1 /*
2 * Copyright 1997-2008 Sun Microsystems, Inc. All Rights Reserved.
3 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4 *
5 * This code is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License version 2 only, as
7 * published by the Free Software Foundation.
8 *
9 * This code is distributed in the hope that it will be useful, but WITHOUT
10 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
12 * version 2 for more details (a copy is included in the LICENSE file that
13 * accompanied this code).
14 *
15 * You should have received a copy of the GNU General Public License version
16 * 2 along with this work; if not, write to the Free Software Foundation,
17 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
18 *
19 * Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa Clara,
20 * CA 95054 USA or visit www.sun.com if you need additional information or
21 * have any questions.
22 *
23 */
24
25 # include "incls/_precompiled.incl"
26 # include "incls/_nativeInst_x86.cpp.incl"
27
28 void NativeInstruction::wrote(int offset) {
29 ICache::invalidate_word(addr_at(offset));
30 }
31
32
33 void NativeCall::verify() {
34 // Make sure code pattern is actually a call imm32 instruction.
35 int inst = ubyte_at(0);
36 if (inst != instruction_code) {
37 tty->print_cr("Addr: " INTPTR_FORMAT " Code: 0x%x", instruction_address(),
38 inst);
39 fatal("not a call disp32");
40 }
41 }
42
43 address NativeCall::destination() const {
44 // Getting the destination of a call isn't safe because that call can
45 // be getting patched while you're calling this. There's only special
46 // places where this can be called but not automatically verifiable by
47 // checking which locks are held. The solution is true atomic patching
48 // on x86, nyi.
49 return return_address() + displacement();
50 }
51
52 void NativeCall::print() {
53 tty->print_cr(PTR_FORMAT ": call " PTR_FORMAT,
54 instruction_address(), destination());
55 }
56
57 // Inserts a native call instruction at a given pc
58 void NativeCall::insert(address code_pos, address entry) {
59 intptr_t disp = (intptr_t)entry - ((intptr_t)code_pos + 1 + 4);
60 #ifdef AMD64
61 guarantee(disp == (intptr_t)(jint)disp, "must be 32-bit offset");
62 #endif // AMD64
63 *code_pos = instruction_code;
64 *((int32_t *)(code_pos+1)) = (int32_t) disp;
65 ICache::invalidate_range(code_pos, instruction_size);
66 }
67
68 // MT-safe patching of a call instruction.
69 // First patches first word of instruction to two jmp's that jmps to them
70 // selfs (spinlock). Then patches the last byte, and then atomicly replaces
71 // the jmp's with the first 4 byte of the new instruction.
72 void NativeCall::replace_mt_safe(address instr_addr, address code_buffer) {
73 assert(Patching_lock->is_locked() ||
74 SafepointSynchronize::is_at_safepoint(), "concurrent code patching");
75 assert (instr_addr != NULL, "illegal address for code patching");
76
77 NativeCall* n_call = nativeCall_at (instr_addr); // checking that it is a call
78 if (os::is_MP()) {
79 guarantee((intptr_t)instr_addr % BytesPerWord == 0, "must be aligned");
80 }
81
82 // First patch dummy jmp in place
83 unsigned char patch[4];
84 assert(sizeof(patch)==sizeof(jint), "sanity check");
85 patch[0] = 0xEB; // jmp rel8
86 patch[1] = 0xFE; // jmp to self
87 patch[2] = 0xEB;
88 patch[3] = 0xFE;
89
90 // First patch dummy jmp in place
91 *(jint*)instr_addr = *(jint *)patch;
92
93 // Invalidate. Opteron requires a flush after every write.
