Do I have to use --illegal-access=permit for Java thin client and JDBC with JDK 9/10/11.

[Shane Duan]

Hi Igniter,

I understand that --illegal-access=permit is required for JDK 9/10/11 on
Ignite server. But do I have to  include this JVM parameter for Ignite Java
thin client and JDBC client? I tried some simple test without it and it
seems working fine...


Thanks,
Shane

[Denis Mekhanikov]

Hi!

There are two JDK internal things that are used by Ignite: Unsafe and sun.nio.ch package.
None of these things are used by thin clients. So, it’s fine to use thin clients without additional flags.

Denis

> On 13 Aug 2019, at 23:01, Shane Duan <[hidden email]> wrote:
>
> Hi Igniter,
>
> I understand that --illegal-access=permit is required for JDK 9/10/11 on
> Ignite server. But do I have to  include this JVM parameter for Ignite Java
> thin client and JDBC client? I tried some simple test without it and it
> seems working fine...
>
>
> Thanks,
> Shane

[Shane Duan]

Thanks for the confirmation!

On Wed, Aug 14, 2019 at 7:56 AM Denis Mekhanikov <[hidden email]>
wrote:

> Hi!
>
> There are two JDK internal things that are used by Ignite: Unsafe and
> sun.nio.ch package.
> None of these things are used by thin clients. So, it’s fine to use thin
> clients without additional flags.
>
> Denis
>
> > On 13 Aug 2019, at 23:01, Shane Duan <[hidden email]> wrote:
> >
> > Hi Igniter,
> >
> > I understand that --illegal-access=permit is required for JDK 9/10/11 on
> > Ignite server. But do I have to  include this JVM parameter for Ignite
> Java
> > thin client and JDBC client? I tried some simple test without it and it
> > seems working fine...
> >
> >
> > Thanks,
> > Shane
>
>

[dmagda]

Denis,

Does it mean we don't need to pass any flags from this list [1] at all for
the JDBC and thin clients?

[1]
https://apacheignite.readme.io/docs/getting-started#section-running-ignite-with-java-9-10-11

-
Denis


On Wed, Aug 14, 2019 at 5:56 PM Denis Mekhanikov <[hidden email]>
wrote:

> Hi!
>
> There are two JDK internal things that are used by Ignite: Unsafe and
> sun.nio.ch package.
> None of these things are used by thin clients. So, it’s fine to use thin
> clients without additional flags.
>
> Denis
>
> > On 13 Aug 2019, at 23:01, Shane Duan <[hidden email]> wrote:
> >
> > Hi Igniter,
> >
> > I understand that --illegal-access=permit is required for JDK 9/10/11 on
> > Ignite server. But do I have to  include this JVM parameter for Ignite
> Java
> > thin client and JDBC client? I tried some simple test without it and it
> > seems working fine...
> >
> >
> > Thanks,
> > Shane
>
>

[Denis Mekhanikov]

Denis,

I didn’t find any usages of JDK internals in the implementation of the thin clients.
It would be nice to verify in tests that thin clients can work without these flags.

Do our Java 9/10/11 tests include thin client testing? If so, do these tests include these flags?

Denis
On 15 Aug 2019, 11:09 +0300, Denis Magda <[hidden email]>, wrote:

> Denis,
>
> Does it mean we don't need to pass any flags from this list [1] at all for
> the JDBC and thin clients?
>
> [1]
> https://apacheignite.readme.io/docs/getting-started#section-running-ignite-with-java-9-10-11
>
> -
> Denis
>
>
> On Wed, Aug 14, 2019 at 5:56 PM Denis Mekhanikov <[hidden email]>
> wrote:
>
> > Hi!
> >
> > There are two JDK internal things that are used by Ignite: Unsafe and
> > sun.nio.ch package.
> > None of these things are used by thin clients. So, it’s fine to use thin
> > clients without additional flags.
> >
> > Denis
> >
> > > On 13 Aug 2019, at 23:01, Shane Duan <[hidden email]> wrote:
> > >
> > > Hi Igniter,
> > >
> > > I understand that --illegal-access=permit is required for JDK 9/10/11 on
> > > Ignite server. But do I have to include this JVM parameter for Ignite
> > Java
> > > thin client and JDBC client? I tried some simple test without it and it
> > > seems working fine...
> > >
> > >
> > > Thanks,
> > > Shane
> >
> >

[dmagda]

Ok, I updated the docs saying that

"4. Add the following VM options to your Java applications. That's not
needed if you use Java thin clients or Ignite JDBC."
https://apacheignite.readme.io/docs/getting-started#section-running-ignite-with-java-9-10-11

-
Denis


On Thu, Aug 22, 2019 at 9:30 AM Denis Mekhanikov <[hidden email]>
wrote:

> Denis,
>
> I didn’t find any usages of JDK internals in the implementation of the
> thin clients.
> It would be nice to verify in tests that thin clients can work without
> these flags.
>
> Do our Java 9/10/11 tests include thin client testing? If so, do these
> tests include these flags?
>
> Denis
> On 15 Aug 2019, 11:09 +0300, Denis Magda <[hidden email]>, wrote:
> > Denis,
> >
> > Does it mean we don't need to pass any flags from this list [1] at all
> for
> > the JDBC and thin clients?
> >
> > [1]
> >
> https://apacheignite.readme.io/docs/getting-started#section-running-ignite-with-java-9-10-11
> >
> > -
> > Denis
> >
> >
> > On Wed, Aug 14, 2019 at 5:56 PM Denis Mekhanikov <[hidden email]>
> > wrote:
> >
> > > Hi!
> > >
> > > There are two JDK internal things that are used by Ignite: Unsafe and
> > > sun.nio.ch package.
> > > None of these things are used by thin clients. So, it’s fine to use
> thin
> > > clients without additional flags.
> > >
> > > Denis
> > >
> > > > On 13 Aug 2019, at 23:01, Shane Duan <[hidden email]> wrote:
> > > >
> > > > Hi Igniter,
> > > >
> > > > I understand that --illegal-access=permit is required for JDK
> 9/10/11 on
> > > > Ignite server. But do I have to include this JVM parameter for Ignite
> > > Java
> > > > thin client and JDBC client? I tried some simple test without it and
> it
> > > > seems working fine...
> > > >
> > > >
> > > > Thanks,
> > > > Shane
> > >
> > >
>

