1 /*
2 * Copyright (c) 1997, 2014, Oracle and/or its affiliates. All rights reserved.
3 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4 *
5 * This code is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License version 2 only, as
7 * published by the Free Software Foundation.
8 *
9 * This code is distributed in the hope that it will be useful, but WITHOUT
10 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
12 * version 2 for more details (a copy is included in the LICENSE file that
13 * accompanied this code).
14 *
15 * You should have received a copy of the GNU General Public License version
16 * 2 along with this work; if not, write to the Free Software Foundation,
17 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
18 *
19 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
20 * or visit www.oracle.com if you need additional information or have any
21 * questions.
22 *
23 */
24
25 #include "precompiled.hpp"
26 #include "asm/macroAssembler.hpp"
27 #include "memory/resourceArea.hpp"
28 #include "nativeInst_x86.hpp"
29 #include "oops/oop.inline.hpp"
30 #include "runtime/handles.hpp"
31 #include "runtime/sharedRuntime.hpp"
32 #include "runtime/stubRoutines.hpp"
33 #include "utilities/ostream.hpp"
34 #ifdef COMPILER1
35 #include "c1/c1_Runtime1.hpp"
36 #endif
37
38 PRAGMA_FORMAT_MUTE_WARNINGS_FOR_GCC
39
40 void NativeInstruction::wrote(int offset) {
41 ICache::invalidate_word(addr_at(offset));
42 }
43
44 void NativeCall::verify() {
45 // Make sure code pattern is actually a call imm32 instruction.
46 int inst = ubyte_at(0);
47 if (inst != instruction_code) {
48 tty->print_cr("Addr: " INTPTR_FORMAT " Code: 0x%x", instruction_address(),
49 inst);
50 fatal("not a call disp32");
51 }
52 }
53
54 address NativeCall::destination() const {
55 // Getting the destination of a call isn't safe because that call can
56 // be getting patched while you're calling this. There's only special
57 // places where this can be called but not automatically verifiable by
58 // checking which locks are held. The solution is true atomic patching
59 // on x86, nyi.
60 return return_address() + displacement();
61 }
62
63 void NativeCall::print() {
64 tty->print_cr(PTR_FORMAT ": call " PTR_FORMAT,
65 instruction_address(), destination());
66 }
67
68 // Inserts a native call instruction at a given pc
69 void NativeCall::insert(address code_pos, address entry) {
70 intptr_t disp = (intptr_t)entry - ((intptr_t)code_pos + 1 + 4);
71 #ifdef AMD64
72 guarantee(disp == (intptr_t)(jint)disp, "must be 32-bit offset");
73 #endif // AMD64
74 *code_pos = instruction_code;
75 *((int32_t *)(code_pos+1)) = (int32_t) disp;
76 ICache::invalidate_range(code_pos, instruction_size);
77 }
78
79 // MT-safe patching of a call instruction.
80 // First patches first word of instruction to two jmp's that jmps to them
81 // selfs (spinlock). Then patches the last byte, and then atomicly replaces
82 // the jmp's with the first 4 byte of the new instruction.
83 void NativeCall::replace_mt_safe(address instr_addr, address code_buffer) {
84 assert(Patching_lock->is_locked() ||
85 SafepointSynchronize::is_at_safepoint(), "concurrent code patching");
86 assert (instr_addr != NULL, "illegal address for code patching");
87
88 NativeCall* n_call = nativeCall_at (instr_addr); // checking that it is a call
89 if (os::is_MP()) {
90 guarantee((intptr_t)instr_addr % BytesPerWord == 0, "must be aligned");
91 }
92
93 // First patch dummy jmp in place
94 unsigned char patch[4];
95 assert(sizeof(patch)==sizeof(jint), "sanity check");
96 patch[0] = 0xEB; // jmp rel8
97 patch[1] = 0xFE; // jmp to self
98 patch[2] = 0xEB;
99 patch[3] = 0xFE;
100
101 // First patch dummy jmp in place
102 *(jint*)instr_addr = *(jint *)patch;
103
104 // Invalidate. Opteron requires a flush after every write.