94 n_call->wrote(0);
95
96 // Patch 4th byte
97 instr_addr[4] = code_buffer[4];
98
99 n_call->wrote(4);
100
101 // Patch bytes 0-3
102 *(jint*)instr_addr = *(jint *)code_buffer;
103
104 n_call->wrote(0);
105
106 #ifdef ASSERT
107 // verify patching
108 for ( int i = 0; i < instruction_size; i++) {
109 address ptr = (address)((intptr_t)code_buffer + i);
110 int a_byte = (*ptr) & 0xFF;
111 assert(*((address)((intptr_t)instr_addr + i)) == a_byte, "mt safe patching failed");
112 }
113 #endif
114
115 }
116
117
118 // Similar to replace_mt_safe, but just changes the destination. The
119 // important thing is that free-running threads are able to execute this
120 // call instruction at all times. If the displacement field is aligned
121 // we can simply rely on atomicity of 32-bit writes to make sure other threads
122 // will see no intermediate states. Otherwise, the first two bytes of the
123 // call are guaranteed to be aligned, and can be atomically patched to a
124 // self-loop to guard the instruction while we change the other bytes.
125
126 // We cannot rely on locks here, since the free-running threads must run at
127 // full speed.
128 //
129 // Used in the runtime linkage of calls; see class CompiledIC.
130 // (Cf. 4506997 and 4479829, where threads witnessed garbage displacements.)
131 void NativeCall::set_destination_mt_safe(address dest) {
132 debug_only(verify());
133 // Make sure patching code is locked. No two threads can patch at the same
134 // time but one may be executing this code.
135 assert(Patching_lock->is_locked() ||
136 SafepointSynchronize::is_at_safepoint(), "concurrent code patching");
137 // Both C1 and C2 should now be generating code which aligns the patched address
138 // to be within a single cache line except that C1 does not do the alignment on
139 // uniprocessor systems.
140 bool is_aligned = ((uintptr_t)displacement_address() + 0) / cache_line_size ==
141 ((uintptr_t)displacement_address() + 3) / cache_line_size;
142
143 guarantee(!os::is_MP() || is_aligned, "destination must be aligned");
144
145 if (is_aligned) {
146 // Simple case: The destination lies within a single cache line.
147 set_destination(dest);
148 } else if ((uintptr_t)instruction_address() / cache_line_size ==
149 ((uintptr_t)instruction_address()+1) / cache_line_size) {
150 // Tricky case: The instruction prefix lies within a single cache line.
151 intptr_t disp = dest - return_address();
152 #ifdef AMD64
153 guarantee(disp == (intptr_t)(jint)disp, "must be 32-bit offset");
154 #endif // AMD64
155
156 int call_opcode = instruction_address()[0];
157
158 // First patch dummy jump in place:
159 {
160 u_char patch_jump[2];
161 patch_jump[0] = 0xEB; // jmp rel8
162 patch_jump[1] = 0xFE; // jmp to self
163
164 assert(sizeof(patch_jump)==sizeof(short), "sanity check");
165 *(short*)instruction_address() = *(short*)patch_jump;
166 }
167 // Invalidate. Opteron requires a flush after every write.
168 wrote(0);
169
170 // (Note: We assume any reader which has already started to read
171 // the unpatched call will completely read the whole unpatched call
172 // without seeing the next writes we are about to make.)
173
174 // Next, patch the last three bytes:
175 u_char patch_disp[5];
176 patch_disp[0] = call_opcode;
177 *(int32_t*)&patch_disp[1] = (int32_t)disp;
178 assert(sizeof(patch_disp)==instruction_size, "sanity check");
179 for (int i = sizeof(short); i < instruction_size; i++)
180 instruction_address()[i] = patch_disp[i];
181
182 // Invalidate. Opteron requires a flush after every write.
183 wrote(sizeof(short));
184
185 // (Note: We assume that any reader which reads the opcode we are
186 // about to repatch will also read the writes we just made.)
187
188 // Finally, overwrite the jump:
189 *(short*)instruction_address() = *(short*)patch_disp;
190 // Invalidate. Opteron requires a flush after every write.
191 wrote(0);
192
193 debug_only(verify());
194 guarantee(destination() == dest, "patch succeeded");
195 } else {
196 // Impossible: One or the other must be atomically writable.
