rdi_save, rdi);

#else

    const Address mxcsr_save(rbp, mxcsr_off * wordSize);

    {

      Label skip_ldmx;

      __ stmxcsr(mxcsr_save);

      __ movl(rax, mxcsr_save);

      __ andl(rax, MXCSR_MASK);    // Only check control and mask bits

      ExternalAddress mxcsr_std(StubRoutines::addr_mxcsr_std());

      __ cmp32(rax, mxcsr_std);

      __ jcc(Assembler::equal, skip_ldmx);

      __ ldmxcsr(mxcsr_std);

      __ bind(skip_ldmx);

    }

#endif

    // Load up thread register

    __ movptr(r15_thread, thread);

    __ reinit_heapbase();

#ifdef ASSERT

    // make sure we have no pending exceptions

    {

      Label L;

      __ cmpptr(Address(r15_thread, Thread::pending_exception_offset()), (int32_t)NULL_WORD);

      __ jcc(Assembler::equal, L);

      __ stop("StubRoutines::call_stub: entered with pending exception");

      __ bind(L);

    }

#endif

    // pass parameters if any

    BLOCK_COMMENT("pass parameters if any");

    Label parameters_done;

    __ movl(c_rarg3, parameter_size);

    __ testl(c_rarg3, c_rarg3);

    __ jcc(Assembler::zero, parameters_done);

    Label loop;

    __ movptr(c_rarg2, parameters);       // parameter pointer

    __ movl(c_rarg1, c_rarg3);            // parameter counter is in c_rarg1

    __ BIND(loop);

    __ movptr(rax, Address(c_rarg2, 0));// get parameter

    __ addptr(c_rarg2, wordSize);       // advance to next parameter

    __ decrementl(c_rarg1);             // decrement counter

    __ push(rax);                       // pass parameter

    __ jcc(Assembler::notZero, loop);

    // call Java function

    __ BIND(parameters_done);

    __ movptr(rbx, method);             // get Method*

    __ movptr(c_rarg1, entry_point);    // get entry_point

    __ mov(r13, rsp);                   // set sender sp

    BLOCK_COMMENT("call Java function");

    __ call(c_rarg1);

    BLOCK_COMMENT("call_stub_return_address:");

    return_address = __ pc();

    // store result depending on type (everything that is not

    // T_OBJECT, T_LONG, T_FLOAT or T_DOUBLE is treated as T_INT)

    __ movptr(c_rarg0, result);

    Label is_long, is_float, is_double, exit;

    __ movl(c_rarg1, result_type);

    __ cmpl(c_rarg1, T_OBJECT);

    __ jcc(Assembler::equal, is_long);

    __ cmpl(c_rarg1, T_LONG);

    __ jcc(Assembler::equal, is_long);

    __ cmpl(c_rarg1, T_FLOAT);

    __ jcc(Assembler::equal, is_float);

    __ cmpl(c_rarg1, T_DOUBLE);

    __ jcc(Assembler::equal, is_double);

    // handle T_INT case

    __ movl(Address(c_rarg0, 0), rax);

    __ BIND(exit);

    // pop parameters

    __ lea(rsp, rsp_after_call);

#ifdef ASSERT

    // verify that threads correspond

    {

      Label L, S;

      __ cmpptr(r15_thread, thread);

      __ jcc(Assembler::notEqual, S);

      __ get_thread(rbx);

      __ cmpptr(r15_thread, rbx);

      __ jcc(Assembler::equal, L);

      __ bind(S);

      __ jcc(Assembler::equal, L);

      __ stop("StubRoutines::call_stub: threads must correspond");

      __ bind(L);

    }

#endif

    // restore regs belonging to calling function

#ifdef _WIN64

    for (int i = 15; i >= 6; i--) {

      __ movdqu(as_XMMRegister(i), xmm_save(i));

    }

#endif

    __ movptr(r15, r15_save);

    __ movptr(r14, r14_save);

    __ movptr(r13, r13_save);

    __ movptr(r12, r12_save);

    __ movptr(rbx, rbx_save);

#ifdef _WIN64

    __ movptr(rdi, rdi_save);

    __ movptr(rsi, rsi_save);

#else

    __ ldmxcsr(mxcsr_save);

#endif

    // restore rsp

    __ addptr(rsp, -rsp_after_call_off * wordSize);

    // return

    __ pop(rbp);

    __ ret(0);

    // handle return types different from T_INT

    __ BIND(is_long);

    __ movq(Address(c_rarg0, 0), rax);

    __ jmp(exit);

    __ BIND(is_float);

    __ movflt(Address(c_rarg0, 0), xmm0);

    __ jmp(exit);

    __ BIND(is_double);

    __ movdbl(Address(c_rarg0, 0), xmm0);

    __ jmp(exit);

    return start;