105 n_call->wrote(0);
106
107 // Patch 4th byte
108 instr_addr[4] = code_buffer[4];
109
110 n_call->wrote(4);
111
112 // Patch bytes 0-3
113 *(jint*)instr_addr = *(jint *)code_buffer;
114
115 n_call->wrote(0);
116
117 #ifdef ASSERT
118 // verify patching
119 for ( int i = 0; i < instruction_size; i++) {
120 address ptr = (address)((intptr_t)code_buffer + i);
121 int a_byte = (*ptr) & 0xFF;
122 assert(*((address)((intptr_t)instr_addr + i)) == a_byte, "mt safe patching failed");
123 }
124 #endif
125
126 }
127
128
129 // Similar to replace_mt_safe, but just changes the destination. The
130 // important thing is that free-running threads are able to execute this
131 // call instruction at all times. If the displacement field is aligned
132 // we can simply rely on atomicity of 32-bit writes to make sure other threads
133 // will see no intermediate states. Otherwise, the first two bytes of the
134 // call are guaranteed to be aligned, and can be atomically patched to a
135 // self-loop to guard the instruction while we change the other bytes.
136
137 // We cannot rely on locks here, since the free-running threads must run at
138 // full speed.
139 //
140 // Used in the runtime linkage of calls; see class CompiledIC.
141 // (Cf. 4506997 and 4479829, where threads witnessed garbage displacements.)
142 void NativeCall::set_destination_mt_safe(address dest) {
143 debug_only(verify());
144 // Make sure patching code is locked. No two threads can patch at the same
145 // time but one may be executing this code.
146 assert(Patching_lock->is_locked() ||
147 SafepointSynchronize::is_at_safepoint(), "concurrent code patching");
148 // Both C1 and C2 should now be generating code which aligns the patched address
149 // to be within a single cache line except that C1 does not do the alignment on
150 // uniprocessor systems.
151 bool is_aligned = ((uintptr_t)displacement_address() + 0) / cache_line_size ==
152 ((uintptr_t)displacement_address() + 3) / cache_line_size;
153
154 guarantee(!os::is_MP() || is_aligned, "destination must be aligned");
155
156 if (is_aligned) {
157 // Simple case: The destination lies within a single cache line.
158 set_destination(dest);
159 } else if ((uintptr_t)instruction_address() / cache_line_size ==
160 ((uintptr_t)instruction_address()+1) / cache_line_size) {
161 // Tricky case: The instruction prefix lies within a single cache line.
162 intptr_t disp = dest - return_address();
163 #ifdef AMD64
164 guarantee(disp == (intptr_t)(jint)disp, "must be 32-bit offset");
165 #endif // AMD64
166
167 int call_opcode = instruction_address()[0];
168
169 // First patch dummy jump in place:
170 {
171 u_char patch_jump[2];
172 patch_jump[0] = 0xEB; // jmp rel8
173 patch_jump[1] = 0xFE; // jmp to self
174
175 assert(sizeof(patch_jump)==sizeof(short), "sanity check");
176 *(short*)instruction_address() = *(short*)patch_jump;
177 }
178 // Invalidate. Opteron requires a flush after every write.
179 wrote(0);
180
181 // (Note: We assume any reader which has already started to read
182 // the unpatched call will completely read the whole unpatched call
183 // without seeing the next writes we are about to make.)
184
185 // Next, patch the last three bytes:
186 u_char patch_disp[5];
187 patch_disp[0] = call_opcode;
188 *(int32_t*)&patch_disp[1] = (int32_t)disp;
189 assert(sizeof(patch_disp)==instruction_size, "sanity check");
190 for (int i = sizeof(short); i < instruction_size; i++)
191 instruction_address()[i] = patch_disp[i];
192
193 // Invalidate. Opteron requires a flush after every write.
194 wrote(sizeof(short));
195
196 // (Note: We assume that any reader which reads the opcode we are
197 // about to repatch will also read the writes we just made.)
198
199 // Finally, overwrite the jump:
200 *(short*)instruction_address() = *(short*)patch_disp;
201 // Invalidate. Opteron requires a flush after every write.
202 wrote(0);
203
204 debug_only(verify());
205 guarantee(destination() == dest, "patch succeeded");
206 } else {
207 // Impossible: One or the other must be atomically writable.
208 ShouldNotReachHere();
209 }
210 }
211
212
213 void NativeMovConstReg::verify() {
214 #ifdef AMD64
215 // make sure code pattern is actually a mov reg64, imm64 instruction
216 if ((ubyte_at(0) != Assembler::REX_W && ubyte_at(0) != Assembler::REX_WB) ||
217 (ubyte_at(1) & (0xff ^ register_mask)) != 0xB8) {
218 print();
219 fatal("not a REX.W[B] mov reg64, imm64");
220 }
221 #else
222 // make sure code pattern is actually a mov reg, imm32 instruction
223 u_char test_byte = *(u_char*)instruction_address();
224 u_char test_byte_2 = test_byte & ( 0xff ^ register_mask);
225 if (test_byte_2 != instruction_code) fatal("not a mov reg, imm32");
226 #endif // AMD64
227 }
228
229
230 void NativeMovConstReg::print() {
231 tty->print_cr(PTR_FORMAT ": mov reg, " INTPTR_FORMAT,
232 instruction_address(), data());
233 }
234
235 //-------------------------------------------------------------------
236
237 int NativeMovRegMem::instruction_start() const {
238 int off = 0;
239 u_char instr_0 = ubyte_at(off);
240
241 // See comment in Assembler::locate_operand() about VEX prefixes.