197 ShouldNotReachHere();
198 }
199 }
200
201
202 void NativeMovConstReg::verify() {
203 #ifdef AMD64
204 // make sure code pattern is actually a mov reg64, imm64 instruction
205 if ((ubyte_at(0) != Assembler::REX_W && ubyte_at(0) != Assembler::REX_WB) ||
206 (ubyte_at(1) & (0xff ^ register_mask)) != 0xB8) {
207 print();
208 fatal("not a REX.W[B] mov reg64, imm64");
209 }
210 #else
211 // make sure code pattern is actually a mov reg, imm32 instruction
212 u_char test_byte = *(u_char*)instruction_address();
213 u_char test_byte_2 = test_byte & ( 0xff ^ register_mask);
214 if (test_byte_2 != instruction_code) fatal("not a mov reg, imm32");
215 #endif // AMD64
216 }
217
218
219 void NativeMovConstReg::print() {
220 tty->print_cr(PTR_FORMAT ": mov reg, " INTPTR_FORMAT,
221 instruction_address(), data());
222 }
223
224 //-------------------------------------------------------------------
225
226 int NativeMovRegMem::instruction_start() const {
227 int off = 0;
228 u_char instr_0 = ubyte_at(off);
229
230 // First check to see if we have a (prefixed or not) xor
231 if ( instr_0 >= instruction_prefix_wide_lo && // 0x40
232 instr_0 <= instruction_prefix_wide_hi) { // 0x4f
233 off++;
234 instr_0 = ubyte_at(off);
235 }
236
237 if (instr_0 == instruction_code_xor) {
238 off += 2;
239 instr_0 = ubyte_at(off);
240 }
241
242 // Now look for the real instruction and the many prefix/size specifiers.
243
244 if (instr_0 == instruction_operandsize_prefix ) { // 0x66
245 off++; // Not SSE instructions
246 instr_0 = ubyte_at(off);
247 }
248
249 if ( instr_0 == instruction_code_xmm_ss_prefix || // 0xf3
250 instr_0 == instruction_code_xmm_sd_prefix) { // 0xf2
251 off++;
252 instr_0 = ubyte_at(off);
253 }
254
255 if ( instr_0 >= instruction_prefix_wide_lo && // 0x40
256 instr_0 <= instruction_prefix_wide_hi) { // 0x4f
257 off++;
258 instr_0 = ubyte_at(off);
259 }
260
261
262 if (instr_0 == instruction_extended_prefix ) { // 0x0f
263 off++;
264 }
265
266 return off;
267 }
268
269 address NativeMovRegMem::instruction_address() const {
270 return addr_at(instruction_start());
271 }
272
273 address NativeMovRegMem::next_instruction_address() const {
274 address ret = instruction_address() + instruction_size;
275 u_char instr_0 = *(u_char*) instruction_address();
276 switch (instr_0) {
277 case instruction_operandsize_prefix:
278
279 fatal("should have skipped instruction_operandsize_prefix");
280 break;
281
282 case instruction_extended_prefix:
283 fatal("should have skipped instruction_extended_prefix");
284 break;
285
286 case instruction_code_mem2reg_movslq: // 0x63
287 case instruction_code_mem2reg_movzxb: // 0xB6
288 case instruction_code_mem2reg_movsxb: // 0xBE
289 case instruction_code_mem2reg_movzxw: // 0xB7
290 case instruction_code_mem2reg_movsxw: // 0xBF
291 case instruction_code_reg2mem: // 0x89 (q/l)
292 case instruction_code_mem2reg: // 0x8B (q/l)
293 case instruction_code_reg2memb: // 0x88
294 case instruction_code_mem2regb: // 0x8a
295
296 case instruction_code_float_s: // 0xd9 fld_s a
297 case instruction_code_float_d: // 0xdd fld_d a
298
299 case instruction_code_xmm_load: // 0x10
300 case instruction_code_xmm_store: // 0x11
301 case instruction_code_xmm_lpd: // 0x12
302 {
303 // If there is an SIB then instruction is longer than expected
304 u_char mod_rm = *(u_char*)(instruction_address() + 1);
305 if ((mod_rm & 7) == 0x4) {
306 ret++;
307 }
308 }
309 case instruction_code_xor:
310 fatal("should have skipped xor lead in");
311 break;
312
313 default:
314 fatal("not a NativeMovRegMem");
315 }
316 return ret;
317
318 }
319
320 int NativeMovRegMem::offset() const{
321 int off = data_offset + instruction_start();
322 u_char mod_rm = *(u_char*)(instruction_address() + 1);
