JVM Attach实现原理剖析

本文转载自JVM Attach实现原理剖析

前言

本文旨在从理论上分析JVM 在 Linux 环境下 Attach 操作的前因后果，以及 JVM 为此而设计并实现的解决方案，通过本文，我希望能够讲述清楚如下三个主要方面的内容。

Attach 为什么而出现

Attach的出现究其根本原因，应该就是为了实现 Java 进程（A）与进程（B）之间的本地通信。一旦这个通信通道能够成功建立，那么进程 A 就能通知进程 B 去执行某些操作，从而达到监控进程 B 或者控制进程 B 的某些行为的目的。如 jstack、jmap等 JDK 自带的工具，基本都是通过 Attach 机制去达成各自想要的目的的。至于 jstack、jmap 能做什么、怎么做，就不再本文的讨论范围了，请自行百度或者 Google。

Attach 在 JVM 底层实现的根本原理是什么

Attach 实现的根本原理就是使用了 Linux 下是文件 Socket 通信（详情可以自行百度或 Google）。有人也许会问，为什么要采用文件 socket 而不采用网络 socket？我个人认为也许一方面是为了效率（避免了网络协议的解析、数据包的封装和解封装等），另一方面是为了减少对系统资源的占用（如网络端口占用）。采用文件 socket 通信，就好比两个进程通过事先约定好的协议，对同一个文件进行读写操作，以达到信息的交互和共享。简单理解成如下图所示的模型

通过/tmp/.java.pid2345这个文件，实现客户进程与目标进程2345的通信。

Attach 在 JVM 中实现的源码分析

源码的分析主要分三阶段进行，这里要达到的目的是，弄 Attach 的清楚来龙去脉，本文的所有源码都是基于 Open JDK 1.8的，大家可以自行去下载 Open JDK 1.8 的源码。

目标JVM 对OS信号监听的实现

或许你会想，在最开始的时候，目标 JVM 是怎么知道有某个进程想 attach 它自己的？答案很简单，就是目标 JVM 在启动的时候，在 JVM 内部启动了一个监听线程，这个线程的名字叫“Signal Dispatcher”，该线程的作用是，监听并处理 OS 的信号。至于什么是 OS 的信号（可以自行百度或 Google），简单理解就是，Linux系统允许进程与进程之间通过过信号的方式进行通信，如触发某个操作（操作由接受到信号的进程自定义）。如平常我们用的最多的就是 kill -9 ${pid}来杀死某个进程，kill进程通过向${pid}的进程发送一个编号为“9”号的信号，来通知系统强制结束${pid}的生命周期。

接下来我们就通过源码截图的方式来呈现一下“Signal Dispatcher”线程的创建过程。

首先进入 JVM 的启动类：/jdk/src/share/bin/main.c

 1 int
 2 main(int argc, char **argv)
 3 {
 4     int margc;
 5     char** margv;
 6     const jboolean const_javaw = JNI_FALSE;
 7 #endif /* JAVAW */
 8 #ifdef _WIN32
 9     {
10         int i = 0;
11         if (getenv(JLDEBUG_ENV_ENTRY) != NULL) {
12             printf("Windows original main args:\n");
13             for (i = 0 ; i < __argc ; i++) {
14                 printf("wwwd_args[%d] = %s\n", i, __argv[i]);
15             }
16         }
17     }
18     JLI_CmdToArgs(GetCommandLine());
19     margc = JLI_GetStdArgc();
20     // add one more to mark the end
21     margv = (char **)JLI_MemAlloc((margc + 1) * (sizeof(char *)));
22     {
23         int i = 0;
24         StdArg *stdargs = JLI_GetStdArgs();
25         for (i = 0 ; i < margc ; i++) {
26             margv[i] = stdargs[i].arg;
27         }
28         margv[i] = NULL;
29     }
30 #else /* *NIXES */
31     margc = argc;
32     margv = argv;
33 #endif /* WIN32 */
34     return JLI_Launch(margc, margv,
35                    sizeof(const_jargs) / sizeof(char *), const_jargs,
36                    sizeof(const_appclasspath) / sizeof(char *), const_appclasspath,
37                    FULL_VERSION,
38                    DOT_VERSION,
39                    (const_progname != NULL) ? const_progname : *margv,
40                    (const_launcher != NULL) ? const_launcher : *margv,
41                    (const_jargs != NULL) ? JNI_TRUE : JNI_FALSE,
42                    const_cpwildcard, const_javaw, const_ergo_class);
43 }

这个类里边最重要的一个方法就是最后的JLI_Launch，这个方法的实现存在于jdk/src/share/bin/java.c 中（大家应该都不陌生平时我们运行 java 程序时，都是采用 java com.***.Main来启动的吧）。

  1 /*
  2  * Entry point.
  3  */
  4 int
  5 JLI_Launch(int argc, char ** argv,              /* main argc, argc */
  6         int jargc, const char** jargv,          /* java args */
  7         int appclassc, const char** appclassv,  /* app classpath */
  8         const char* fullversion,                /* full version defined */
  9         const char* dotversion,                 /* dot version defined */
 10         const char* pname,                      /* program name */
 11         const char* lname,                      /* launcher name */
 12         jboolean javaargs,                      /* JAVA_ARGS */
 13         jboolean cpwildcard,                    /* classpath wildcard*/
 14         jboolean javaw,                         /* windows-only javaw */
 15         jint ergo                               /* ergonomics class policy */
 16 )
 17 {
 18     int mode = LM_UNKNOWN;
 19     char *what = NULL;
 20     char *cpath = 0;
 21     char *main_class = NULL;
 22     int ret;
 23     InvocationFunctions ifn;
 24     jlong start, end;
 25     char jvmpath[MAXPATHLEN];
 26     char jrepath[MAXPATHLEN];
 27     char jvmcfg[MAXPATHLEN];
 28
 29     _fVersion = fullversion;
 30     _dVersion = dotversion;
 31     _launcher_name = lname;
 32     _program_name = pname;
 33     _is_java_args = javaargs;
 34     _wc_enabled = cpwildcard;
 35     _ergo_policy = ergo;
 36
 37     InitLauncher(javaw);
 38     DumpState();
 39     if (JLI_IsTraceLauncher()) {
 40         int i;
 41         printf("Command line args:\n");
 42         for (i = 0; i < argc ; i++) {
 43             printf("argv[%d] = %s\n", i, argv[i]);
 44         }
 45         AddOption("-Dsun.java.launcher.diag=true", NULL);
 46     }
 47
 48     /*
 49      * Make sure the specified version of the JRE is running.
 50      *
 51      * There are three things to note about the SelectVersion() routine:
 52      *  1) If the version running isn't correct, this routine doesn't
 53      *     return (either the correct version has been exec'd or an error
 54      *     was issued).
 55      *  2) Argc and Argv in this scope are *not* altered by this routine.
 56      *     It is the responsibility of subsequent code to ignore the
 57      *     arguments handled by this routine.
 58      *  3) As a side-effect, the variable "main_class" is guaranteed to
 59      *     be set (if it should ever be set).  This isn't exactly the
 60      *     poster child for structured programming, but it is a small
 61      *     price to pay for not processing a jar file operand twice.
 62      *     (Note: This side effect has been disabled.  See comment on
 63      *     bugid 5030265 below.)
 64      */
 65     SelectVersion(argc, argv, &main_class);
 66
 67     CreateExecutionEnvironment(&argc, &argv,
 68                                jrepath, sizeof(jrepath),
 69                                jvmpath, sizeof(jvmpath),
 70                                jvmcfg,  sizeof(jvmcfg));
 71
 72     ifn.CreateJavaVM = 0;
 73     ifn.GetDefaultJavaVMInitArgs = 0;
 74
 75     if (JLI_IsTraceLauncher()) {
 76         start = CounterGet();
 77     }
 78
 79     if (!LoadJavaVM(jvmpath, &ifn)) {
 80         return(6);
 81     }
 82
 83     if (JLI_IsTraceLauncher()) {
 84         end   = CounterGet();
 85     }
 86
 87     JLI_TraceLauncher("%ld micro seconds to LoadJavaVM\n",
 88              (long)(jint)Counter2Micros(end-start));
 89
 90     ++argv;
 91     --argc;
 92
 93     if (IsJavaArgs()) {
 94         /* Preprocess wrapper arguments */
 95         TranslateApplicationArgs(jargc, jargv, &argc, &argv);
 96         if (!AddApplicationOptions(appclassc, appclassv)) {
 97             return(1);
 98         }
 99     } else {
100         /* Set default CLASSPATH */
101         cpath = getenv("CLASSPATH");
102         if (cpath == NULL) {
103             cpath = ".";
104         }
105         SetClassPath(cpath);
106     }
107
108     /* Parse command line options; if the return value of
109      * ParseArguments is false, the program should exit.
110      */
111     if (!ParseArguments(&argc, &argv, &mode, &what, &ret, jrepath))
112     {
113         return(ret);
114     }
115
116     /* Override class path if -jar flag was specified */
117     if (mode == LM_JAR) {
118         SetClassPath(what);     /* Override class path */
119     }
120
121     /* set the -Dsun.java.command pseudo property */
122     SetJavaCommandLineProp(what, argc, argv);
123
124     /* Set the -Dsun.java.launcher pseudo property */
125     SetJavaLauncherProp();
126
127     /* set the -Dsun.java.launcher.* platform properties */
128     SetJavaLauncherPlatformProps();
129
130     return JVMInit(&ifn, threadStackSize, argc, argv, mode, what, ret);
131 }

这个方法中，进行了一系列必要的操作，如libjvm.so的加载、参数解析、Classpath 的获取和设置、系统属性的设置、JVM 初始化等等，不过和本文相关的主要是130行的 JVMInit 方法，接下来我们看下这个方法的实现（位于/jdk/src/solaris/bin/java_md_solinux.c）。

1 int
2 JVMInit(InvocationFunctions* ifn, jlong threadStackSize,
3         int argc, char **argv,
4         int mode, char *what, int ret)
5 {
6     ShowSplashScreen();
7     return ContinueInNewThread(ifn, threadStackSize, argc, argv, mode, what, ret);
8 }

这里请关注两个点，ContinueInNewThread方法 和 ifn 入参。ContinueInNewThread位于 java.c中，而 ifn 则携带了libjvm.so中的几个非常重要的函数(CreateJavaVM/GetDefaultJavaVMInitArgs/GetCreatedJavaVMs)，这里我们重点关注CreateJavaVM