242 if (instr_0 == instruction_VEX_prefix_2bytes) {
243 assert((UseAVX > 0), "shouldn't have VEX prefix");
244 NOT_LP64(assert((0xC0 & ubyte_at(1)) == 0xC0, "shouldn't have LDS and LES instructions"));
245 return 2;
246 }
247 if (instr_0 == instruction_VEX_prefix_3bytes) {
248 assert((UseAVX > 0), "shouldn't have VEX prefix");
249 NOT_LP64(assert((0xC0 & ubyte_at(1)) == 0xC0, "shouldn't have LDS and LES instructions"));
250 return 3;
251 }
252
253 // First check to see if we have a (prefixed or not) xor
254 if (instr_0 >= instruction_prefix_wide_lo && // 0x40
255 instr_0 <= instruction_prefix_wide_hi) { // 0x4f
256 off++;
257 instr_0 = ubyte_at(off);
258 }
259
260 if (instr_0 == instruction_code_xor) {
261 off += 2;
262 instr_0 = ubyte_at(off);
263 }
264
265 // Now look for the real instruction and the many prefix/size specifiers.
266
267 if (instr_0 == instruction_operandsize_prefix ) { // 0x66
268 off++; // Not SSE instructions
269 instr_0 = ubyte_at(off);
270 }
271
272 if ( instr_0 == instruction_code_xmm_ss_prefix || // 0xf3
273 instr_0 == instruction_code_xmm_sd_prefix) { // 0xf2
274 off++;
275 instr_0 = ubyte_at(off);
276 }
277
278 if ( instr_0 >= instruction_prefix_wide_lo && // 0x40
279 instr_0 <= instruction_prefix_wide_hi) { // 0x4f
280 off++;
281 instr_0 = ubyte_at(off);
282 }
283
284
285 if (instr_0 == instruction_extended_prefix ) { // 0x0f
286 off++;
287 }
288
289 return off;
290 }
291
292 address NativeMovRegMem::instruction_address() const {
293 return addr_at(instruction_start());
294 }
295
296 address NativeMovRegMem::next_instruction_address() const {
297 address ret = instruction_address() + instruction_size;
298 u_char instr_0 = *(u_char*) instruction_address();
299 switch (instr_0) {
300 case instruction_operandsize_prefix:
301
302 fatal("should have skipped instruction_operandsize_prefix");
303 break;
304
305 case instruction_extended_prefix:
306 fatal("should have skipped instruction_extended_prefix");
307 break;
308
309 case instruction_code_mem2reg_movslq: // 0x63
310 case instruction_code_mem2reg_movzxb: // 0xB6
311 case instruction_code_mem2reg_movsxb: // 0xBE
312 case instruction_code_mem2reg_movzxw: // 0xB7
313 case instruction_code_mem2reg_movsxw: // 0xBF
314 case instruction_code_reg2mem: // 0x89 (q/l)
315 case instruction_code_mem2reg: // 0x8B (q/l)
316 case instruction_code_reg2memb: // 0x88
317 case instruction_code_mem2regb: // 0x8a
318
319 case instruction_code_float_s: // 0xd9 fld_s a
320 case instruction_code_float_d: // 0xdd fld_d a
321
322 case instruction_code_xmm_load: // 0x10
323 case instruction_code_xmm_store: // 0x11
324 case instruction_code_xmm_lpd: // 0x12
325 {
326 // If there is an SIB then instruction is longer than expected
327 u_char mod_rm = *(u_char*)(instruction_address() + 1);
328 if ((mod_rm & 7) == 0x4) {
329 ret++;
330 }
331 }
332 case instruction_code_xor:
333 fatal("should have skipped xor lead in");
334 break;
335
336 default:
337 fatal("not a NativeMovRegMem");
338 }
339 return ret;
340
341 }
342
343 int NativeMovRegMem::offset() const{
344 int off = data_offset + instruction_start();
345 u_char mod_rm = *(u_char*)(instruction_address() + 1);
346 // nnnn(r12|rsp) isn't coded as simple mod/rm since that is
347 // the encoding to use an SIB byte. Which will have the nnnn
348 // field off by one byte
349 if ((mod_rm & 7) == 0x4) {
350 off++;
351 }
352 return int_at(off);
353 }
354
355 void NativeMovRegMem::set_offset(int x) {
356 int off = data_offset + instruction_start();
357 u_char mod_rm = *(u_char*)(instruction_address() + 1);
358 // nnnn(r12|rsp) isn't coded as simple mod/rm since that is