[Alexey Plekhanov]

Denis,

Thin client uses BinaryHeapOutputStream, which uses Unsafe. I've got some
warnings when I run thin client with --illegal-access=debug flag, for
example:

WARNING: Illegal reflective access by
org.apache.ignite.internal.util.GridUnsafe$2
(file:/D:/Work/Projects/ignite/modules/core/target/classes/) to field
java.nio.Buffer.address
at org.apache.ignite.internal.util.GridUnsafe$2.run(GridUnsafe.java:1536)
at org.apache.ignite.internal.util.GridUnsafe$2.run(GridUnsafe.java:1531)
at
java.base/java.security.AccessController.doPrivileged(AccessController.java:310)
at
org.apache.ignite.internal.util.GridUnsafe.bufferAddressOffset(GridUnsafe.java:1531)
at org.apache.ignite.internal.util.GridUnsafe.<clinit>(GridUnsafe.java:106)
at
org.apache.ignite.internal.binary.streams.BinaryHeapOutputStream.writeIntFast(BinaryHeapOutputStream.java:122)
at
org.apache.ignite.internal.binary.streams.BinaryAbstractOutputStream.writeInt(BinaryAbstractOutputStream.java:123)


чт, 22 авг. 2019 г. в 23:43, Denis Magda <[hidden email]>:

> Ok, I updated the docs saying that
>
> "4. Add the following VM options to your Java applications. That's not
> needed if you use Java thin clients or Ignite JDBC."
>
> https://apacheignite.readme.io/docs/getting-started#section-running-ignite-with-java-9-10-11
>
> -
> Denis
>
>
> On Thu, Aug 22, 2019 at 9:30 AM Denis Mekhanikov <[hidden email]>
> wrote:
>
> > Denis,
> >
> > I didn’t find any usages of JDK internals in the implementation of the
> > thin clients.
> > It would be nice to verify in tests that thin clients can work without
> > these flags.
> >
> > Do our Java 9/10/11 tests include thin client testing? If so, do these
> > tests include these flags?
> >
> > Denis
> > On 15 Aug 2019, 11:09 +0300, Denis Magda <[hidden email]>, wrote:
> > > Denis,
> > >
> > > Does it mean we don't need to pass any flags from this list [1] at all
> > for
> > > the JDBC and thin clients?
> > >
> > > [1]
> > >
> >
> https://apacheignite.readme.io/docs/getting-started#section-running-ignite-with-java-9-10-11
> > >
> > > -
> > > Denis
> > >
> > >
> > > On Wed, Aug 14, 2019 at 5:56 PM Denis Mekhanikov <
> [hidden email]>
> > > wrote:
> > >
> > > > Hi!
> > > >
> > > > There are two JDK internal things that are used by Ignite: Unsafe and
> > > > sun.nio.ch package.
> > > > None of these things are used by thin clients. So, it’s fine to use
> > thin
> > > > clients without additional flags.
> > > >
> > > > Denis
> > > >
> > > > > On 13 Aug 2019, at 23:01, Shane Duan <[hidden email]> wrote:
> > > > >
> > > > > Hi Igniter,
> > > > >
> > > > > I understand that --illegal-access=permit is required for JDK
> > 9/10/11 on
> > > > > Ignite server. But do I have to include this JVM parameter for
> Ignite
> > > > Java
> > > > > thin client and JDBC client? I tried some simple test without it
> and
> > it
> > > > > seems working fine...
> > > > >
> > > > >
> > > > > Thanks,
> > > > > Shane
> > > >
> > > >
> >
>

[dmagda]

Hmm, looks like we need to provide some VM options for the thin clients as
well.

Alex, would you mind checking and sharing a full subset of such options for
the thin clients? I'll update the docs.

-
Denis


On Fri, Aug 23, 2019 at 9:23 AM Alex Plehanov <[hidden email]>
wrote:

> Denis,
>
> Thin client uses BinaryHeapOutputStream, which uses Unsafe. I've got some
> warnings when I run thin client with --illegal-access=debug flag, for
> example:
>
> WARNING: Illegal reflective access by
> org.apache.ignite.internal.util.GridUnsafe$2
> (file:/D:/Work/Projects/ignite/modules/core/target/classes/) to field
> java.nio.Buffer.address
> at org.apache.ignite.internal.util.GridUnsafe$2.run(GridUnsafe.java:1536)
> at org.apache.ignite.internal.util.GridUnsafe$2.run(GridUnsafe.java:1531)
> at
>
> java.base/java.security.AccessController.doPrivileged(AccessController.java:310)
> at
>
> org.apache.ignite.internal.util.GridUnsafe.bufferAddressOffset(GridUnsafe.java:1531)
> at org.apache.ignite.internal.util.GridUnsafe.<clinit>(GridUnsafe.java:106)
> at
>
> org.apache.ignite.internal.binary.streams.BinaryHeapOutputStream.writeIntFast(BinaryHeapOutputStream.java:122)
> at
>
> org.apache.ignite.internal.binary.streams.BinaryAbstractOutputStream.writeInt(BinaryAbstractOutputStream.java:123)
>
>
> чт, 22 авг. 2019 г. в 23:43, Denis Magda <[hidden email]>:
>
> > Ok, I updated the docs saying that
> >
> > "4. Add the following VM options to your Java applications. That's not
> > needed if you use Java thin clients or Ignite JDBC."
> >
> >
> https://apacheignite.readme.io/docs/getting-started#section-running-ignite-with-java-9-10-11
> >
> > -
> > Denis
> >
> >
> > On Thu, Aug 22, 2019 at 9:30 AM Denis Mekhanikov <[hidden email]>
> > wrote:
> >
> > > Denis,
> > >
> > > I didn’t find any usages of JDK internals in the implementation of the
> > > thin clients.
> > > It would be nice to verify in tests that thin clients can work without
> > > these flags.
> > >
> > > Do our Java 9/10/11 tests include thin client testing? If so, do these
> > > tests include these flags?
> > >
> > > Denis
> > > On 15 Aug 2019, 11:09 +0300, Denis Magda <[hidden email]>, wrote:
> > > > Denis,
> > > >
> > > > Does it mean we don't need to pass any flags from this list [1] at
> all
> > > for
> > > > the JDBC and thin clients?
> > > >
> > > > [1]
> > > >
> > >
> >
> https://apacheignite.readme.io/docs/getting-started#section-running-ignite-with-java-9-10-11
> > > >
> > > > -
> > > > Denis
> > > >
> > > >
> > > > On Wed, Aug 14, 2019 at 5:56 PM Denis Mekhanikov <
> > [hidden email]>
> > > > wrote:
> > > >
> > > > > Hi!
> > > > >
> > > > > There are two JDK internal things that are used by Ignite: Unsafe
> and
> > > > > sun.nio.ch package.
> > > > > None of these things are used by thin clients. So, it’s fine to use
> > > thin
> > > > > clients without additional flags.
> > > > >
> > > > > Denis
> > > > >
> > > > > > On 13 Aug 2019, at 23:01, Shane Duan <[hidden email]>
> wrote:
> > > > > >
> > > > > > Hi Igniter,
> > > > > >
> > > > > > I understand that --illegal-access=permit is required for JDK
> > > 9/10/11 on
> > > > > > Ignite server. But do I have to include this JVM parameter for
> > Ignite
> > > > > Java
> > > > > > thin client and JDBC client? I tried some simple test without it
> > and
> > > it
> > > > > > seems working fine...
> > > > > >
> > > > > >
> > > > > > Thanks,
> > > > > > Shane
> > > > >
> > > > >
> > >
> >
>

[Alexey Plekhanov]

Denis,

I've tried Oracle JDK 11 and OpenJDK 12 with Ignite 2.7.5, looks like:
"--add-exports=java.base/jdk.internal.misc=ALL-UNNAMED"
Is enough for running java thin client.
Also, adding:
"--add-opens=java.base/java.nio=ALL-UNNAMED"
Eliminates all warnings about illegal access (with
"--illegal-access=permit" warnings are still shown)

About "--illegal-access=permit" flag, AFAIK this is the default value for
currently released java versions (11, 12). But with option
"--add-opens=java.base/java.nio=ALL-UNNAMED" thin client also works even if
"--illegal-access=deny" is set.

 пт, 23 авг. 2019 г. в 19:44, Denis Magda <[hidden email]>:

> Hmm, looks like we need to provide some VM options for the thin clients as
> well.
>
> Alex, would you mind checking and sharing a full subset of such options for
> the thin clients? I'll update the docs.
>
> -
> Denis
>
>
> On Fri, Aug 23, 2019 at 9:23 AM Alex Plehanov <[hidden email]>
> wrote:
>
> > Denis,
> >
> > Thin client uses BinaryHeapOutputStream, which uses Unsafe. I've got some
> > warnings when I run thin client with --illegal-access=debug flag, for
> > example:
> >
> > WARNING: Illegal reflective access by
> > org.apache.ignite.internal.util.GridUnsafe$2
> > (file:/D:/Work/Projects/ignite/modules/core/target/classes/) to field
> > java.nio.Buffer.address
> > at org.apache.ignite.internal.util.GridUnsafe$2.run(GridUnsafe.java:1536)
> > at org.apache.ignite.internal.util.GridUnsafe$2.run(GridUnsafe.java:1531)
> > at
> >
> >
> java.base/java.security.AccessController.doPrivileged(AccessController.java:310)
> > at
> >
> >
> org.apache.ignite.internal.util.GridUnsafe.bufferAddressOffset(GridUnsafe.java:1531)
> > at
> org.apache.ignite.internal.util.GridUnsafe.<clinit>(GridUnsafe.java:106)
> > at
> >
> >
> org.apache.ignite.internal.binary.streams.BinaryHeapOutputStream.writeIntFast(BinaryHeapOutputStream.java:122)
> > at
> >
> >
> org.apache.ignite.internal.binary.streams.BinaryAbstractOutputStream.writeInt(BinaryAbstractOutputStream.java:123)
> >
> >
> > чт, 22 авг. 2019 г. в 23:43, Denis Magda <[hidden email]>:
> >
> > > Ok, I updated the docs saying that
> > >
> > > "4. Add the following VM options to your Java applications. That's not
> > > needed if you use Java thin clients or Ignite JDBC."
> > >
> > >
> >
> https://apacheignite.readme.io/docs/getting-started#section-running-ignite-with-java-9-10-11
> > >
> > > -
> > > Denis
> > >
> > >
> > > On Thu, Aug 22, 2019 at 9:30 AM Denis Mekhanikov <
> [hidden email]>
> > > wrote:
> > >
> > > > Denis,
> > > >
> > > > I didn’t find any usages of JDK internals in the implementation of
> the
> > > > thin clients.
> > > > It would be nice to verify in tests that thin clients can work
> without
> > > > these flags.
> > > >
> > > > Do our Java 9/10/11 tests include thin client testing? If so, do
> these
> > > > tests include these flags?
> > > >
> > > > Denis
> > > > On 15 Aug 2019, 11:09 +0300, Denis Magda <[hidden email]>, wrote:
> > > > > Denis,
> > > > >
> > > > > Does it mean we don't need to pass any flags from this list [1] at
> > all
> > > > for
> > > > > the JDBC and thin clients?
> > > > >
> > > > > [1]
> > > > >
> > > >
> > >
> >
> https://apacheignite.readme.io/docs/getting-started#section-running-ignite-with-java-9-10-11
> > > > >
> > > > > -
> > > > > Denis
> > > > >
> > > > >
> > > > > On Wed, Aug 14, 2019 at 5:56 PM Denis Mekhanikov <
> > > [hidden email]>
> > > > > wrote:
> > > > >
> > > > > > Hi!
> > > > > >
> > > > > > There are two JDK internal things that are used by Ignite: Unsafe
> > and
> > > > > > sun.nio.ch package.
> > > > > > None of these things are used by thin clients. So, it’s fine to
> use
> > > > thin
> > > > > > clients without additional flags.
> > > > > >
> > > > > > Denis
> > > > > >
> > > > > > > On 13 Aug 2019, at 23:01, Shane Duan <[hidden email]>
> > wrote:
> > > > > > >
> > > > > > > Hi Igniter,
> > > > > > >
> > > > > > > I understand that --illegal-access=permit is required for JDK
> > > > 9/10/11 on
> > > > > > > Ignite server. But do I have to include this JVM parameter for
> > > Ignite
> > > > > > Java
> > > > > > > thin client and JDBC client? I tried some simple test without
> it
> > > and
> > > > it
> > > > > > > seems working fine...
> > > > > > >
> > > > > > >
> > > > > > > Thanks,
> > > > > > > Shane
> > > > > >
> > > > > >
> > > >
> > >
> >
>

[Dmitry Pavlov]

Hi Alex, Would it be reasonable to migrate exports to --add-opens?

Thin clients don't use Unsafe, so --illegal-access=deny has no effect.

--illegal-acess=pertmit is also well known that it is a default value. I
guess it was added to compensate future Java defaults changes from permit
to deny. We can save one more release if Ignite will work on a future
release of Java, where `permit` is not  default.

Sincerely,
Dmitriy Pavlov

пн, 26 авг. 2019 г. в 15:51, Alex Plehanov <[hidden email]>:

> Denis,
>
> I've tried Oracle JDK 11 and OpenJDK 12 with Ignite 2.7.5, looks like:
> "--add-exports=java.base/jdk.internal.misc=ALL-UNNAMED"
> Is enough for running java thin client.
> Also, adding:
> "--add-opens=java.base/java.nio=ALL-UNNAMED"
> Eliminates all warnings about illegal access (with
> "--illegal-access=permit" warnings are still shown)
>
> About "--illegal-access=permit" flag, AFAIK this is the default value for
> currently released java versions (11, 12). But with option
> "--add-opens=java.base/java.nio=ALL-UNNAMED" thin client also works even if
> "--illegal-access=deny" is set.
>
>  пт, 23 авг. 2019 г. в 19:44, Denis Magda <[hidden email]>:
>
> > Hmm, looks like we need to provide some VM options for the thin clients
> as
> > well.
> >
> > Alex, would you mind checking and sharing a full subset of such options
> for
> > the thin clients? I'll update the docs.
> >
> > -
> > Denis
> >
> >
> > On Fri, Aug 23, 2019 at 9:23 AM Alex Plehanov <[hidden email]>
> > wrote:
> >
> > > Denis,
> > >
> > > Thin client uses BinaryHeapOutputStream, which uses Unsafe. I've got
> some
> > > warnings when I run thin client with --illegal-access=debug flag, for
> > > example:
> > >
> > > WARNING: Illegal reflective access by
> > > org.apache.ignite.internal.util.GridUnsafe$2
> > > (file:/D:/Work/Projects/ignite/modules/core/target/classes/) to field
> > > java.nio.Buffer.address
> > > at
> org.apache.ignite.internal.util.GridUnsafe$2.run(GridUnsafe.java:1536)
> > > at
> org.apache.ignite.internal.util.GridUnsafe$2.run(GridUnsafe.java:1531)
> > > at
> > >
> > >
> >
> java.base/java.security.AccessController.doPrivileged(AccessController.java:310)
> > > at
> > >
> > >
> >
> org.apache.ignite.internal.util.GridUnsafe.bufferAddressOffset(GridUnsafe.java:1531)
> > > at
> > org.apache.ignite.internal.util.GridUnsafe.<clinit>(GridUnsafe.java:106)
> > > at
> > >
> > >
> >
> org.apache.ignite.internal.binary.streams.BinaryHeapOutputStream.writeIntFast(BinaryHeapOutputStream.java:122)
> > > at
> > >
> > >
> >
> org.apache.ignite.internal.binary.streams.BinaryAbstractOutputStream.writeInt(BinaryAbstractOutputStream.java:123)
> > >
> > >
> > > чт, 22 авг. 2019 г. в 23:43, Denis Magda <[hidden email]>:
> > >
> > > > Ok, I updated the docs saying that
> > > >
> > > > "4. Add the following VM options to your Java applications. That's
> not
> > > > needed if you use Java thin clients or Ignite JDBC."
> > > >
> > > >
> > >
> >
> https://apacheignite.readme.io/docs/getting-started#section-running-ignite-with-java-9-10-11
> > > >
> > > > -
> > > > Denis
> > > >
> > > >
> > > > On Thu, Aug 22, 2019 at 9:30 AM Denis Mekhanikov <
> > [hidden email]>
> > > > wrote:
> > > >
> > > > > Denis,
> > > > >
> > > > > I didn’t find any usages of JDK internals in the implementation of
> > the
> > > > > thin clients.
> > > > > It would be nice to verify in tests that thin clients can work
> > without
> > > > > these flags.
> > > > >
> > > > > Do our Java 9/10/11 tests include thin client testing? If so, do
> > these
> > > > > tests include these flags?
> > > > >
> > > > > Denis
> > > > > On 15 Aug 2019, 11:09 +0300, Denis Magda <[hidden email]>,
> wrote:
> > > > > > Denis,
> > > > > >
> > > > > > Does it mean we don't need to pass any flags from this list [1]
> at
> > > all
> > > > > for
> > > > > > the JDBC and thin clients?
> > > > > >
> > > > > > [1]
> > > > > >
> > > > >
> > > >
> > >
> >
> https://apacheignite.readme.io/docs/getting-started#section-running-ignite-with-java-9-10-11
> > > > > >
> > > > > > -
> > > > > > Denis
> > > > > >
> > > > > >
> > > > > > On Wed, Aug 14, 2019 at 5:56 PM Denis Mekhanikov <
> > > > [hidden email]>
> > > > > > wrote:
> > > > > >
> > > > > > > Hi!
> > > > > > >
> > > > > > > There are two JDK internal things that are used by Ignite:
> Unsafe
> > > and
> > > > > > > sun.nio.ch package.
> > > > > > > None of these things are used by thin clients. So, it’s fine to
> > use
> > > > > thin
> > > > > > > clients without additional flags.
> > > > > > >
> > > > > > > Denis
> > > > > > >
> > > > > > > > On 13 Aug 2019, at 23:01, Shane Duan <[hidden email]>
> > > wrote:
> > > > > > > >
> > > > > > > > Hi Igniter,
> > > > > > > >
> > > > > > > > I understand that --illegal-access=permit is required for JDK
> > > > > 9/10/11 on
> > > > > > > > Ignite server. But do I have to include this JVM parameter
> for
> > > > Ignite
> > > > > > > Java
> > > > > > > > thin client and JDBC client? I tried some simple test without
> > it
> > > > and
> > > > > it
> > > > > > > > seems working fine...
> > > > > > > >
> > > > > > > >
> > > > > > > > Thanks,
> > > > > > > > Shane
> > > > > > >
> > > > > > >
> > > > >
> > > >
> > >
> >
>

[Alexey Plekhanov]

Dmitry,

As I said before, thin client uses BinaryHeapOutputStream, which uses
Unsafe, so "--illegal-access=deny" has an effect.
With "--illegal-access=deny" thin client will not start unless you specify
"--add-opens=java.base/java.nio=ALL-UNNAMED"

пн, 26 авг. 2019 г. в 15:57, Dmitriy Pavlov <[hidden email]>:

> Hi Alex, Would it be reasonable to migrate exports to --add-opens?
>
> Thin clients don't use Unsafe, so --illegal-access=deny has no effect.
>
> --illegal-acess=pertmit is also well known that it is a default value. I
> guess it was added to compensate future Java defaults changes from permit
> to deny. We can save one more release if Ignite will work on a future
> release of Java, where `permit` is not  default.
>
> Sincerely,
> Dmitriy Pavlov
>
> пн, 26 авг. 2019 г. в 15:51, Alex Plehanov <[hidden email]>:
>
> > Denis,
> >
> > I've tried Oracle JDK 11 and OpenJDK 12 with Ignite 2.7.5, looks like:
> > "--add-exports=java.base/jdk.internal.misc=ALL-UNNAMED"
> > Is enough for running java thin client.
> > Also, adding:
> > "--add-opens=java.base/java.nio=ALL-UNNAMED"
> > Eliminates all warnings about illegal access (with
> > "--illegal-access=permit" warnings are still shown)
> >
> > About "--illegal-access=permit" flag, AFAIK this is the default value for
> > currently released java versions (11, 12). But with option
> > "--add-opens=java.base/java.nio=ALL-UNNAMED" thin client also works even
> if
> > "--illegal-access=deny" is set.
> >
> >  пт, 23 авг. 2019 г. в 19:44, Denis Magda <[hidden email]>:
> >
> > > Hmm, looks like we need to provide some VM options for the thin clients
> > as
> > > well.
> > >
> > > Alex, would you mind checking and sharing a full subset of such options
> > for
> > > the thin clients? I'll update the docs.
> > >
> > > -
> > > Denis
> > >
> > >
> > > On Fri, Aug 23, 2019 at 9:23 AM Alex Plehanov <[hidden email]
> >
> > > wrote:
> > >
> > > > Denis,
> > > >
> > > > Thin client uses BinaryHeapOutputStream, which uses Unsafe. I've got
> > some
> > > > warnings when I run thin client with --illegal-access=debug flag, for
> > > > example:
> > > >
> > > > WARNING: Illegal reflective access by
> > > > org.apache.ignite.internal.util.GridUnsafe$2
> > > > (file:/D:/Work/Projects/ignite/modules/core/target/classes/) to field
> > > > java.nio.Buffer.address
> > > > at
> > org.apache.ignite.internal.util.GridUnsafe$2.run(GridUnsafe.java:1536)
> > > > at
> > org.apache.ignite.internal.util.GridUnsafe$2.run(GridUnsafe.java:1531)
> > > > at
> > > >
> > > >
> > >
> >
> java.base/java.security.AccessController.doPrivileged(AccessController.java:310)
> > > > at
> > > >
> > > >
> > >
> >
> org.apache.ignite.internal.util.GridUnsafe.bufferAddressOffset(GridUnsafe.java:1531)
> > > > at
> > >
> org.apache.ignite.internal.util.GridUnsafe.<clinit>(GridUnsafe.java:106)
> > > > at
> > > >
> > > >
> > >
> >
> org.apache.ignite.internal.binary.streams.BinaryHeapOutputStream.writeIntFast(BinaryHeapOutputStream.java:122)
> > > > at
> > > >
> > > >
> > >
> >
> org.apache.ignite.internal.binary.streams.BinaryAbstractOutputStream.writeInt(BinaryAbstractOutputStream.java:123)
> > > >
> > > >
> > > > чт, 22 авг. 2019 г. в 23:43, Denis Magda <[hidden email]>:
> > > >
> > > > > Ok, I updated the docs saying that
> > > > >
> > > > > "4. Add the following VM options to your Java applications. That's
> > not
> > > > > needed if you use Java thin clients or Ignite JDBC."
> > > > >
> > > > >
> > > >
> > >
> >
> https://apacheignite.readme.io/docs/getting-started#section-running-ignite-with-java-9-10-11
> > > > >
> > > > > -
> > > > > Denis
> > > > >
> > > > >
> > > > > On Thu, Aug 22, 2019 at 9:30 AM Denis Mekhanikov <
> > > [hidden email]>
> > > > > wrote:
> > > > >
> > > > > > Denis,
> > > > > >
> > > > > > I didn’t find any usages of JDK internals in the implementation
> of
> > > the
> > > > > > thin clients.
> > > > > > It would be nice to verify in tests that thin clients can work
> > > without
> > > > > > these flags.
> > > > > >
> > > > > > Do our Java 9/10/11 tests include thin client testing? If so, do
> > > these
> > > > > > tests include these flags?
> > > > > >
> > > > > > Denis
> > > > > > On 15 Aug 2019, 11:09 +0300, Denis Magda <[hidden email]>,
> > wrote:
> > > > > > > Denis,
> > > > > > >
> > > > > > > Does it mean we don't need to pass any flags from this list [1]
> > at
> > > > all
> > > > > > for
> > > > > > > the JDBC and thin clients?
> > > > > > >
> > > > > > > [1]
> > > > > > >
> > > > > >
> > > > >
> > > >
> > >
> >
> https://apacheignite.readme.io/docs/getting-started#section-running-ignite-with-java-9-10-11
> > > > > > >
> > > > > > > -
> > > > > > > Denis
> > > > > > >
> > > > > > >
> > > > > > > On Wed, Aug 14, 2019 at 5:56 PM Denis Mekhanikov <
> > > > > [hidden email]>
> > > > > > > wrote:
> > > > > > >
> > > > > > > > Hi!
> > > > > > > >
> > > > > > > > There are two JDK internal things that are used by Ignite:
> > Unsafe
> > > > and
> > > > > > > > sun.nio.ch package.
> > > > > > > > None of these things are used by thin clients. So, it’s fine
> to
> > > use
> > > > > > thin
> > > > > > > > clients without additional flags.
> > > > > > > >
> > > > > > > > Denis
> > > > > > > >
> > > > > > > > > On 13 Aug 2019, at 23:01, Shane Duan <[hidden email]>
> > > > wrote:
> > > > > > > > >
> > > > > > > > > Hi Igniter,
> > > > > > > > >
> > > > > > > > > I understand that --illegal-access=permit is required for
> JDK
> > > > > > 9/10/11 on
> > > > > > > > > Ignite server. But do I have to include this JVM parameter
> > for
> > > > > Ignite
> > > > > > > > Java
> > > > > > > > > thin client and JDBC client? I tried some simple test
> without
> > > it
> > > > > and
> > > > > > it
> > > > > > > > > seems working fine...
> > > > > > > > >
> > > > > > > > >
> > > > > > > > > Thanks,
> > > > > > > > > Shane
> > > > > > > >
> > > > > > > >
> > > > > >
> > > > >
> > > >
> > >
> >
>

[Dmitry Sherstobitov]

Hi!

I've made some simple tests using Apache Ignite documentation for JDBC and Java Thin client with using of following API functions:

JDBC: executeQuery, execute, preparedStatement
Java Thin: cache get, put, create

None of these API requires additional options for JVM. However, some options are optional and used to suppress warning messages.

Tested with Open JDK 9.0.4, 10.0.2, 11.0.2, 12.0.2 on Ubuntu and Mac OS.


Best regards, Dmitry Sherstobitov
On 26 Aug 2019, 16:22 +0300, Alex Plehanov <[hidden email]>, wrote:
>
> Dmitry,
>
> As I said before, thin client uses BinaryHeapOutputStream, which uses
> Unsafe, so "--illegal-access=deny" has an effect.
> With "--illegal-access=deny" thin client will not start unless you specify
> "--add-opens=java.base/java.nio=ALL-UNNAMED"

[Alexey Plekhanov]

Dmitrii,

What version of Ignite you are using?