 1 int
 2 ContinueInNewThread(InvocationFunctions* ifn, jlong threadStackSize,
 3                     int argc, char **argv,
 4                     int mode, char *what, int ret)
 5 {
 6
 7     /*
 8      * If user doesn't specify stack size, check if VM has a preference.
 9      * Note that HotSpot no longer supports JNI_VERSION_1_1 but it will
10      * return its default stack size through the init args structure.
11      */
12     if (threadStackSize == 0) {
13       struct JDK1_1InitArgs args1_1;
14       memset((void*)&args1_1, 0, sizeof(args1_1));
15       args1_1.version = JNI_VERSION_1_1;
16       ifn->GetDefaultJavaVMInitArgs(&args1_1);  /* ignore return value */
17       if (args1_1.javaStackSize > 0) {
18          threadStackSize = args1_1.javaStackSize;
19       }
20     }
21
22     { /* Create a new thread to create JVM and invoke main method */
23       JavaMainArgs args;
24       int rslt;
25
26       args.argc = argc;
27       args.argv = argv;
28       args.mode = mode;
29       args.what = what;
30       args.ifn = *ifn;
31
32       rslt = ContinueInNewThread0(JavaMain, threadStackSize, (void*)&args);
33       /* If the caller has deemed there is an error we
34        * simply return that, otherwise we return the value of
35        * the callee
36        */
37       return (ret != 0) ? ret : rslt;
38     }
39 }

可以看出，这里进行了 JavaMainArgs 参数设置，设置完成之后，在32行处调用了 ContinueInNewThread0 （位于/jdk/src/solaris/bin/java_md_solinux.c）方法，该方法中传入了 JavaMain 函数指针和 args 参数，这二者至关重要。接下来看下其源码

 1 /*
 2  * Block current thread and continue execution in a new thread
 3  */
 4 int
 5 ContinueInNewThread0(int (JNICALL *continuation)(void *), jlong stack_size, void * args) {
 6     int rslt;
 7 #ifdef __linux__
 8     pthread_t tid;
 9     pthread_attr_t attr;
10     pthread_attr_init(&attr);
11     pthread_attr_setdetachstate(&attr, PTHREAD_CREATE_JOINABLE);
12
13     if (stack_size > 0) {
14       pthread_attr_setstacksize(&attr, stack_size);
15     }
16
17     if (pthread_create(&tid, &attr, (void *(*)(void*))continuation, (void*)args) == 0) {
18       void * tmp;
19       pthread_join(tid, &tmp);
20       rslt = (int)tmp;
21     } else {
22      /*
23       * Continue execution in current thread if for some reason (e.g. out of
24       * memory/LWP)  a new thread can't be created. This will likely fail
25       * later in continuation as JNI_CreateJavaVM needs to create quite a
26       * few new threads, anyway, just give it a try..
27       */
28       rslt = continuation(args);
29     }
30
31     pthread_attr_destroy(&attr);
32 #else /* ! __linux__ */
33     thread_t tid;
34     long flags = 0;
35     if (thr_create(NULL, stack_size, (void *(*)(void *))continuation, args, flags, &tid) == 0) {
36       void * tmp;
37       thr_join(tid, NULL, &tmp);
38       rslt = (int)tmp;
39     } else {
40       /* See above. Continue in current thread if thr_create() failed */
41       rslt = continuation(args);
42     }
43 #endif /* __linux__ */
44     return rslt;
45 }

这里最关键的点在于，如果是 linux 环境下，则创建了一个 pthread_t 的线程来运行传入的 JavaMain 函数，并且将 args 参数也一并传入了。这时候，我们唯一要关注的便是 JavaMain （在jdk/src/share/bin/java.c ）函数，请看源码

  1 int JNICALL
  2 JavaMain(void * _args)
  3 {
  4     JavaMainArgs *args = (JavaMainArgs *)_args;
  5     int argc = args->argc;
  6     char **argv = args->argv;
  7     int mode = args->mode;
  8     char *what = args->what;
  9     InvocationFunctions ifn = args->ifn;
 10
 11     JavaVM *vm = 0;
 12     JNIEnv *env = 0;
 13     jclass mainClass = NULL;
 14     jclass appClass = NULL; // actual application class being launched
 15     jmethodID mainID;
 16     jobjectArray mainArgs;
 17     int ret = 0;
 18     jlong start, end;
 19
 20     RegisterThread();
 21
 22     /* Initialize the virtual machine */
 23     start = CounterGet();
 24     if (!InitializeJVM(&vm, &env, &ifn)) {
 25         JLI_ReportErrorMessage(JVM_ERROR1);
 26         exit(1);
 27     }
 28
 29     if (showSettings != NULL) {
 30         ShowSettings(env, showSettings);
 31         CHECK_EXCEPTION_LEAVE(1);
 32     }
 33
 34     if (printVersion || showVersion) {
 35         PrintJavaVersion(env, showVersion);
 36         CHECK_EXCEPTION_LEAVE(0);
 37         if (printVersion) {
 38             LEAVE();
 39         }
 40     }
 41
 42     /* If the user specified neither a class name nor a JAR file */
 43     if (printXUsage || printUsage || what == 0 || mode == LM_UNKNOWN) {
 44         PrintUsage(env, printXUsage);
 45         CHECK_EXCEPTION_LEAVE(1);
 46         LEAVE();
 47     }
 48
 49     FreeKnownVMs();  /* after last possible PrintUsage() */
 50
 51     if (JLI_IsTraceLauncher()) {
 52         end = CounterGet();
 53         JLI_TraceLauncher("%ld micro seconds to InitializeJVM\n",
 54                (long)(jint)Counter2Micros(end-start));
 55     }
 56
 57     /* At this stage, argc/argv have the application's arguments */
 58     if (JLI_IsTraceLauncher()){
 59         int i;
 60         printf("%s is '%s'\n", launchModeNames[mode], what);
 61         printf("App's argc is %d\n", argc);
 62         for (i=0; i < argc; i++) {
 63             printf("    argv[%2d] = '%s'\n", i, argv[i]);
 64         }
 65     }
 66
 67     ret = 1;
 68
 69     /*
 70      * Get the application's main class.
 71      *
 72      * See bugid 5030265.  The Main-Class name has already been parsed
 73      * from the manifest, but not parsed properly for UTF-8 support.
 74      * Hence the code here ignores the value previously extracted and
 75      * uses the pre-existing code to reextract the value.  This is
 76      * possibly an end of release cycle expedient.  However, it has
 77      * also been discovered that passing some character sets through
 78      * the environment has "strange" behavior on some variants of
 79      * Windows.  Hence, maybe the manifest parsing code local to the
 80      * launcher should never be enhanced.
 81      *
 82      * Hence, future work should either:
 83      *     1)   Correct the local parsing code and verify that the
 84      *          Main-Class attribute gets properly passed through
 85      *          all environments,
 86      *     2)   Remove the vestages of maintaining main_class through
 87      *          the environment (and remove these comments).
 88      *
 89      * This method also correctly handles launching existing JavaFX
 90      * applications that may or may not have a Main-Class manifest entry.
 91      */
 92     mainClass = LoadMainClass(env, mode, what);
 93     CHECK_EXCEPTION_NULL_LEAVE(mainClass);
 94     /*
 95      * In some cases when launching an application that needs a helper, e.g., a
 96      * JavaFX application with no main method, the mainClass will not be the
 97      * applications own main class but rather a helper class. To keep things
 98      * consistent in the UI we need to track and report the application main class.
 99      */
100     appClass = GetApplicationClass(env);
101     NULL_CHECK_RETURN_VALUE(appClass, -1);
102     /*
103      * PostJVMInit uses the class name as the application name for GUI purposes,
104      * for example, on OSX this sets the application name in the menu bar for
105      * both SWT and JavaFX. So we'll pass the actual application class here
106      * instead of mainClass as that may be a launcher or helper class instead
107      * of the application class.
108      */
109     PostJVMInit(env, appClass, vm);
110     /*
111      * The LoadMainClass not only loads the main class, it will also ensure
112      * that the main method's signature is correct, therefore further checking
113      * is not required. The main method is invoked here so that extraneous java
114      * stacks are not in the application stack trace.
115      */
116     mainID = (*env)->GetStaticMethodID(env, mainClass, "main",
117                                        "([Ljava/lang/String;)V");
118     CHECK_EXCEPTION_NULL_LEAVE(mainID);
119
120     /* Build platform specific argument array */
121     mainArgs = CreateApplicationArgs(env, argv, argc);
122     CHECK_EXCEPTION_NULL_LEAVE(mainArgs);
123
124     /* Invoke main method. */
125     (*env)->CallStaticVoidMethod(env, mainClass, mainID, mainArgs);
126
127     /*
128      * The launcher's exit code (in the absence of calls to
129      * System.exit) will be non-zero if main threw an exception.
130      */
131     ret = (*env)->ExceptionOccurred(env) == NULL ? 0 : 1;
132     LEAVE();
133 }

和本小节相关的函数为InitializeJVM函数，在这个函数中，调用CreateJavaVM方法，这个方法就是之前在加载 libjvm.so 的时候，从动态库中获取的，首先看InitializeJVM的源码

 1 /*
 2  * Initializes the Java Virtual Machine. Also frees options array when
 3  * finished.
 4  */
 5 static jboolean
 6 InitializeJVM(JavaVM **pvm, JNIEnv **penv, InvocationFunctions *ifn)
 7 {
 8     JavaVMInitArgs args;
 9     jint r;
10
11     memset(&args, 0, sizeof(args));
12     args.version  = JNI_VERSION_1_2;
13     args.nOptions = numOptions;
14     args.options  = options;
15     args.ignoreUnrecognized = JNI_FALSE;
16
17     if (JLI_IsTraceLauncher()) {
18         int i = 0;
19         printf("JavaVM args:\n    ");
20         printf("version 0x%08lx, ", (long)args.version);
21         printf("ignoreUnrecognized is %s, ",
22                args.ignoreUnrecognized ? "JNI_TRUE" : "JNI_FALSE");
23         printf("nOptions is %ld\n", (long)args.nOptions);
24         for (i = 0; i < numOptions; i++)
25             printf("    option[%2d] = '%s'\n",
26                    i, args.options[i].optionString);
27     }
28
29     r = ifn->CreateJavaVM(pvm, (void **)penv, &args);
30     JLI_MemFree(options);
31     return r == JNI_OK;
32 }

29行处，调用 CreateJavaVM（定义在hotspot/src/share/vm/prims/jni.cpp） 方法，来进行 JVM 虚拟机的真正创建过程，源码如下