323 // nnnn(r12|rsp) isn't coded as simple mod/rm since that is
324 // the encoding to use an SIB byte. Which will have the nnnn
325 // field off by one byte
326 if ((mod_rm & 7) == 0x4) {
327 off++;
328 }
329 return int_at(off);
330 }
331
332 void NativeMovRegMem::set_offset(int x) {
333 int off = data_offset + instruction_start();
334 u_char mod_rm = *(u_char*)(instruction_address() + 1);
335 // nnnn(r12|rsp) isn't coded as simple mod/rm since that is
336 // the encoding to use an SIB byte. Which will have the nnnn
337 // field off by one byte
338 if ((mod_rm & 7) == 0x4) {
339 off++;
340 }
341 set_int_at(off, x);
342 }
343
344 void NativeMovRegMem::verify() {
345 // make sure code pattern is actually a mov [reg+offset], reg instruction
346 u_char test_byte = *(u_char*)instruction_address();
347 switch (test_byte) {
348 case instruction_code_reg2memb: // 0x88 movb a, r
349 case instruction_code_reg2mem: // 0x89 movl a, r (can be movq in 64bit)
350 case instruction_code_mem2regb: // 0x8a movb r, a
351 case instruction_code_mem2reg: // 0x8b movl r, a (can be movq in 64bit)
352 break;
353
354 case instruction_code_mem2reg_movslq: // 0x63 movsql r, a
355 case instruction_code_mem2reg_movzxb: // 0xb6 movzbl r, a (movzxb)
356 case instruction_code_mem2reg_movzxw: // 0xb7 movzwl r, a (movzxw)
357 case instruction_code_mem2reg_movsxb: // 0xbe movsbl r, a (movsxb)
358 case instruction_code_mem2reg_movsxw: // 0xbf movswl r, a (movsxw)
359 break;
360
361 case instruction_code_float_s: // 0xd9 fld_s a
362 case instruction_code_float_d: // 0xdd fld_d a
363 case instruction_code_xmm_load: // 0x10 movsd xmm, a
364 case instruction_code_xmm_store: // 0x11 movsd a, xmm
365 case instruction_code_xmm_lpd: // 0x12 movlpd xmm, a
366 break;
367
368 default:
369 fatal ("not a mov [reg+offs], reg instruction");
370 }
371 }
372
373
374 void NativeMovRegMem::print() {
375 tty->print_cr("0x%x: mov reg, [reg + %x]", instruction_address(), offset());
376 }
377
378 //-------------------------------------------------------------------
379
380 void NativeLoadAddress::verify() {
381 // make sure code pattern is actually a mov [reg+offset], reg instruction
382 u_char test_byte = *(u_char*)instruction_address();
383 #ifdef _LP64
384 if ( (test_byte == instruction_prefix_wide ||
385 test_byte == instruction_prefix_wide_extended) ) {
386 test_byte = *(u_char*)(instruction_address() + 1);
387 }
388 #endif // _LP64
389 if ( ! ((test_byte == lea_instruction_code)
390 LP64_ONLY(|| (test_byte == mov64_instruction_code) ))) {
391 fatal ("not a lea reg, [reg+offs] instruction");
392 }
393 }
394
395
396 void NativeLoadAddress::print() {
397 tty->print_cr("0x%x: lea [reg + %x], reg", instruction_address(), offset());
398 }
399
400 //--------------------------------------------------------------------------------
401
402 void NativeJump::verify() {
403 if (*(u_char*)instruction_address() != instruction_code) {
404 fatal("not a jump instruction");
405 }
406 }
407
408
409 void NativeJump::insert(address code_pos, address entry) {
410 intptr_t disp = (intptr_t)entry - ((intptr_t)code_pos + 1 + 4);
411 #ifdef AMD64
412 guarantee(disp == (intptr_t)(int32_t)disp, "must be 32-bit offset");
413 #endif // AMD64
414
415 *code_pos = instruction_code;
416 *((int32_t*)(code_pos + 1)) = (int32_t)disp;
417
418 ICache::invalidate_range(code_pos, instruction_size);
419 }
420
421 void NativeJump::check_verified_entry_alignment(address entry, address verified_entry) {
422 // Patching to not_entrant can happen while activations of the method are
423 // in use. The patching in that instance must happen only when certain
424 // alignment restrictions are true. These guarantees check those
425 // conditions.