  }

上述函数是在JVM启动初始化会调用这个。函数返回的是adress，其类型定义如下：

typedef unsigned char u_char;

typedef u_char*       address;

关于adress

C++中是可以将对象this转换成unsigned char指针的。adress的值就是对象this的地址。示例程序参见《C++中将对象this转换成unsigned char指针》

address start = _masm-> pc(); // SimonNote: _code_section 的end 是pc() 也是此处的start

_masm

关于_masm

__是一个宏，展开后是 _masm->

_masm变量的初始化在stubCodeGenerator.cpp中的StubCodeGenerator::StubCodeGenerator函数里

StubCodeGenerator::StubCodeGenerator(CodeBuffer* code, bool print_code) {

  _masm = new MacroAssembler(code);

  _first_stub = _last_stub = NULL;

  _print_code = print_code;

}

贴一下到初始化_masm的调用栈

StubCodeGenerator::StubCodeGenerator() at stubCodeGenerator.cpp:72 0x7ffff69d60d8

ICacheStubGenerator::ICacheStubGenerator() at icache.hpp:91 0x7ffff65da534

AbstractICache::initialize() at icache.cpp:39 0x7ffff65da324

icache_init() at icache.cpp:105 0x7ffff65da4f0

CodeCache::initialize() at codeCache.cpp:572 0x7ffff63d09f8

codeCache_init() at codeCache.cpp:582 0x7ffff63d0a34

init_globals() at init.cpp:98 0x7ffff65e93c5

Threads::create_vm() at thread.cpp:3,424 0x7ffff6a471c8

JNI_CreateJavaVM() at jni.cpp:5,166 0x7ffff66a156d

InitializeJVM() at java.c:1,145 0x7ffff7bc1b1f

JavaMain() at java.c:371 0x7ffff7bbf9e8

start_thread() at pthread_create.c:463 0x7ffff73ab6db

clone() at clone.S:95 0x7ffff78e888f

往上翻几个栈不难看出：

_masm(MacroAssembler需要的code是CodeBuffer，

CodeBuffer又需要BufferBlob

这段逻辑在icache.cpp的 void AbstractICache::initialize()中

void AbstractICache::initialize() {

  // Making this stub must be FIRST use of assembler

  ResourceMark rm;

  BufferBlob* b = BufferBlob::create("flush_icache_stub", ICache::stub_size);

  CodeBuffer c(b);

  ICacheStubGenerator g(&c);

  g.generate_icache_flush(&_flush_icache_stub);

  // The first use of flush_icache_stub must apply it to itself.

  // The StubCodeMark destructor in generate_icache_flush will

  // call Assembler::flush, which in turn will call invalidate_range,

  // which will in turn call the flush stub.  Thus we don't need an

  // explicit call to invalidate_range here.  This assumption is

  // checked in invalidate_range.

}

BufferBlob* b = BufferBlob::create("flush_icache_stub", ICache::stub_size);做了空间分配，下面讲；

空间分配

分配的栈

HeapBlock::allocated_space() at heap.hpp:54 0x7ffff65c26e4

CodeHeap::allocate() at heap.cpp:219 0x7ffff65c1a25

CodeCache::allocate() at codeCache.cpp:186 0x7ffff63cf5d8

BufferBlob::operator new() at codeBlob.cpp:249 0x7ffff63c8a0b

BufferBlob::create() at codeBlob.cpp:218 0x7ffff63c884e

AbstractICache::initialize() at icache.cpp:36 0x7ffff65da2eb

icache_init() at icache.cpp:105 0x7ffff65da4f0

CodeCache::initialize() at codeCache.cpp:572 0x7ffff63d09f8

codeCache_init() at codeCache.cpp:582 0x7ffff63d0a34

init_globals() at init.cpp:98 0x7ffff65e93c5

Threads::create_vm() at thread.cpp:3,424 0x7ffff6a471c8

JNI_CreateJavaVM() at jni.cpp:5,166 0x7ffff66a156d

InitializeJVM() at java.c:1,145 0x7ffff7bc1b1f

JavaMain() at java.c:371 0x7ffff7bbf9e8

start_thread() at pthread_create.c:463 0x7ffff73ab6db

clone() at clone.S:95 0x7ffff78e888f

有一段代码一开始没读懂，在同事帮助下才看明白：

BufferBlob* BufferBlob::create(const char* name, int buffer_size) {

  ThreadInVMfromUnknown __tiv;  // get to VM state in case we block on CodeCache_lock

  BufferBlob* blob = NULL;

  unsigned int size = sizeof(BufferBlob);

  // align the size to CodeEntryAlignment

  size = align_code_offset(size);

  size += round_to(buffer_size, oopSize);

  assert(name != NULL, "must provide a name");