  1 _JNI_IMPORT_OR_EXPORT_ jint JNICALL JNI_CreateJavaVM(JavaVM **vm, void **penv, void *args) {
  2 #ifndef USDT2
  3   HS_DTRACE_PROBE3(hotspot_jni, CreateJavaVM__entry, vm, penv, args);
  4 #else /* USDT2 */
  5   HOTSPOT_JNI_CREATEJAVAVM_ENTRY(
  6                                  (void **) vm, penv, args);
  7 #endif /* USDT2 */
  8
  9   jint result = JNI_ERR;
 10   DT_RETURN_MARK(CreateJavaVM, jint, (const jint&)result);
 11
 12   // We're about to use Atomic::xchg for synchronization.  Some Zero
 13   // platforms use the GCC builtin __sync_lock_test_and_set for this,
 14   // but __sync_lock_test_and_set is not guaranteed to do what we want
 15   // on all architectures.  So we check it works before relying on it.
 16 #if defined(ZERO) && defined(ASSERT)
 17   {
 18     jint a = 0xcafebabe;
 19     jint b = Atomic::xchg(0xdeadbeef, &a);
 20     void *c = &a;
 21     void *d = Atomic::xchg_ptr(&b, &c);
 22     assert(a == (jint) 0xdeadbeef && b == (jint) 0xcafebabe, "Atomic::xchg() works");
 23     assert(c == &b && d == &a, "Atomic::xchg_ptr() works");
 24   }
 25 #endif // ZERO && ASSERT
 26
 27   // At the moment it's only possible to have one Java VM,
 28   // since some of the runtime state is in global variables.
 29
 30   // We cannot use our mutex locks here, since they only work on
 31   // Threads. We do an atomic compare and exchange to ensure only
 32   // one thread can call this method at a time
 33
 34   // We use Atomic::xchg rather than Atomic::add/dec since on some platforms
 35   // the add/dec implementations are dependent on whether we are running
 36   // on a multiprocessor, and at this stage of initialization the os::is_MP
 37   // function used to determine this will always return false. Atomic::xchg
 38   // does not have this problem.
 39   if (Atomic::xchg(1, &vm_created) == 1) {
 40     return JNI_EEXIST;   // already created, or create attempt in progress
 41   }
 42   if (Atomic::xchg(0, &safe_to_recreate_vm) == 0) {
 43     return JNI_ERR;  // someone tried and failed and retry not allowed.
 44   }
 45
 46   assert(vm_created == 1, "vm_created is true during the creation");
 47
 48   /**
 49    * Certain errors during initialization are recoverable and do not
 50    * prevent this method from being called again at a later time
 51    * (perhaps with different arguments).  However, at a certain
 52    * point during initialization if an error occurs we cannot allow
 53    * this function to be called again (or it will crash).  In those
 54    * situations, the 'canTryAgain' flag is set to false, which atomically
 55    * sets safe_to_recreate_vm to 1, such that any new call to
 56    * JNI_CreateJavaVM will immediately fail using the above logic.
 57    */
 58   bool can_try_again = true;
 59
 60   result = Threads::create_vm((JavaVMInitArgs*) args, &can_try_again);
 61   if (result == JNI_OK) {
 62     JavaThread *thread = JavaThread::current();
 63     /* thread is thread_in_vm here */
 64     *vm = (JavaVM *)(&main_vm);
 65     *(JNIEnv**)penv = thread->jni_environment();
 66
 67     // Tracks the time application was running before GC
 68     RuntimeService::record_application_start();
 69
 70     // Notify JVMTI
 71     if (JvmtiExport::should_post_thread_life()) {
 72        JvmtiExport::post_thread_start(thread);
 73     }
 74
 75     EventThreadStart event;
 76     if (event.should_commit()) {
 77       event.set_javalangthread(java_lang_Thread::thread_id(thread->threadObj()));
 78       event.commit();
 79     }
 80
 81 #ifndef PRODUCT
 82   #ifndef TARGET_OS_FAMILY_windows
 83     #define CALL_TEST_FUNC_WITH_WRAPPER_IF_NEEDED(f) f()
 84   #endif
 85
 86     // Check if we should compile all classes on bootclasspath
 87     if (CompileTheWorld) ClassLoader::compile_the_world();
 88     if (ReplayCompiles) ciReplay::replay(thread);
 89
 90     // Some platforms (like Win*) need a wrapper around these test
 91     // functions in order to properly handle error conditions.
 92     CALL_TEST_FUNC_WITH_WRAPPER_IF_NEEDED(test_error_handler);
 93     CALL_TEST_FUNC_WITH_WRAPPER_IF_NEEDED(execute_internal_vm_tests);
 94 #endif
 95
 96     // Since this is not a JVM_ENTRY we have to set the thread state manually before leaving.
 97     ThreadStateTransition::transition_and_fence(thread, _thread_in_vm, _thread_in_native);
 98   } else {
 99     if (can_try_again) {
100       // reset safe_to_recreate_vm to 1 so that retrial would be possible
101       safe_to_recreate_vm = 1;
102     }
103
104     // Creation failed. We must reset vm_created
105     *vm = 0;
106     *(JNIEnv**)penv = 0;
107     // reset vm_created last to avoid race condition. Use OrderAccess to
108     // control both compiler and architectural-based reordering.
109     OrderAccess::release_store(&vm_created, 0);
110   }
111
112   return result;
113 }

这里只关注最核心的方法是60行的Threads::create_vm（hotspot/src/share/vm/runtime/Thread.cpp） 方法，在这个方法中，进行了大量的初始化操作，不过，这里我们只关注其中的一个点，就是 os::signal_init() 方法的调用，这就是启动“Signal Dispatcher”线程的地方。先看 create_vm 的源码