426 #ifdef AMD64
427 const int linesize = 64;
428 #else
429 const int linesize = 32;
430 #endif // AMD64
431
432 // Must be wordSize aligned
433 guarantee(((uintptr_t) verified_entry & (wordSize -1)) == 0,
434 "illegal address for code patching 2");
435 // First 5 bytes must be within the same cache line - 4827828
436 guarantee((uintptr_t) verified_entry / linesize ==
437 ((uintptr_t) verified_entry + 4) / linesize,
438 "illegal address for code patching 3");
439 }
440
441
442 // MT safe inserting of a jump over an unknown instruction sequence (used by nmethod::makeZombie)
443 // The problem: jmp <dest> is a 5-byte instruction. Atomical write can be only with 4 bytes.
444 // First patches the first word atomically to be a jump to itself.
445 // Then patches the last byte and then atomically patches the first word (4-bytes),
446 // thus inserting the desired jump
447 // This code is mt-safe with the following conditions: entry point is 4 byte aligned,
448 // entry point is in same cache line as unverified entry point, and the instruction being
449 // patched is >= 5 byte (size of patch).
450 //
451 // In C2 the 5+ byte sized instruction is enforced by code in MachPrologNode::emit.
452 // In C1 the restriction is enforced by CodeEmitter::method_entry
453 //
454 void NativeJump::patch_verified_entry(address entry, address verified_entry, address dest) {
455 // complete jump instruction (to be inserted) is in code_buffer;
456 unsigned char code_buffer[5];
457 code_buffer[0] = instruction_code;
458 intptr_t disp = (intptr_t)dest - ((intptr_t)verified_entry + 1 + 4);
459 #ifdef AMD64
460 guarantee(disp == (intptr_t)(int32_t)disp, "must be 32-bit offset");
461 #endif // AMD64
462 *(int32_t*)(code_buffer + 1) = (int32_t)disp;
463
464 check_verified_entry_alignment(entry, verified_entry);
465
466 // Can't call nativeJump_at() because it's asserts jump exists
467 NativeJump* n_jump = (NativeJump*) verified_entry;
468
469 //First patch dummy jmp in place
470
471 unsigned char patch[4];
472 assert(sizeof(patch)==sizeof(int32_t), "sanity check");
473 patch[0] = 0xEB; // jmp rel8
474 patch[1] = 0xFE; // jmp to self
475 patch[2] = 0xEB;
476 patch[3] = 0xFE;
477
478 // First patch dummy jmp in place
479 *(int32_t*)verified_entry = *(int32_t *)patch;
480
481 n_jump->wrote(0);
482
483 // Patch 5th byte (from jump instruction)
484 verified_entry[4] = code_buffer[4];
485
486 n_jump->wrote(4);
487
488 // Patch bytes 0-3 (from jump instruction)
489 *(int32_t*)verified_entry = *(int32_t *)code_buffer;
490 // Invalidate. Opteron requires a flush after every write.
