Why does jstack not trigger a warning in target JVM >= 21?

[Aman Sharma]

Dear Bernd,


> You sure you do the same thing?


Was a bit confused, but Alan clarified it. Thanks!


Dear Alan,


> The warning is limited to cases where code (in the form of a JVMTI agent in a shared library, or a Java agent in an agent JAR file) is loaded into a running VM without opt-in on the command line


I was of the opinion that usage of any API in `com.sun.tools.attach`<https://docs.oracle.com/en/java/javase/21/docs/api/jdk.attach/com/sun/tools/attach/package-summary.html> package would trigger this warning, but it is clear to me now when the warning will be triggered. Thank you for your answer!


> , there are a number of commands implemented in Java that may be closer to what you are looking for.


We will take a look, thanks!


Regards,
Aman Sharma

PhD Student
KTH Royal Institute of Technology
School of Electrical Engineering and Computer Science (EECS)
Department of Theoretical Computer Science (TCS)
<http://www.kth.se><https://www.kth.se/profile/amansha><https://www.kth.se/profile/amansha>
<https://www.kth.se/profile/amansha>https://algomaster99.github.io/
________________________________
From: Alan Bateman <alan.bateman at oracle.com>
Sent: Tuesday, December 31, 2024 8:00:57 AM
To: Aman Sharma; serviceability-dev at openjdk.org
Cc: Serena Cofano
Subject: Re: Why does jstack not trigger a warning in target JVM >= 21?

On 30/12/2024 14:42, Aman Sharma wrote:

Hi all,


I hope this is the correct email thread to ask a question related to JEP 451: Prepare to Disallow the Dynamic Loading of Agents<https://openjdk.org/jeps/451>.


For some context, we at KTH are trying to build a serviceability tool that would monitor dependencies that are running in the target JVM. We looked at jstack for inspiration as it is able to return the stack trace of the target JVM, but we want classes instead and then we can get dependencies as we have annotated each class with dependency information.


While looking at jstack, we noticed that it does not trigger the warning "WARNING: A {Java,JVM TI} agent has been loaded dynamically" when the target JVM is 21. However, when we try to build our own agent using the attach API, we get the warning exactly how it says in the JEP. I initially thought that an exception was made for jstack in the open JDK code but I could find it either here<https://github.com/openjdk/jdk/blob/24c5ff7ba58cb7cf93df07f81484cd8fae60e31e/src/java.instrument/share/classes/sun/instrument/InstrumentationImpl.java#L107> or here<https://github.com/openjdk/jdk/blob/24c5ff7ba58cb7cf93df07f81484cd8fae60e31e/src/hotspot/share/prims/jvmtiAgent.cpp#L521>. Could anyone please tell us why a warning is not shown when jstack is dynamically attaching itself?

Attaching to a running VM to run diagnostic commands doesn't trigger a warning. The warning is limited to cases where code (in the form of a JVMTI agent in a shared library, or a Java agent in an agent JAR file) is loaded into a running VM without opt-in on the command line.

It might be that some of of the existing jcmd commands might give you inspiration. While most of the diagnostic commands in written in C++, there are a number of commands implemented in Java that may be closer to what you are looking for.

-Alan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://mail.openjdk.org/pipermail/serviceability-dev/attachments/20241231/753121ef/attachment.htm>