  1 jint Threads::create_vm(JavaVMInitArgs* args, bool* canTryAgain) {
  2
  3   extern void JDK_Version_init();
  4
  5   // Check version
  6   if (!is_supported_jni_version(args->version)) return JNI_EVERSION;
  7
  8   // Initialize the output stream module
  9   ostream_init();
 10
 11   // Process java launcher properties.
 12   Arguments::process_sun_java_launcher_properties(args);
 13
 14   // Initialize the os module before using TLS
 15   os::init();
 16
 17   // Initialize system properties.
 18   Arguments::init_system_properties();
 19
 20   // So that JDK version can be used as a discrimintor when parsing arguments
 21   JDK_Version_init();
 22
 23   // Update/Initialize System properties after JDK version number is known
 24   Arguments::init_version_specific_system_properties();
 25
 26   // Parse arguments
 27   jint parse_result = Arguments::parse(args);
 28   if (parse_result != JNI_OK) return parse_result;
 29
 30   os::init_before_ergo();
 31
 32   jint ergo_result = Arguments::apply_ergo();
 33   if (ergo_result != JNI_OK) return ergo_result;
 34
 35   if (PauseAtStartup) {
 36     os::pause();
 37   }
 38
 39 #ifndef USDT2
 40   HS_DTRACE_PROBE(hotspot, vm__init__begin);
 41 #else /* USDT2 */
 42   HOTSPOT_VM_INIT_BEGIN();
 43 #endif /* USDT2 */
 44
 45   // Record VM creation timing statistics
 46   TraceVmCreationTime create_vm_timer;
 47   create_vm_timer.start();
 48
 49   // Timing (must come after argument parsing)
 50   TraceTime timer("Create VM", TraceStartupTime);
 51
 52   // Initialize the os module after parsing the args
 53   jint os_init_2_result = os::init_2();
 54   if (os_init_2_result != JNI_OK) return os_init_2_result;
 55
 56   jint adjust_after_os_result = Arguments::adjust_after_os();
 57   if (adjust_after_os_result != JNI_OK) return adjust_after_os_result;
 58
 59   // intialize TLS
 60   ThreadLocalStorage::init();
 61
 62   // Bootstrap native memory tracking, so it can start recording memory
 63   // activities before worker thread is started. This is the first phase
 64   // of bootstrapping, VM is currently running in single-thread mode.
 65   MemTracker::bootstrap_single_thread();
 66
 67   // Initialize output stream logging
 68   ostream_init_log();
 69
 70   // Convert -Xrun to -agentlib: if there is no JVM_OnLoad
 71   // Must be before create_vm_init_agents()
 72   if (Arguments::init_libraries_at_startup()) {
 73     convert_vm_init_libraries_to_agents();
 74   }
 75
 76   // Launch -agentlib/-agentpath and converted -Xrun agents
 77   if (Arguments::init_agents_at_startup()) {
 78     create_vm_init_agents();
 79   }
 80
 81   // Initialize Threads state
 82   _thread_list = NULL;
 83   _number_of_threads = 0;
 84   _number_of_non_daemon_threads = 0;
 85
 86   // Initialize global data structures and create system classes in heap
 87   vm_init_globals();
 88
 89   // Attach the main thread to this os thread
 90   JavaThread* main_thread = new JavaThread();
 91   main_thread->set_thread_state(_thread_in_vm);
 92   // must do this before set_active_handles and initialize_thread_local_storage
 93   // Note: on solaris initialize_thread_local_storage() will (indirectly)
 94   // change the stack size recorded here to one based on the java thread
 95   // stacksize. This adjusted size is what is used to figure the placement
 96   // of the guard pages.
 97   main_thread->record_stack_base_and_size();
 98   main_thread->initialize_thread_local_storage();
 99
100   main_thread->set_active_handles(JNIHandleBlock::allocate_block());
101
102   if (!main_thread->set_as_starting_thread()) {
103     vm_shutdown_during_initialization(
104       "Failed necessary internal allocation. Out of swap space");
105     delete main_thread;
106     *canTryAgain = false; // don't let caller call JNI_CreateJavaVM again
107     return JNI_ENOMEM;
108   }
109
110   // Enable guard page *after* os::create_main_thread(), otherwise it would
111   // crash Linux VM, see notes in os_linux.cpp.
112   main_thread->create_stack_guard_pages();
113
114   // Initialize Java-Level synchronization subsystem
115   ObjectMonitor::Initialize() ;
116
117   // Second phase of bootstrapping, VM is about entering multi-thread mode
118   MemTracker::bootstrap_multi_thread();
119
120   // Initialize global modules
121   jint status = init_globals();
122   if (status != JNI_OK) {
123     delete main_thread;
124     *canTryAgain = false; // don't let caller call JNI_CreateJavaVM again
125     return status;
126   }
127
128   // Should be done after the heap is fully created
129   main_thread->cache_global_variables();
130
131   HandleMark hm;
132
133   { MutexLocker mu(Threads_lock);
134     Threads::add(main_thread);
135   }
136
137   // Any JVMTI raw monitors entered in onload will transition into
138   // real raw monitor. VM is setup enough here for raw monitor enter.
139   JvmtiExport::transition_pending_onload_raw_monitors();
140
141   // Fully start NMT
142   MemTracker::start();
143
144   // Create the VMThread
145   { TraceTime timer("Start VMThread", TraceStartupTime);
146     VMThread::create();
147     Thread* vmthread = VMThread::vm_thread();
148
149     if (!os::create_thread(vmthread, os::vm_thread))
150       vm_exit_during_initialization("Cannot create VM thread. Out of system resources.");
151
152     // Wait for the VM thread to become ready, and VMThread::run to initialize
153     // Monitors can have spurious returns, must always check another state flag
154     {
155       MutexLocker ml(Notify_lock);
156       os::start_thread(vmthread);
157       while (vmthread->active_handles() == NULL) {
158         Notify_lock->wait();
159       }
160     }
161   }
162
163   assert (Universe::is_fully_initialized(), "not initialized");
164   if (VerifyDuringStartup) {
165     // Make sure we're starting with a clean slate.
166     VM_Verify verify_op;
167     VMThread::execute(&verify_op);
168   }
169
170   EXCEPTION_MARK;
171
172   // At this point, the Universe is initialized, but we have not executed
173   // any byte code.  Now is a good time (the only time) to dump out the
174   // internal state of the JVM for sharing.
175   if (DumpSharedSpaces) {
176     MetaspaceShared::preload_and_dump(CHECK_0);
177     ShouldNotReachHere();
178   }
179
180   // Always call even when there are not JVMTI environments yet, since environments
181   // may be attached late and JVMTI must track phases of VM execution
182   JvmtiExport::enter_start_phase();
183
184   // Notify JVMTI agents that VM has started (JNI is up) - nop if no agents.
185   JvmtiExport::post_vm_start();
186
187   {
188     TraceTime timer("Initialize java.lang classes", TraceStartupTime);
189
190     if (EagerXrunInit && Arguments::init_libraries_at_startup()) {
191       create_vm_init_libraries();
192     }
193
194     initialize_class(vmSymbols::java_lang_String(), CHECK_0);
195
196     // Initialize java_lang.System (needed before creating the thread)
197     initialize_class(vmSymbols::java_lang_System(), CHECK_0);
198     initialize_class(vmSymbols::java_lang_ThreadGroup(), CHECK_0);
199     Handle thread_group = create_initial_thread_group(CHECK_0);
200     Universe::set_main_thread_group(thread_group());
201     initialize_class(vmSymbols::java_lang_Thread(), CHECK_0);
202     oop thread_object = create_initial_thread(thread_group, main_thread, CHECK_0);
203     main_thread->set_threadObj(thread_object);
204     // Set thread status to running since main thread has
205     // been started and running.
206     java_lang_Thread::set_thread_status(thread_object,
207                                         java_lang_Thread::RUNNABLE);
208
209     // The VM creates & returns objects of this class. Make sure it's initialized.
210     initialize_class(vmSymbols::java_lang_Class(), CHECK_0);
211
212     // The VM preresolves methods to these classes. Make sure that they get initialized
213     initialize_class(vmSymbols::java_lang_reflect_Method(), CHECK_0);
214     initialize_class(vmSymbols::java_lang_ref_Finalizer(),  CHECK_0);
215     call_initializeSystemClass(CHECK_0);
216
217     // get the Java runtime name after java.lang.System is initialized
218     JDK_Version::set_runtime_name(get_java_runtime_name(THREAD));
219     JDK_Version::set_runtime_version(get_java_runtime_version(THREAD));
220
221     // an instance of OutOfMemory exception has been allocated earlier
222     initialize_class(vmSymbols::java_lang_OutOfMemoryError(), CHECK_0);
223     initialize_class(vmSymbols::java_lang_NullPointerException(), CHECK_0);
224     initialize_class(vmSymbols::java_lang_ClassCastException(), CHECK_0);
225     initialize_class(vmSymbols::java_lang_ArrayStoreException(), CHECK_0);
226     initialize_class(vmSymbols::java_lang_ArithmeticException(), CHECK_0);
227     initialize_class(vmSymbols::java_lang_StackOverflowError(), CHECK_0);
228     initialize_class(vmSymbols::java_lang_IllegalMonitorStateException(), CHECK_0);
229     initialize_class(vmSymbols::java_lang_IllegalArgumentException(), CHECK_0);
230   }
231
232   // See        : bugid 4211085.
233   // Background : the static initializer of java.lang.Compiler tries to read
234   //              property"java.compiler" and read & write property "java.vm.info".
235   //              When a security manager is installed through the command line
236   //              option "-Djava.security.manager", the above properties are not
237   //              readable and the static initializer for java.lang.Compiler fails
238   //              resulting in a NoClassDefFoundError.  This can happen in any
239   //              user code which calls methods in java.lang.Compiler.
240   // Hack :       the hack is to pre-load and initialize this class, so that only
241   //              system domains are on the stack when the properties are read.
242   //              Currently even the AWT code has calls to methods in java.lang.Compiler.
243   //              On the classic VM, java.lang.Compiler is loaded very early to load the JIT.
244   // Future Fix : the best fix is to grant everyone permissions to read "java.compiler" and
245   //              read and write"java.vm.info" in the default policy file. See bugid 4211383
246   //              Once that is done, we should remove this hack.
247   initialize_class(vmSymbols::java_lang_Compiler(), CHECK_0);
248
249   // More hackery - the static initializer of java.lang.Compiler adds the string "nojit" to
250   // the java.vm.info property if no jit gets loaded through java.lang.Compiler (the hotspot
251   // compiler does not get loaded through java.lang.Compiler).  "java -version" with the
252   // hotspot vm says "nojit" all the time which is confusing.  So, we reset it here.
253   // This should also be taken out as soon as 4211383 gets fixed.
254   reset_vm_info_property(CHECK_0);
255
256   quicken_jni_functions();
257
258   // Must be run after init_ft which initializes ft_enabled
259   if (TRACE_INITIALIZE() != JNI_OK) {
260     vm_exit_during_initialization("Failed to initialize tracing backend");
261   }
262
263   // Set flag that basic initialization has completed. Used by exceptions and various
264   // debug stuff, that does not work until all basic classes have been initialized.
265   set_init_completed();
266
267 #ifndef USDT2
268   HS_DTRACE_PROBE(hotspot, vm__init__end);
269 #else /* USDT2 */
270   HOTSPOT_VM_INIT_END();
271 #endif /* USDT2 */
272
273   // record VM initialization completion time
274 #if INCLUDE_MANAGEMENT
275   Management::record_vm_init_completed();
276 #endif // INCLUDE_MANAGEMENT
277
278   // Compute system loader. Note that this has to occur after set_init_completed, since
279   // valid exceptions may be thrown in the process.
280   // Note that we do not use CHECK_0 here since we are inside an EXCEPTION_MARK and
281   // set_init_completed has just been called, causing exceptions not to be shortcut
282   // anymore. We call vm_exit_during_initialization directly instead.
283   SystemDictionary::compute_java_system_loader(THREAD);
284   if (HAS_PENDING_EXCEPTION) {
285     vm_exit_during_initialization(Handle(THREAD, PENDING_EXCEPTION));
286   }
287
288 #if INCLUDE_ALL_GCS
289   // Support for ConcurrentMarkSweep. This should be cleaned up
290   // and better encapsulated. The ugly nested if test would go away
291   // once things are properly refactored. XXX YSR
292   if (UseConcMarkSweepGC || UseG1GC) {
293     if (UseConcMarkSweepGC) {
294       ConcurrentMarkSweepThread::makeSurrogateLockerThread(THREAD);
295     } else {
296       ConcurrentMarkThread::makeSurrogateLockerThread(THREAD);
297     }
298     if (HAS_PENDING_EXCEPTION) {
299       vm_exit_during_initialization(Handle(THREAD, PENDING_EXCEPTION));
300     }
301   }
302 #endif // INCLUDE_ALL_GCS
303
304   // Always call even when there are not JVMTI environments yet, since environments
305   // may be attached late and JVMTI must track phases of VM execution
306   JvmtiExport::enter_live_phase();
307
308   // Signal Dispatcher needs to be started before VMInit event is posted
309   os::signal_init();
310
311   // Start Attach Listener if +StartAttachListener or it can't be started lazily
312   if (!DisableAttachMechanism) {
313     AttachListener::vm_start();
314     if (StartAttachListener || AttachListener::init_at_startup()) {
315       AttachListener::init();
316     }
317   }
318
319   // Launch -Xrun agents
320   // Must be done in the JVMTI live phase so that for backward compatibility the JDWP
321   // back-end can launch with -Xdebug -Xrunjdwp.
322   if (!EagerXrunInit && Arguments::init_libraries_at_startup()) {
323     create_vm_init_libraries();
324   }
325
326   // Notify JVMTI agents that VM initialization is complete - nop if no agents.
327   JvmtiExport::post_vm_initialized();
328
329   if (TRACE_START() != JNI_OK) {
330     vm_exit_during_initialization("Failed to start tracing backend.");
331   }
332
333   if (CleanChunkPoolAsync) {
334     Chunk::start_chunk_pool_cleaner_task();
335   }
336
337   // initialize compiler(s)
338 #if defined(COMPILER1) || defined(COMPILER2) || defined(SHARK)
339   CompileBroker::compilation_init();
340 #endif
341
342   if (EnableInvokeDynamic) {
343     // Pre-initialize some JSR292 core classes to avoid deadlock during class loading.
344     // It is done after compilers are initialized, because otherwise compilations of
345     // signature polymorphic MH intrinsics can be missed
346     // (see SystemDictionary::find_method_handle_intrinsic).
347     initialize_class(vmSymbols::java_lang_invoke_MethodHandle(), CHECK_0);
348     initialize_class(vmSymbols::java_lang_invoke_MemberName(), CHECK_0);
349     initialize_class(vmSymbols::java_lang_invoke_MethodHandleNatives(), CHECK_0);
350   }
351
352 #if INCLUDE_MANAGEMENT
353   Management::initialize(THREAD);
354 #endif // INCLUDE_MANAGEMENT
355
356   if (HAS_PENDING_EXCEPTION) {
357     // management agent fails to start possibly due to
358     // configuration problem and is responsible for printing
359     // stack trace if appropriate. Simply exit VM.
360     vm_exit(1);
361   }
362
363   if (Arguments::has_profile())       FlatProfiler::engage(main_thread, true);
364   if (MemProfiling)                   MemProfiler::engage();
365   StatSampler::engage();
366   if (CheckJNICalls)                  JniPeriodicChecker::engage();
367
368   BiasedLocking::init();
369
370   if (JDK_Version::current().post_vm_init_hook_enabled()) {
371     call_postVMInitHook(THREAD);
372     // The Java side of PostVMInitHook.run must deal with all
373     // exceptions and provide means of diagnosis.
374     if (HAS_PENDING_EXCEPTION) {
375       CLEAR_PENDING_EXCEPTION;
376     }
377   }
378
379   {
380       MutexLockerEx ml(PeriodicTask_lock, Mutex::_no_safepoint_check_flag);
381       // Make sure the watcher thread can be started by WatcherThread::start()
382       // or by dynamic enrollment.
383       WatcherThread::make_startable();
384       // Start up the WatcherThread if there are any periodic tasks
385       // NOTE:  All PeriodicTasks should be registered by now. If they
386       //   aren't, late joiners might appear to start slowly (we might
387       //   take a while to process their first tick).
388       if (PeriodicTask::num_tasks() > 0) {
389           WatcherThread::start();
390       }
391   }
392
393   // Give os specific code one last chance to start
394   os::init_3();
395
396   create_vm_timer.end();
397 #ifdef ASSERT
398   _vm_complete = true;
399 #endif
400   return JNI_OK;
401 }