  {

    MutexLockerEx mu(CodeCache_lock, Mutex::_no_safepoint_check_flag);

    blob = new (size) BufferBlob(name, size); // 这行是什么意思？怎么有这种写法？

  }

  // Track memory usage statistic after releasing CodeCache_lock

  MemoryService::track_code_cache_memory_usage();

  return blob;

}

BufferBlob* blob = new (size) BufferBlob(name, size); 这种写法是placement new的写法，在《The C++ Programming Language, 4th Edition》中11.2.4 Overloading new有讲解。按我粗浅的不严谨的写法理解成：

在创建对象时，给对象指定分配在哪个内存地址上，place object of size sz at p。

不过这里的写法，跟最简单的placement new写法还是有点差异，它做了重载，最原始的写法是：

void∗ buf = reinterpret_cast<void∗>(0xF00F); // significant address

X∗ p2 = new(buf) X; // construct an X at buf;

                    // invokes: operator new(sizeof(X),buf)

// The ‘‘placement’’ operator new() is the simplest such allocator. It is defined in the standard header <new>:

void∗ operator new (size_t sz, void∗ p) noexcept;   // place object of size sz at p

对于operator new的第一个参数size_t sz在调用时不用传送，由编译器在编译时决定并送进来，使用者只要送void* p就可以了

上面BufferBlob的代码对operator new还做了重载，(这也是通常的做法，自定义内存分配逻辑，并返回分配的指针)：

void* BufferBlob::operator new(size_t s, unsigned size, bool is_critical) throw() {

  void* p = CodeCache::allocate(size, is_critical);

  return p;

}

字节码翻译成汇编指令

将字节码翻译成汇编指令的调用栈：

以new为例：

TemplateTable::_new() at templateTable_x86_64.cpp:3,250 0x7ffff6a39ed6

Template::generate() at templateTable.cpp:63 0x7ffff6a267c7

TemplateInterpreterGenerator::generate_and_dispatch() at templateInterpreter.cpp:530 0x7ffff6a1c392

TemplateInterpreterGenerator::set_vtos_entry_points() at templateInterpreter_x86_64.cpp:2,039 0x7ffff6a25dfc

TemplateInterpreterGenerator::set_short_entry_points() at templateInterpreter.cpp:498 0x7ffff6a1c179

TemplateInterpreterGenerator::set_entry_points() at templateInterpreter.cpp:464 0x7ffff6a1bcb3

TemplateInterpreterGenerator::set_entry_points_for_all_bytes() at templateInterpreter.cpp:421 0x7ffff6a1b974

TemplateInterpreterGenerator::generate_all() at templateInterpreter.cpp:402 0x7ffff6a1b8d6

InterpreterGenerator::InterpreterGenerator() at templateInterpreter_x86_64.cpp:2,051 0x7ffff6a25e3b

TemplateInterpreter::initialize() at templateInterpreter.cpp:52 0x7ffff6a19aab

interpreter_init() at interpreter.cpp:118 0x7ffff664c2fe

init_globals() at init.cpp:107 0x7ffff65e93ef

Threads::create_vm() at thread.cpp:3,424 0x7ffff6a471c8

JNI_CreateJavaVM() at jni.cpp:5,166 0x7ffff66a156d

InitializeJVM() at java.c:1,145 0x7ffff7bc1b1f

JavaMain() at java.c:371 0x7ffff7bbf9e8

start_thread() at pthread_create.c:463 0x7ffff73ab6db

clone() at clone.S:95 0x7ffff78e888f

这个栈很重要！子节码都会按这个套路生成汇编指令模板。

在解释汇编指令时再用跳转指令跳转到指令模板入口处的地址。

可以通过在调试TemplateTable::_new()代码时，按如下路线查下_masm对应的_code_section对应的_start内存地址，然后通过CDT的Disassembly视图定位到相应的内存地址，并查看生成的指令，一目了然。此办法同样适用于generate_call_stub生成模板指令的地方的调试：

MacroAssembler	MacroAssembler	{...}

	Assembler	Assembler	{...}

		AbstractAssembler	AbstractAssembler	{...}

			ResourceObj	ResourceObj	{...}

			_code_section	CodeSection *	0x7ffff7fdd5e0

				_start	address	0x7fffe10449e0 "Pé*"

[inside hotspot] 汇编模板解释器(Template Interpreter)和字节码执行

参考

[讨论] HotSpot 解释器是怎样执行bytecode 的

 [讨论] 请教：Java 字节码如何执行的

 [讨论] java_main的汇编入口在哪里

 运行时对代码操纵的一个小demo

JVM 模板解释器之如何根据字节码生成汇编码？