I've rechecked Java thin client recently (forgot to share results here), in
my tests:
Client Version 2.7.0
OracleJDK 11: Client won't start unless
"--add-exports=java.base/jdk.internal.misc=ALL-UNNAMED" option is specified.
OpenJDK 12: Client can't start at all

Client Version 2.7.5
OracleJDK 11: Client starts without any additional options
OpenJDK 12: Client starts without any additional options

 "--add-opens=java.base/java.nio=ALL-UNNAMED" suppress warning messages on
all versions.


вт, 3 сент. 2019 г. в 16:35, Dmitrii Sherstobitov <[hidden email]
>:

> Hi!
>
> I've made some simple tests using Apache Ignite documentation for JDBC and
> Java Thin client with using of following API functions:
>
> JDBC: executeQuery, execute, preparedStatement
> Java Thin: cache get, put, create
>
> None of these API requires additional options for JVM. However, some
> options are optional and used to suppress warning messages.
>
> Tested with Open JDK 9.0.4, 10.0.2, 11.0.2, 12.0.2 on Ubuntu and Mac OS.
>
>
> Best regards, Dmitry Sherstobitov
> On 26 Aug 2019, 16:22 +0300, Alex Plehanov <[hidden email]>,
> wrote:
> >
> > Dmitry,
> >
> > As I said before, thin client uses BinaryHeapOutputStream, which uses
> > Unsafe, so "--illegal-access=deny" has an effect.
> > With "--illegal-access=deny" thin client will not start unless you
> specify
> > "--add-opens=java.base/java.nio=ALL-UNNAMED"
>

[Denis Mekhanikov]

Alex,

Could you share the project you’re checking? A GitHub repository would be nice.

Denis
On 3 Sep 2019, 17:10 +0300, Alex Plehanov <[hidden email]>, wrote:

> Dmitrii,
>
> What version of Ignite you are using?
>
> I've rechecked Java thin client recently (forgot to share results here), in
> my tests:
> Client Version 2.7.0
> OracleJDK 11: Client won't start unless
> "--add-exports=java.base/jdk.internal.misc=ALL-UNNAMED" option is specified.
> OpenJDK 12: Client can't start at all
>
> Client Version 2.7.5
> OracleJDK 11: Client starts without any additional options
> OpenJDK 12: Client starts without any additional options
>
> "--add-opens=java.base/java.nio=ALL-UNNAMED" suppress warning messages on
> all versions.
>
>
> вт, 3 сент. 2019 г. в 16:35, Dmitrii Sherstobitov <[hidden email]
> > :
>
> > Hi!
> >
> > I've made some simple tests using Apache Ignite documentation for JDBC and
> > Java Thin client with using of following API functions:
> >
> > JDBC: executeQuery, execute, preparedStatement
> > Java Thin: cache get, put, create
> >
> > None of these API requires additional options for JVM. However, some
> > options are optional and used to suppress warning messages.
> >
> > Tested with Open JDK 9.0.4, 10.0.2, 11.0.2, 12.0.2 on Ubuntu and Mac OS.
> >
> >
> > Best regards, Dmitry Sherstobitov
> > On 26 Aug 2019, 16:22 +0300, Alex Plehanov <[hidden email]>,
> > wrote:
> > >
> > > Dmitry,
> > >
> > > As I said before, thin client uses BinaryHeapOutputStream, which uses
> > > Unsafe, so "--illegal-access=deny" has an effect.
> > > With "--illegal-access=deny" thin client will not start unless you
> > specify
> > > "--add-opens=java.base/java.nio=ALL-UNNAMED"
> >

[Alexey Plekhanov]

Denis, there is almost nothing to share: thin client connects to the
server, creates a cache, do some puts, gets and queries. I run this test by
IDE specifying different JVM options, JDK versions and dependency Ignite
versions (it's not scripted anyhow)

pom:
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0
http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <artifactId>thin-client-test</artifactId>
    <groupId>org.apache.ignite</groupId>
    <version>1.0-SNAPSHOT</version>

    <dependencies>
        <dependency>
            <groupId>org.apache.ignite</groupId>
            <artifactId>ignite-core</artifactId>
            <version>2.7.0</version>
        </dependency>
    </dependencies>
</project>

java:
    public static void main(String[] args) throws Exception {
        IgniteClient igniteClient = Ignition.startClient(new
ClientConfiguration().setAddresses("127.0.0.1:10800"));
        ClientCache<Integer, String> cache =
igniteClient.getOrCreateCache("test.cache");
        cache.put(1, "value1");
        cache.put(2, "value2");
        cache.get(1);
        cache.query(new SqlFieldsQuery("SELECT * FROM
IGNITE.NODES")).getAll();
    }

вт, 3 сент. 2019 г. в 17:26, Denis Mekhanikov <[hidden email]>:

> Alex,
>
> Could you share the project you’re checking? A GitHub repository would be
> nice.
>
> Denis
> On 3 Sep 2019, 17:10 +0300, Alex Plehanov <[hidden email]>,
> wrote:
> > Dmitrii,
> >
> > What version of Ignite you are using?
> >
> > I've rechecked Java thin client recently (forgot to share results here),
> in
> > my tests:
> > Client Version 2.7.0
> > OracleJDK 11: Client won't start unless
> > "--add-exports=java.base/jdk.internal.misc=ALL-UNNAMED" option is
> specified.
> > OpenJDK 12: Client can't start at all
> >
> > Client Version 2.7.5
> > OracleJDK 11: Client starts without any additional options
> > OpenJDK 12: Client starts without any additional options
> >
> > "--add-opens=java.base/java.nio=ALL-UNNAMED" suppress warning messages on
> > all versions.
> >
> >
> > вт, 3 сент. 2019 г. в 16:35, Dmitrii Sherstobitov <
> [hidden email]
> > > :
> >
> > > Hi!
> > >
> > > I've made some simple tests using Apache Ignite documentation for JDBC
> and
> > > Java Thin client with using of following API functions:
> > >
> > > JDBC: executeQuery, execute, preparedStatement
> > > Java Thin: cache get, put, create
> > >
> > > None of these API requires additional options for JVM. However, some
> > > options are optional and used to suppress warning messages.
> > >
> > > Tested with Open JDK 9.0.4, 10.0.2, 11.0.2, 12.0.2 on Ubuntu and Mac
> OS.
> > >
> > >
> > > Best regards, Dmitry Sherstobitov
> > > On 26 Aug 2019, 16:22 +0300, Alex Plehanov <[hidden email]>,
> > > wrote:
> > > >
> > > > Dmitry,
> > > >
> > > > As I said before, thin client uses BinaryHeapOutputStream, which uses
> > > > Unsafe, so "--illegal-access=deny" has an effect.
> > > > With "--illegal-access=deny" thin client will not start unless you
> > > specify
> > > > "--add-opens=java.base/java.nio=ALL-UNNAMED"
> > >
>

[Denis Mekhanikov]

Alex,

Thanks for providing the details.
Ignite 2.7.0 doesn’t officially support Java 11+, so what you wrote seems valid. So, currently we don’t have an example, that fails with an Ignite thin client version 2.7.5 and Java 11+.
Please let us know if you find a counterexample.

Denis
On 3 Sep 2019, 19:00 +0300, Alex Plehanov <[hidden email]>, wrote:

> Denis, there is almost nothing to share: thin client connects to the
> server, creates a cache, do some puts, gets and queries. I run this test by
> IDE specifying different JVM options, JDK versions and dependency Ignite
> versions (it's not scripted anyhow)
>
> pom:
> <?xml version="1.0" encoding="UTF-8"?>
> <project xmlns="http://maven.apache.org/POM/4.0.0"
> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
> xsi:schemaLocation="http://maven.apache.org/POM/4.0.0
> http://maven.apache.org/xsd/maven-4.0.0.xsd">
> <modelVersion>4.0.0</modelVersion>
>
> <artifactId>thin-client-test</artifactId>
> <groupId>org.apache.ignite</groupId>
> <version>1.0-SNAPSHOT</version>
>
> <dependencies>
> <dependency>
> <groupId>org.apache.ignite</groupId>
> <artifactId>ignite-core</artifactId>
> <version>2.7.0</version>
> </dependency>
> </dependencies>
> </project>
>
> java:
> public static void main(String[] args) throws Exception {
> IgniteClient igniteClient = Ignition.startClient(new
> ClientConfiguration().setAddresses("127.0.0.1:10800"));
> ClientCache<Integer, String> cache =
> igniteClient.getOrCreateCache("test.cache");
> cache.put(1, "value1");
> cache.put(2, "value2");
> cache.get(1);
> cache.query(new SqlFieldsQuery("SELECT * FROM
> IGNITE.NODES")).getAll();
> }
>
> вт, 3 сент. 2019 г. в 17:26, Denis Mekhanikov <[hidden email]>:
>
> > Alex,
> >
> > Could you share the project you’re checking? A GitHub repository would be
> > nice.
> >
> > Denis
> > On 3 Sep 2019, 17:10 +0300, Alex Plehanov <[hidden email]>,
> > wrote:
> > > Dmitrii,
> > >
> > > What version of Ignite you are using?
> > >
> > > I've rechecked Java thin client recently (forgot to share results here),
> > in
> > > my tests:
> > > Client Version 2.7.0
> > > OracleJDK 11: Client won't start unless
> > > "--add-exports=java.base/jdk.internal.misc=ALL-UNNAMED" option is
> > specified.
> > > OpenJDK 12: Client can't start at all
> > >
> > > Client Version 2.7.5
> > > OracleJDK 11: Client starts without any additional options
> > > OpenJDK 12: Client starts without any additional options
> > >
> > > "--add-opens=java.base/java.nio=ALL-UNNAMED" suppress warning messages on
> > > all versions.
> > >
> > >
> > > вт, 3 сент. 2019 г. в 16:35, Dmitrii Sherstobitov <
> > [hidden email]
> > > > :
> > >
> > > > Hi!
> > > >
> > > > I've made some simple tests using Apache Ignite documentation for JDBC
> > and
> > > > Java Thin client with using of following API functions:
> > > >
> > > > JDBC: executeQuery, execute, preparedStatement
> > > > Java Thin: cache get, put, create
> > > >
> > > > None of these API requires additional options for JVM. However, some
> > > > options are optional and used to suppress warning messages.
> > > >
> > > > Tested with Open JDK 9.0.4, 10.0.2, 11.0.2, 12.0.2 on Ubuntu and Mac
> > OS.
> > > >
> > > >
> > > > Best regards, Dmitry Sherstobitov
> > > > On 26 Aug 2019, 16:22 +0300, Alex Plehanov <[hidden email]>,
> > > > wrote:
> > > > >
> > > > > Dmitry,
> > > > >
> > > > > As I said before, thin client uses BinaryHeapOutputStream, which uses
> > > > > Unsafe, so "--illegal-access=deny" has an effect.
> > > > > With "--illegal-access=deny" thin client will not start unless you
> > > > specify
> > > > > "--add-opens=java.base/java.nio=ALL-UNNAMED"
> > > >
> >