309 行处，看到了os::signal_init() 的调用（hotspot/src/share/vm/runtime/os.cpp），这就是我们要找的。接着，我们看下其具体实现

 1 void os::signal_init() {
 2   if (!ReduceSignalUsage) {
 3     // Setup JavaThread for processing signals
 4     EXCEPTION_MARK;
 5     Klass* k = SystemDictionary::resolve_or_fail(vmSymbols::java_lang_Thread(), true, CHECK);
 6     instanceKlassHandle klass (THREAD, k);
 7     instanceHandle thread_oop = klass->allocate_instance_handle(CHECK);
 8
 9     const char thread_name[] = "Signal Dispatcher";
10     Handle string = java_lang_String::create_from_str(thread_name, CHECK);
11
12     // Initialize thread_oop to put it into the system threadGroup
13     Handle thread_group (THREAD, Universe::system_thread_group());
14     JavaValue result(T_VOID);
15     JavaCalls::call_special(&result, thread_oop,
16                            klass,
17                            vmSymbols::object_initializer_name(),
18                            vmSymbols::threadgroup_string_void_signature(),
19                            thread_group,
20                            string,
21                            CHECK);
22
23     KlassHandle group(THREAD, SystemDictionary::ThreadGroup_klass());
24     JavaCalls::call_special(&result,
25                             thread_group,
26                             group,
27                             vmSymbols::add_method_name(),
28                             vmSymbols::thread_void_signature(),
29                             thread_oop,         // ARG 1
30                             CHECK);
31
32     os::signal_init_pd();
33
34     { MutexLocker mu(Threads_lock);
35       JavaThread* signal_thread = new JavaThread(&signal_thread_entry);
36
37       // At this point it may be possible that no osthread was created for the
38       // JavaThread due to lack of memory. We would have to throw an exception
39       // in that case. However, since this must work and we do not allow
40       // exceptions anyway, check and abort if this fails.
41       if (signal_thread == NULL || signal_thread->osthread() == NULL) {
42         vm_exit_during_initialization("java.lang.OutOfMemoryError",
43                                       "unable to create new native thread");
44       }
45
46       java_lang_Thread::set_thread(thread_oop(), signal_thread);
47       java_lang_Thread::set_priority(thread_oop(), NearMaxPriority);
48       java_lang_Thread::set_daemon(thread_oop());
49
50       signal_thread->set_threadObj(thread_oop());
51       Threads::add(signal_thread);
52       Thread::start(signal_thread);
53     }
54     // Handle ^BREAK
55     os::signal(SIGBREAK, os::user_handler());
56   }
57 }

这里的完全可以看出来，在此函数中35行处，创建了一个 java 线程，用于执行signal_thread_entry 函数，那我们来看看，这个 signal_thread_entry 函数到底做了什么？

 1 // sigexitnum_pd is a platform-specific special signal used for terminating the Signal thread.
 2 static void signal_thread_entry(JavaThread* thread, TRAPS) {
 3   os::set_priority(thread, NearMaxPriority);
 4   while (true) {
 5     int sig;
 6     {
 7       // FIXME : Currently we have not decieded what should be the status
 8       //         for this java thread blocked here. Once we decide about
 9       //         that we should fix this.
10       sig = os::signal_wait();
11     }
12     if (sig == os::sigexitnum_pd()) {
13        // Terminate the signal thread
14        return;
15     }
16
17     switch (sig) {
18       case SIGBREAK: {
19         // Check if the signal is a trigger to start the Attach Listener - in that
20         // case don't print stack traces.
21         if (!DisableAttachMechanism && AttachListener::is_init_trigger()) {
22           continue;
23         }
24         // Print stack traces
25         // Any SIGBREAK operations added here should make sure to flush
26         // the output stream (e.g. tty->flush()) after output.  See 4803766.
27         // Each module also prints an extra carriage return after its output.
28         VM_PrintThreads op;
29         VMThread::execute(&op);
30         VM_PrintJNI jni_op;
31         VMThread::execute(&jni_op);
32         VM_FindDeadlocks op1(tty);
33         VMThread::execute(&op1);
34         Universe::print_heap_at_SIGBREAK();
35         if (PrintClassHistogram) {
36           VM_GC_HeapInspection op1(gclog_or_tty, true /* force full GC before heap inspection */);
37           VMThread::execute(&op1);
38         }
39         if (JvmtiExport::should_post_data_dump()) {
40           JvmtiExport::post_data_dump();
41         }
42         break;
43       }
44       default: {
45         // Dispatch the signal to java
46         HandleMark hm(THREAD);
47         Klass* k = SystemDictionary::resolve_or_null(vmSymbols::sun_misc_Signal(), THREAD);
48         KlassHandle klass (THREAD, k);
49         if (klass.not_null()) {
50           JavaValue result(T_VOID);
51           JavaCallArguments args;
52           args.push_int(sig);
53           JavaCalls::call_static(
54             &result,
55             klass,
56             vmSymbols::dispatch_name(),
57             vmSymbols::int_void_signature(),
58             &args,
59             THREAD
60           );
61         }
62         if (HAS_PENDING_EXCEPTION) {
63           // tty is initialized early so we don't expect it to be null, but
64           // if it is we can't risk doing an initialization that might
65           // trigger additional out-of-memory conditions
66           if (tty != NULL) {
67             char klass_name[256];
68             char tmp_sig_name[16];
69             const char* sig_name = "UNKNOWN";
70             InstanceKlass::cast(PENDING_EXCEPTION->klass())->
71               name()->as_klass_external_name(klass_name, 256);
72             if (os::exception_name(sig, tmp_sig_name, 16) != NULL)
73               sig_name = tmp_sig_name;
74             warning("Exception %s occurred dispatching signal %s to handler"
75                     "- the VM may need to be forcibly terminated",
76                     klass_name, sig_name );
77           }
78           CLEAR_PENDING_EXCEPTION;
79         }
80       }
81     }
82   }
83 }

函数里面意思已经很清晰明了了，首先在10行处，有一个os::signal_wait()的调用，该调用的主要是阻塞当前线程，并等待接收系统信号，然后再根据接收到的信号 sig 做 switch 逻辑，对于不同的信号做不同的处理。至此，关于“目标 JVM 对OS信号监听的实现”这一点，就已经分析结束了。简单的一句话总结就是，JVM 在启动的时候，会创建一个名为“Signal Dispatcher”的线程用于接收os 的信号，以便对不同信号分别做处理。

文件 Socket 通信的通道的创建

经过3.1的分析，我们已经知道在 JVM 启动之后，内部会有线程监听并处理 os 的信号，那么，这个时候，如果我们想和已经启动的 JVM 建立通信，当然就可以毫不犹豫的使用信号来进行了。不过，基于信号的通信，也是存在限制的，一方面，os 支持的信号是有限的，二来信号的通信往往是单向的，不方便通信双方进行高效的通信。基于这些，笔者认为，为了使得 Client JVM 和 Target JVM 更好的通信，就采用了 Socket 通信来实现二者的通信。那接下来我们看看，这个通道究竟是如何创建的？

当我们需要 attach 到某个目标 JVM 进程上去的时候，我们通常会写如下代码

1 VirtualMachine vm = VirtualMachine.attach(pid);

这样我们就能得到目标 JVM 的相关信息了，是不是很简单？不过，今天我们要做的可不是这么简单的事情，我们需要深入其后，了解其根本。接下来我们就以com.sun.tools.attach.VirtualMachine的 attach 方法入手，逐层揭开其神秘面纱。

 1 public static VirtualMachine attach(String id)
 2         throws AttachNotSupportedException, IOException
 3     {
 4         if (id == null) {
 5             throw new NullPointerException("id cannot be null");
 6         }
 7         List<AttachProvider> providers = AttachProvider.providers();
 8         if (providers.size() == 0) {
 9             throw new AttachNotSupportedException("no providers installed");
10         }
11         AttachNotSupportedException lastExc = null;
12         for (AttachProvider provider: providers) {
13             try {
14                 return provider.attachVirtualMachine(id);
15             } catch (AttachNotSupportedException x) {
16                 lastExc = x;
17             }
18         }
19         throw lastExc;
20     }

这是attach的源码，入参为目标 JVM 的进程 ID，其实现委派给了 AttachProvider 了，通过provider.attachVirtualMachine(id);来实现真正的 attach 操作。由于 AttachProvider 是个抽象类，所以这个方法的真正实现在子类中，在 Linux 环境下，我们看 sun.tools.attach.BsdAttachProvider.java 的实现。

 1 public VirtualMachine attachVirtualMachine(String vmid)
 2         throws AttachNotSupportedException, IOException
 3     {
 4         checkAttachPermission();
 5
 6         // AttachNotSupportedException will be thrown if the target VM can be determined
 7         // to be not attachable.
 8         testAttachable(vmid);
 9
10         return new BsdVirtualMachine(this, vmid);
11     }

这个方法非常简单，就是 new 了一个 BsdVirtualMachine 对象，并且把目标进程 ID 带过去了。看sun.tools.attach.BsdVirtualMachine.java 的构造函数