491 n_jump->wrote(0);
492
493 }
494
495 void NativePopReg::insert(address code_pos, Register reg) {
496 assert(reg->encoding() < 8, "no space for REX");
497 assert(NativePopReg::instruction_size == sizeof(char), "right address unit for update");
498 *code_pos = (u_char)(instruction_code | reg->encoding());
499 ICache::invalidate_range(code_pos, instruction_size);
500 }
501
502
503 void NativeIllegalInstruction::insert(address code_pos) {
504 assert(NativeIllegalInstruction::instruction_size == sizeof(short), "right address unit for update");
505 *(short *)code_pos = instruction_code;
506 ICache::invalidate_range(code_pos, instruction_size);
507 }
508
509 void NativeGeneralJump::verify() {
510 assert(((NativeInstruction *)this)->is_jump() ||
511 ((NativeInstruction *)this)->is_cond_jump(), "not a general jump instruction");
512 }
513
514
515 void NativeGeneralJump::insert_unconditional(address code_pos, address entry) {
516 intptr_t disp = (intptr_t)entry - ((intptr_t)code_pos + 1 + 4);
517 #ifdef AMD64
518 guarantee(disp == (intptr_t)(int32_t)disp, "must be 32-bit offset");
519 #endif // AMD64
520
521 *code_pos = unconditional_long_jump;
522 *((int32_t *)(code_pos+1)) = (int32_t) disp;
523 ICache::invalidate_range(code_pos, instruction_size);
524 }
525
526
527 // MT-safe patching of a long jump instruction.
528 // First patches first word of instruction to two jmp's that jmps to them
529 // selfs (spinlock). Then patches the last byte, and then atomicly replaces
530 // the jmp's with the first 4 byte of the new instruction.
531 void NativeGeneralJump::replace_mt_safe(address instr_addr, address code_buffer) {
532 assert (instr_addr != NULL, "illegal address for code patching (4)");
533 NativeGeneralJump* n_jump = nativeGeneralJump_at (instr_addr); // checking that it is a jump
534
535 // Temporary code
536 unsigned char patch[4];
537 assert(sizeof(patch)==sizeof(int32_t), "sanity check");
538 patch[0] = 0xEB; // jmp rel8
539 patch[1] = 0xFE; // jmp to self
540 patch[2] = 0xEB;
541 patch[3] = 0xFE;
542
543 // First patch dummy jmp in place
544 *(int32_t*)instr_addr = *(int32_t *)patch;
545 n_jump->wrote(0);
546
547 // Patch 4th byte
548 instr_addr[4] = code_buffer[4];
549
550 n_jump->wrote(4);
551
552 // Patch bytes 0-3
553 *(jint*)instr_addr = *(jint *)code_buffer;
554
555 n_jump->wrote(0);
556
557 #ifdef ASSERT
558 // verify patching
559 for ( int i = 0; i < instruction_size; i++) {
560 address ptr = (address)((intptr_t)code_buffer + i);
561 int a_byte = (*ptr) & 0xFF;
562 assert(*((address)((intptr_t)instr_addr + i)) == a_byte, "mt safe patching failed");
563 }
564 #endif
565
566 }
567
568
569
570 address NativeGeneralJump::jump_destination() const {
571 int op_code = ubyte_at(0);
572 bool is_rel32off = (op_code == 0xE9 || op_code == 0x0F);
573 int offset = (op_code == 0x0F) ? 2 : 1;
574 int length = offset + ((is_rel32off) ? 4 : 1);
575
576 if (is_rel32off)
577 return addr_at(0) + length + int_at(offset);
578 else
579 return addr_at(0) + length + sbyte_at(offset);
580 }
581
582 bool NativeInstruction::is_dtrace_trap() {
583 return (*(int32_t*)this & 0xff) == 0xcc;
584 }