 1 /**
 2      * Attaches to the target VM
 3      */
 4     BsdVirtualMachine(AttachProvider provider, String vmid)
 5         throws AttachNotSupportedException, IOException
 6     {
 7         super(provider, vmid);
 8
 9         // This provider only understands pids
10         int pid;
11         try {
12             pid = Integer.parseInt(vmid);
13         } catch (NumberFormatException x) {
14             throw new AttachNotSupportedException("Invalid process identifier");
15         }
16
17         // Find the socket file. If not found then we attempt to start the
18         // attach mechanism in the target VM by sending it a QUIT signal.
19         // Then we attempt to find the socket file again.
20         path = findSocketFile(pid);
21         if (path == null) {
22             File f = new File(tmpdir, ".attach_pid" + pid);
23             createAttachFile(f.getPath());
24             try {
25                 sendQuitTo(pid);
26
27                 // give the target VM time to start the attach mechanism
28                 int i = 0;
29                 long delay = 200;
30                 int retries = (int)(attachTimeout() / delay);
31                 do {
32                     try {
33                         Thread.sleep(delay);
34                     } catch (InterruptedException x) { }
35                     path = findSocketFile(pid);
36                     i++;
37                 } while (i <= retries && path == null);
38                 if (path == null) {
39                     throw new AttachNotSupportedException(
40                         "Unable to open socket file: target process not responding " +
41                         "or HotSpot VM not loaded");
42                 }
43             } finally {
44                 f.delete();
45             }
46         }
47
48         // Check that the file owner/permission to avoid attaching to
49         // bogus process
50         checkPermissions(path);
51
52         // Check that we can connect to the process
53         // - this ensures we throw the permission denied error now rather than
54         // later when we attempt to enqueue a command.
55         int s = socket();
56         try {
57             connect(s, path);
58         } finally {
59             close(s);
60         }
61     }

首先看20行处的findSocketFile(pid);这里是找对应的 socket （/tmp/.java_pid${pid}）文件，这个文件就是我们在第二大点图中画出来的，用于进程间通信的 socket 文件，如果不存在，即第一次进入该方法的时候。这时会运行到74行的createAttachFile(f.getPath());来创建一个attach 文件，socket 文件的命名方式为：/tmp/../.attach_pid${pid}，关于这两个方法（findSocketFile和createAttachFile）的具体实现，这里就不展开了，感兴趣的可以直接去查看jdk/src/solaris/native/sun/tools/attach/BsdVirtualMachine.c的相关源码。然后就会运行到一个非常关键的方法25行的sendQuitTo(pid);这个方法的实现，我们等会进入BsdVirtualMachine.c看下源码，其主要目的就是给该进程发送一个信号。之后会进入到31行处的 do...while循环，自旋反复轮询指定的次数来获取该 socket 文件的路径，直到超时或者 path（即 socket 文件路径） 不为空，最后在55行处，建立一个 socket，并且在57行处通过 path 进行 socket 的连接，从而完成了客户端（Client JVM）到目标进程（Target JVM）的 socket 通道建立。不过，请打住，这里是不是少了点什么？我相信细心的你肯定发现了，至少还存2个问题，

1. Target JVM 的 socket 服务端是何时创建的？

2. 用于通信的 socket 文件是在哪里创建的？

带着这两个问题，我们进入25行关键方法sendQuitTo(pid);的源码解读，该方法是个本地方法，位于jdk/src/solaris/native/sun/tools/attach/BsdVirtualMachine.c中

 1 /*
 2  * Class:     sun_tools_attach_BsdVirtualMachine
 3  * Method:    sendQuitTo
 4  * Signature: (I)V
 5  */
 6 JNIEXPORT void JNICALL Java_sun_tools_attach_BsdVirtualMachine_sendQuitTo
 7   (JNIEnv *env, jclass cls, jint pid)
 8 {
 9     if (kill((pid_t)pid, SIGQUIT)) {
10         JNU_ThrowIOExceptionWithLastError(env, "kill");
11     }
12 }

看到第9行的时候，是不是觉得这里必然和前面3.1中大篇幅分析的信号处理线程“Signal Dispatcher”有种必然联系了？没错，这里就是通过 kill 这个系统调用像目标 JVM，发送了一个 SIGQUIT 的信号，该信号是个#define，即宏，表示的数字“3”，即类似在 linux 命令行执行了“kill -3 ${pid}”的操做（其实，这个命令正是获取目标 JVM 线程 dump 文件的一种方式，读者可以试试）。既然这里向目标 JVM 发送了这么个信号，那么我们现在就移步到3.1中讲到过的 signal_thread_entry 方法中去。

 1 static void signal_thread_entry(JavaThread* thread, TRAPS) {
 2   os::set_priority(thread, NearMaxPriority);
 3   while (true) {
 4     int sig;
 5     {
 6       // FIXME : Currently we have not decieded what should be the status
 7       //         for this java thread blocked here. Once we decide about
 8       //         that we should fix this.
 9       sig = os::signal_wait();
10     }
11     if (sig == os::sigexitnum_pd()) {
12        // Terminate the signal thread
13        return;
14     }
15
16     switch (sig) {
17       case SIGBREAK: {
18         // Check if the signal is a trigger to start the Attach Listener - in that
19         // case don't print stack traces.
20         if (!DisableAttachMechanism && AttachListener::is_init_trigger()) {
21           continue;
22         }
23         // Print stack traces
24         // Any SIGBREAK operations added here should make sure to flush
25         // the output stream (e.g. tty->flush()) after output.  See 4803766.
26         // Each module also prints an extra carriage return after its output.
27         VM_PrintThreads op;
28         VMThread::execute(&op);
29         VM_PrintJNI jni_op;
30         VMThread::execute(&jni_op);
31         VM_FindDeadlocks op1(tty);
32         VMThread::execute(&op1);
33         Universe::print_heap_at_SIGBREAK();
34         if (PrintClassHistogram) {
35           VM_GC_HeapInspection op1(gclog_or_tty, true /* force full GC before heap inspection */);
36           VMThread::execute(&op1);
37         }
38         if (JvmtiExport::should_post_data_dump()) {
39           JvmtiExport::post_data_dump();
40         }
41         break;
42       }
43       default: {
44         // Dispatch the signal to java
45         HandleMark hm(THREAD);
46         Klass* k = SystemDictionary::resolve_or_null(vmSymbols::sun_misc_Signal(), THREAD);
47         KlassHandle klass (THREAD, k);
48         if (klass.not_null()) {
49           JavaValue result(T_VOID);
50           JavaCallArguments args;
51           args.push_int(sig);
52           JavaCalls::call_static(
53             &result,
54             klass,
55             vmSymbols::dispatch_name(),
56             vmSymbols::int_void_signature(),
57             &args,
58             THREAD
59           );
60         }
61         if (HAS_PENDING_EXCEPTION) {
62           // tty is initialized early so we don't expect it to be null, but
63           // if it is we can't risk doing an initialization that might
64           // trigger additional out-of-memory conditions
65           if (tty != NULL) {
66             char klass_name[256];
67             char tmp_sig_name[16];
68             const char* sig_name = "UNKNOWN";
69             InstanceKlass::cast(PENDING_EXCEPTION->klass())->
70               name()->as_klass_external_name(klass_name, 256);
71             if (os::exception_name(sig, tmp_sig_name, 16) != NULL)
72               sig_name = tmp_sig_name;
73             warning("Exception %s occurred dispatching signal %s to handler"
74                     "- the VM may need to be forcibly terminated",
75                     klass_name, sig_name );
76           }
77           CLEAR_PENDING_EXCEPTION;
78         }
79       }
80     }
81   }
82 }

这里的17行，我们看到了有个对 SIGBREAK（宏定义） 信号处理的 case，事实上，这个SIGBREAK和前面客户端发过来的SIGQUIT 的值是一样的，都是“3”，熟悉 C语言的读者应该不难理解。所以，当客户端发送这个信号给目标 JVM 时，就理所应当的进入了这个 case 的处理逻辑。这里的27行到40行，事实上就是对“kill -3 ${pid}”执行时对应的处理逻辑“进行目标 JVM 进程的线程 dump 操作”。现在我们重点关注一下20行的 if 语句，第一个 boolean 值，某认情况下是false（可通过/hotspot/src/share/vm/runtime/globals.c）查看，表示某认情况下是不禁止attach 机制的，于是就会进入第二个条件的判断AttachListener::is_init_trigger()，这里的判断还是比较有意思的（即判断当前杀是不是需要进行 attach 的初始化操作），我们进入源码，源码的文件为：hotspot/src/os/bsd/vm/attachListener_bsd.cpp

 1 // If the file .attach_pid<pid> exists in the working directory
 2 // or /tmp then this is the trigger to start the attach mechanism
 3 bool AttachListener::is_init_trigger() {
 4   if (init_at_startup() || is_initialized()) {
 5     return false;               // initialized at startup or already initialized
 6   }
 7   char path[PATH_MAX + 1];
 8   int ret;
 9   struct stat st;
10
11   snprintf(path, PATH_MAX + 1, "%s/.attach_pid%d",
12            os::get_temp_directory(), os::current_process_id());
13   RESTARTABLE(::stat(path, &st), ret);
14   if (ret == 0) {
15     // simple check to avoid starting the attach mechanism when
16     // a bogus user creates the file
17     if (st.st_uid == geteuid()) {
18       init();
19       return true;
20     }
21   }
22   return false;
23 }

方法进入的第一行，即判断是不是在 JVM 启动时就初始化或者之前已经初始化过，如果是，则直接返回，否则继续当前方法。方法的第11行，是在处理/tmp/attach_pid${pid}路径（这个文件就是 Client JVM 在attach 时创建的），并把 path 传入13行定义的宏进行判断，如果这个文件存在，且刚好是当前用户的创建的 attach_pid 文件，则进入18行的 init() 方法，否则什么也不做，返回 false。接着我们进入 init 的源码(hotspot/src/share/vm/services/attachListener.cpp)

 1 // Starts the Attach Listener thread
 2 void AttachListener::init() {
 3   EXCEPTION_MARK;
 4   Klass* k = SystemDictionary::resolve_or_fail(vmSymbols::java_lang_Thread(), true, CHECK);
 5   instanceKlassHandle klass (THREAD, k);
 6   instanceHandle thread_oop = klass->allocate_instance_handle(CHECK);
 7
 8   const char thread_name[] = "Attach Listener";
 9   Handle string = java_lang_String::create_from_str(thread_name, CHECK);
10
11   // Initialize thread_oop to put it into the system threadGroup
12   Handle thread_group (THREAD, Universe::system_thread_group());
13   JavaValue result(T_VOID);
14   JavaCalls::call_special(&result, thread_oop,
15                        klass,
16                        vmSymbols::object_initializer_name(),
17                        vmSymbols::threadgroup_string_void_signature(),
18                        thread_group,
19                        string,
20                        THREAD);
21
22   if (HAS_PENDING_EXCEPTION) {
23     tty->print_cr("Exception in VM (AttachListener::init) : ");
24     java_lang_Throwable::print(PENDING_EXCEPTION, tty);
25     tty->cr();
26
27     CLEAR_PENDING_EXCEPTION;
28
29     return;
30   }
31
32   KlassHandle group(THREAD, SystemDictionary::ThreadGroup_klass());
33   JavaCalls::call_special(&result,
34                         thread_group,
35                         group,
36                         vmSymbols::add_method_name(),
37                         vmSymbols::thread_void_signature(),
38                         thread_oop,             // ARG 1
39                         THREAD);
40
41   if (HAS_PENDING_EXCEPTION) {
42     tty->print_cr("Exception in VM (AttachListener::init) : ");
43     java_lang_Throwable::print(PENDING_EXCEPTION, tty);
44     tty->cr();
45
46     CLEAR_PENDING_EXCEPTION;
47
48     return;
49   }
50
51   { MutexLocker mu(Threads_lock);
52     JavaThread* listener_thread = new JavaThread(&attach_listener_thread_entry);
53
54     // Check that thread and osthread were created
55     if (listener_thread == NULL || listener_thread->osthread() == NULL) {
56       vm_exit_during_initialization("java.lang.OutOfMemoryError",
57                                     "unable to create new native thread");
58     }
59
60     java_lang_Thread::set_thread(thread_oop(), listener_thread);
61     java_lang_Thread::set_daemon(thread_oop());
62
63     listener_thread->set_threadObj(thread_oop());
64     Threads::add(listener_thread);
65     Thread::start(listener_thread);
66   }
67 }

从源码中，我们可以看出来，这里最主要的功能是，创建一个名为“Attach Listener”的 Java 线程，该线程启动后会调用attach_listener_thread_entry这个方法（52行），来完成有关的任务处理。进入attach_listener_thread_entry方法

 1 // The Attach Listener threads services a queue. It dequeues an operation
 2 // from the queue, examines the operation name (command), and dispatches
 3 // to the corresponding function to perform the operation.
 4
 5 static void attach_listener_thread_entry(JavaThread* thread, TRAPS) {
 6   os::set_priority(thread, NearMaxPriority);
 7
 8   thread->record_stack_base_and_size();
 9
10   if (AttachListener::pd_init() != 0) {
11     return;
12   }
13   AttachListener::set_initialized();
14
15   for (;;) {
16     AttachOperation* op = AttachListener::dequeue();
17     if (op == NULL) {
18       return;   // dequeue failed or shutdown
19     }
20
21     ResourceMark rm;
22     bufferedStream st;
23     jint res = JNI_OK;
24
25     // handle special detachall operation
26     if (strcmp(op->name(), AttachOperation::detachall_operation_name()) == 0) {
27       AttachListener::detachall();
28     } else {
29       // find the function to dispatch too
30       AttachOperationFunctionInfo* info = NULL;
31       for (int i=0; funcs[i].name != NULL; i++) {
32         const char* name = funcs[i].name;
33         assert(strlen(name) <= AttachOperation::name_length_max, "operation <= name_length_max");
34         if (strcmp(op->name(), name) == 0) {
35           info = &(funcs[i]);
36           break;
37         }
38       }
39
40       // check for platform dependent attach operation
41       if (info == NULL) {
42         info = AttachListener::pd_find_operation(op->name());
43       }
44
45       if (info != NULL) {
46         // dispatch to the function that implements this operation
47         res = (info->func)(op, &st);
48       } else {
49         st.print("Operation %s not recognized!", op->name());
50         res = JNI_ERR;
51       }
52     }
53
54     // operation complete - send result and output to client
55     op->complete(res, &st);
56   }
57 }

这里需要关注两个方面的内容，

第一、第10行的AttachListener::pd_init()；

第二、第15行开始的 for 循环里面的内容。

首先看AttachListener::pd_init()

 1 int AttachListener::pd_init() {
 2   JavaThread* thread = JavaThread::current();
 3   ThreadBlockInVM tbivm(thread);
 4
 5   thread->set_suspend_equivalent();
 6   // cleared by handle_special_suspend_equivalent_condition() or
 7   // java_suspend_self() via check_and_wait_while_suspended()
 8
 9   int ret_code = BsdAttachListener::init();
10
11   // were we externally suspended while we were waiting?
12   thread->check_and_wait_while_suspended();
13
14   return ret_code;
15 }

以上的 pd_init() 方法是在hotspot/src/os/bsd/vm/attachListener_bsd.cpp中实现的，我们看第9行的代码，调用了BsdAttachListener::init()一个这样的方法，该方法的主要作用就是生产 socket 通信文件的。源码如下

 1 // Initialization - create a listener socket and bind it to a file
 2
 3 int BsdAttachListener::init() {
 4   char path[UNIX_PATH_MAX];          // socket file
 5   char initial_path[UNIX_PATH_MAX];  // socket file during setup
 6   int listener;                      // listener socket (file descriptor)
 7
 8   // register function to cleanup
 9   ::atexit(listener_cleanup);
10
11   int n = snprintf(path, UNIX_PATH_MAX, "%s/.java_pid%d",
12                    os::get_temp_directory(), os::current_process_id());
13   if (n < (int)UNIX_PATH_MAX) {
14     n = snprintf(initial_path, UNIX_PATH_MAX, "%s.tmp", path);
15   }
16   if (n >= (int)UNIX_PATH_MAX) {
17     return -1;
18   }
19
20   // create the listener socket
21   listener = ::socket(PF_UNIX, SOCK_STREAM, 0);
22   if (listener == -1) {
23     return -1;
24   }
25
26   // bind socket
27   struct sockaddr_un addr;
28   addr.sun_family = AF_UNIX;
29   strcpy(addr.sun_path, initial_path);
30   ::unlink(initial_path);
31   int res = ::bind(listener, (struct sockaddr*)&addr, sizeof(addr));
32   if (res == -1) {
33     ::close(listener);
34     return -1;
35   }
36
37   // put in listen mode, set permissions, and rename into place
38   res = ::listen(listener, 5);
39   if (res == 0) {
40     RESTARTABLE(::chmod(initial_path, S_IREAD|S_IWRITE), res);
41     if (res == 0) {
42       // make sure the file is owned by the effective user and effective group
43       // (this is the default on linux, but not on mac os)
44       RESTARTABLE(::chown(initial_path, geteuid(), getegid()), res);
45       if (res == 0) {
46         res = ::rename(initial_path, path);
47       }
48     }
49   }
50   if (res == -1) {
51     ::close(listener);
52     ::unlink(initial_path);
53     return -1;
54   }
55   set_path(path);
56   set_listener(listener);
57
58   return 0;
59 }

从方法的注释，就能看出这个方法就是用来创建一个基于文件的 socket 的 listener 端，即服务端的。具体的创建过程，代码写的已经很清楚了，我做下简单描述，11行处，构建 socket 通信文件的路径（/tmp/.java_pid${pid}）,21 行，创建一个 socket，其中关注 socket 函数的第一个参数，当为 PF_UNIX 时，表示创建文件 socket，详情可以参考 linux 的 socket 函数说明，然后到29行，将 socket 文件 path 拷贝到 socket 通信地址中，即以此文件作为通信地址，然后在31行时，将 socket 和该 socket 文件地址做一个绑定，38行，表示对当前 socket 进行监听（数字5表示监听时可容纳客户端连接的队列的大小），如果有Client JVM 的客户端连接上来，并且发送了相关消息，该服务端就可以对其进行相应处理了。至此，进程间 socket 的通信的通道就建立了。

其次看下 for 循环做了什么？其实很简单，16行，BsdAttachListener::dequeue() 从监听器的队列中拿到一个 Client JVM 的AttachOperation（当客户端 attach 上 target JVM 之后，往目标 JVM 发送任意 socket 信息，都会被放置到这个队列中，等待被处理），此处会被阻塞，直到收到请求，如下源码的13行， socket 的 accept 函数处于等待状态，等待来之客户端 JVM 的相关请求，一旦获取到请求，则将请求组装好返回给调用者一个BadAttachOperation 对象。

 1 // Dequeue an operation
 2 //
 3 // In the Bsd implementation there is only a single operation and clients
 4 // cannot queue commands (except at the socket level).
 5 //
 6 BsdAttachOperation* BsdAttachListener::dequeue() {
 7   for (;;) {
 8     int s;
 9
10     // wait for client to connect
11     struct sockaddr addr;
12     socklen_t len = sizeof(addr);
13     RESTARTABLE(::accept(listener(), &addr, &len), s);
14     if (s == -1) {
15       return NULL;      // log a warning?
16     }
17
18     // get the credentials of the peer and check the effective uid/guid
19     // - check with jeff on this.
20     uid_t puid;
21     gid_t pgid;
22     if (::getpeereid(s, &puid, &pgid) != 0) {
23       ::close(s);
24       continue;
25     }
26     uid_t euid = geteuid();
27     gid_t egid = getegid();
28
29     if (puid != euid || pgid != egid) {
30       ::close(s);
31       continue;
32     }
33
34     // peer credential look okay so we read the request
35     BsdAttachOperation* op = read_request(s);
36     if (op == NULL) {
37       ::close(s);
38       continue;
39     } else {
40       return op;
41     }
42   }
43 }

所以，只要收到一个AttachOperation不为“detachall”的操纵请求就会进入到45行处进行处理，这里的目的就是为了拿到对应的操作AttachOperationFunctionInfo对象，如果不为空，则调用其func，来完成对客户端的响应，如47行所示。AttachOperationFunctionInfo（/hotspot/src/share/vm/services/attachListener.cpp）的定义如下

 1 // names must be of length <= AttachOperation::name_length_max
 2 static AttachOperationFunctionInfo funcs[] = {
 3   { "agentProperties",  get_agent_properties },
 4   { "datadump",         data_dump },
 5   { "dumpheap",         dump_heap },
 6   { "load",             JvmtiExport::load_agent_library },
 7   { "properties",       get_system_properties },
 8   { "threaddump",       thread_dump },
 9   { "inspectheap",      heap_inspection },
10   { "setflag",          set_flag },
11   { "printflag",        print_flag },
12   { "jcmd",             jcmd },
13   { NULL,               NULL }
14 };

从这里，我们可以看到，threaddump、dumpheap 等我们常用的操纵。到此为止，水落石出，涉及到 attach 操纵的服务端的原理基本已经理清楚了。接下来我们以 jstack 为例，来看下客户端 JVM 是不是确实是以我们上面分析出来的方式与服务端 JVM 进行通信，并获取到它想要的内容的。

JVM 对 Attach 上来的进程的命令的响应，以 jstack -l 为例

我们首先进入 jstack 的源码，源码目录为jdk/src/share/classes/sun/tools/jstack/JStack.java。进入 main 函数

 1 public static void main(String[] args) throws Exception {
 2         if (args.length == 0) {
 3             usage(1); // no arguments
 4         }
 5
 6         boolean useSA = false;
 7         boolean mixed = false;
 8         boolean locks = false;
 9
10         // Parse the options (arguments starting with "-" )
11         int optionCount = 0;
12         while (optionCount < args.length) {
13             String arg = args[optionCount];
14             if (!arg.startsWith("-")) {
15                 break;
16             }
17             if (arg.equals("-help") || arg.equals("-h")) {
18                 usage(0);
19             }
20             else if (arg.equals("-F")) {
21                 useSA = true;
22             }
23             else {
24                 if (arg.equals("-m")) {
25                     mixed = true;
26                 } else {
27                     if (arg.equals("-l")) {
28                        locks = true;
29                     } else {
30                         usage(1);
31                     }
32                 }
33             }
34             optionCount++;
35         }
36
37         // mixed stack implies SA tool
38         if (mixed) {
39             useSA = true;
40         }
41
42         // Next we check the parameter count. If there are two parameters
43         // we assume core file and executable so we use SA.
44         int paramCount = args.length - optionCount;
45         if (paramCount == 0 || paramCount > 2) {
46             usage(1);
47         }
48         if (paramCount == 2) {
49             useSA = true;
50         } else {
51             // If we can't parse it as a pid then it must be debug server
52             if (!args[optionCount].matches("[0-9]+")) {
53                 useSA = true;
54             }
55         }
56
57         // now execute using the SA JStack tool or the built-in thread dumper
58         if (useSA) {
59             // parameters (<pid> or <exe> <core>
60             String params[] = new String[paramCount];
61             for (int i=optionCount; i<args.length; i++ ){
62                 params[i-optionCount] = args[i];
63             }
64             runJStackTool(mixed, locks, params);
65         } else {
66             // pass -l to thread dump operation to get extra lock info
67             String pid = args[optionCount];
68             String params[];
69             if (locks) {
70                 params = new String[] { "-l" };
71             } else {
72                 params = new String[0];
73             }
74             runThreadDump(pid, params);
75         }
76     }

当采用 jstack -l 时，会走65行的 else 分支，最终执行77行的runThreadDump方法

 1 // Attach to pid and perform a thread dump
 2     private static void runThreadDump(String pid, String args[]) throws Exception {
 3         VirtualMachine vm = null;
 4         try {
 5             vm = VirtualMachine.attach(pid);
 6         } catch (Exception x) {
 7             String msg = x.getMessage();
 8             if (msg != null) {
 9                 System.err.println(pid + ": " + msg);
10             } else {
11                 x.printStackTrace();
12             }
13             if ((x instanceof AttachNotSupportedException) &&
14                 (loadSAClass() != null)) {
15                 System.err.println("The -F option can be used when the target " +
16                     "process is not responding");
17             }
18             System.exit(1);
19         }
20
21         // Cast to HotSpotVirtualMachine as this is implementation specific
22         // method.
23         InputStream in = ((HotSpotVirtualMachine)vm).remoteDataDump((Object[])args);
24
25         // read to EOF and just print output
26         byte b[] = new byte[256];
27         int n;
28         do {
29             n = in.read(b);
30             if (n > 0) {
31                 String s = new String(b, 0, n, "UTF-8");
32                 System.out.print(s);
33             }
34         } while (n > 0);
35         in.close();
36         vm.detach();
37     }

5行：执行VirtualMachine.attach(pid);则会达到3.1、3.2的效果，即服务端已经做好了所有 attach 所需的准备，如 socket 服务端、socket 通信文件、socket 请求处理线程“Attach Listener”。

23行：通过调用 HotSpotVirtualMachine 对象的 remoteDataDump 函数进行远程 dump，获得输入流 InputStream in，最后通过读取输入流的内容，来通过标准输出流输出从服务端获取的数据。至此，jstack -l 命令完成所有操作。

接下来，我们重点分析HotSpotVirtualMachine 对象的 remoteDataDump 函数。首先上HotSpotVirtualMachine（/jdk/src/share/classes/sun/tools/attach/HotSpotVirtualMachine.java） 对象的 remoteDataDump的源码

1 // Remote ctrl-break. The output of the ctrl-break actions can
2     // be read from the input stream.
3     public InputStream remoteDataDump(Object ... args) throws IOException {
4         return executeCommand("threaddump", args);
5     }

请注意4行的 cmd 字符串为“threaddump”，这个和3.2中 AttachOperationFunctionInfo 的定义是吻合的，也就是说最终在服务端会调用 thread_dump 方法，来执行线程 dump，并将结果返回给客户端。接着我们看下下 executeCommand方法，该方法只是简单的调用 execute 方法，如下

 1 /*
 2      * Convenience method for simple commands
 3      */
 4     private InputStream executeCommand(String cmd, Object ... args) throws IOException {
 5         try {
 6             return execute(cmd, args);
 7         } catch (AgentLoadException x) {
 8             throw new InternalError("Should not get here", x);
 9         }
10     }

exectue 方法在该类中为抽象方法，其具体实现放在了sun.tools.attach.BsdVirtualMachine.java中，我们看下在其具体实现这里可是最最关键的地方了

 1 /**
 2      * Execute the given command in the target VM.
 3      */
 4     InputStream execute(String cmd, Object ... args) throws AgentLoadException, IOException {
 5         assert args.length <= 3;                // includes null
 6
 7         // did we detach?
 8         String p;
 9         synchronized (this) {
10             if (this.path == null) {
11                 throw new IOException("Detached from target VM");
12             }
13             p = this.path;
14         }
15
16         // create UNIX socket
17         int s = socket();
18
19         // connect to target VM
20         try {
21             connect(s, p);
22         } catch (IOException x) {
23             close(s);
24             throw x;
25         }
26
27         IOException ioe = null;
28
29         // connected - write request
30         // <ver> <cmd> <args...>
31         try {
32             writeString(s, PROTOCOL_VERSION);
33             writeString(s, cmd);
34
35             for (int i=0; i<3; i++) {
36                 if (i < args.length && args[i] != null) {
37                     writeString(s, (String)args[i]);
38                 } else {
39                     writeString(s, "");
40                 }
41             }
42         } catch (IOException x) {
43             ioe = x;
44         }
45
46
47         // Create an input stream to read reply
48         SocketInputStream sis = new SocketInputStream(s);
49
50         // Read the command completion status
51         int completionStatus;
52         try {
53             completionStatus = readInt(sis);
54         } catch (IOException x) {
55             sis.close();
56             if (ioe != null) {
57                 throw ioe;
58             } else {
59                 throw x;
60             }
61         }
62
63         if (completionStatus != 0) {
64             sis.close();
65
66             // In the event of a protocol mismatch then the target VM
67             // returns a known error so that we can throw a reasonable
68             // error.
69             if (completionStatus == ATTACH_ERROR_BADVERSION) {
70                 throw new IOException("Protocol mismatch with target VM");
71             }
72
73             // Special-case the "load" command so that the right exception is
74             // thrown.
75             if (cmd.equals("load")) {
76                 throw new AgentLoadException("Failed to load agent library");
77             } else {
78                 throw new IOException("Command failed in target VM");
79             }
80         }
81
82         // Return the input stream so that the command output can be read
83         return sis;
84     }

17行：创建一个 socket，这个是 socket 是一个 jni 本地方法，有兴趣的可以去看对应的实现，源码在jdk/src/solaris/native/sun/tools/attach/BsdVirtualMachine.c中，其关键操作就一个return socket(PF_UNIX, SOCK_STREAM, 0) 客户端 socket 连接。

21行：这里也是一个本地方法，调用了 connect(s,p),这里的 p 就是 attach 时产生的/tmp/.java_pid${pid}的 socket 文件路径，这样，客户端就和目标 JVM 连接上了，该方法同样是一个 native 方法，可以通过查看BsdVirtualMachine.c的源码来进行查看，如下，重点在16行使用 socket 文件路径作为连接地址 和 18 行与目标 JVM 端启动的 socket server 建立连接；

 1 /*
 2  * Class:     sun_tools_attach_BsdVirtualMachine
 3  * Method:    connect
 4  * Signature: (ILjava/lang/String;)I
 5  */
 6 JNIEXPORT void JNICALL Java_sun_tools_attach_BsdVirtualMachine_connect
 7   (JNIEnv *env, jclass cls, jint fd, jstring path)
 8 {
 9     jboolean isCopy;
10     const char* p = GetStringPlatformChars(env, path, &isCopy);
11     if (p != NULL) {
12         struct sockaddr_un addr;
13         int err = 0;
14
15         addr.sun_family = AF_UNIX;
16         strcpy(addr.sun_path, p);
17
18         if (connect(fd, (struct sockaddr*)&addr, sizeof(addr)) == -1) {
19             err = errno;
20         }
21
22         if (isCopy) {
23             JNU_ReleaseStringPlatformChars(env, path, p);
24         }
25
26         /*
27          * If the connect failed then we throw the appropriate exception
28          * here (can't throw it before releasing the string as can't call
29          * JNI with pending exception)
30          */
31         if (err != 0) {
32             if (err == ENOENT) {
33                 JNU_ThrowByName(env, "java/io/FileNotFoundException", NULL);
34             } else {
35                 char* msg = strdup(strerror(err));
36                 JNU_ThrowIOException(env, msg);
37                 if (msg != NULL) {
38                     free(msg);
39                 }
40             }
41         }
42     }

31~44行：想 Target JVM 端发送命令 threaddump、以及可能存在的相关参数，如-l；这里的 writeString 同样是一个本地方法，涉及到的底层操作就是一个 C 语言库的 write 操作，感兴趣的可以自己看源码，不再赘述；

48~83行：这里就是对当前 socket 连接，构建一个 SocketInputStream 对象，并等待Target JVM 端数据完全返回，最后将这个 InputStream 对象作为方法返回参数返回。

总结

本文结合 Attach 的原理和使用案例（jstack -l），对 Attach 的各个方面都进行了深入的分析和总结，希望能对有需要的同学有所帮助。当然，以上均为本人个人所学，所以难免会有错误和疏忽的地方，如果您发现了，还麻烦指出。