359 // the encoding to use an SIB byte. Which will have the nnnn
360 // field off by one byte
361 if ((mod_rm & 7) == 0x4) {
362 off++;
363 }
364 set_int_at(off, x);
365 }
366
367 void NativeMovRegMem::verify() {
368 // make sure code pattern is actually a mov [reg+offset], reg instruction
369 u_char test_byte = *(u_char*)instruction_address();
370 switch (test_byte) {
371 case instruction_code_reg2memb: // 0x88 movb a, r
372 case instruction_code_reg2mem: // 0x89 movl a, r (can be movq in 64bit)
373 case instruction_code_mem2regb: // 0x8a movb r, a
374 case instruction_code_mem2reg: // 0x8b movl r, a (can be movq in 64bit)
375 break;
376
377 case instruction_code_mem2reg_movslq: // 0x63 movsql r, a
378 case instruction_code_mem2reg_movzxb: // 0xb6 movzbl r, a (movzxb)
379 case instruction_code_mem2reg_movzxw: // 0xb7 movzwl r, a (movzxw)
380 case instruction_code_mem2reg_movsxb: // 0xbe movsbl r, a (movsxb)
381 case instruction_code_mem2reg_movsxw: // 0xbf movswl r, a (movsxw)
382 break;
383
384 case instruction_code_float_s: // 0xd9 fld_s a
385 case instruction_code_float_d: // 0xdd fld_d a
386 case instruction_code_xmm_load: // 0x10 movsd xmm, a
387 case instruction_code_xmm_store: // 0x11 movsd a, xmm
388 case instruction_code_xmm_lpd: // 0x12 movlpd xmm, a
389 break;
390
391 default:
392 fatal ("not a mov [reg+offs], reg instruction");
393 }
394 }
395
396
397 void NativeMovRegMem::print() {
398 tty->print_cr("0x%x: mov reg, [reg + %x]", instruction_address(), offset());
399 }
400
401 //-------------------------------------------------------------------
402
403 void NativeLoadAddress::verify() {
404 // make sure code pattern is actually a mov [reg+offset], reg instruction
405 u_char test_byte = *(u_char*)instruction_address();
406 #ifdef _LP64
407 if ( (test_byte == instruction_prefix_wide ||
408 test_byte == instruction_prefix_wide_extended) ) {
409 test_byte = *(u_char*)(instruction_address() + 1);
410 }
411 #endif // _LP64
412 if ( ! ((test_byte == lea_instruction_code)
413 LP64_ONLY(|| (test_byte == mov64_instruction_code) ))) {
414 fatal ("not a lea reg, [reg+offs] instruction");
415 }
416 }
417
418
419 void NativeLoadAddress::print() {
420 tty->print_cr("0x%x: lea [reg + %x], reg", instruction_address(), offset());
421 }
422
423 //--------------------------------------------------------------------------------
424
425 void NativeJump::verify() {
426 if (*(u_char*)instruction_address() != instruction_code) {
427 fatal("not a jump instruction");
428 }
429 }
430
431
432 void NativeJump::insert(address code_pos, address entry) {
433 intptr_t disp = (intptr_t)entry - ((intptr_t)code_pos + 1 + 4);
434 #ifdef AMD64
435 guarantee(disp == (intptr_t)(int32_t)disp, "must be 32-bit offset");
436 #endif // AMD64
437
438 *code_pos = instruction_code;
439 *((int32_t*)(code_pos + 1)) = (int32_t)disp;
440
441 ICache::invalidate_range(code_pos, instruction_size);
442 }
443
444 void NativeJump::check_verified_entry_alignment(address entry, address verified_entry) {
445 // Patching to not_entrant can happen while activations of the method are
446 // in use. The patching in that instance must happen only when certain
447 // alignment restrictions are true. These guarantees check those
448 // conditions.
449 #ifdef AMD64
450 const int linesize = 64;
451 #else
452 const int linesize = 32;
453 #endif // AMD64
454
455 // Must be wordSize aligned
456 guarantee(((uintptr_t) verified_entry & (wordSize -1)) == 0,
457 "illegal address for code patching 2");
458 // First 5 bytes must be within the same cache line - 4827828
459 guarantee((uintptr_t) verified_entry / linesize ==
460 ((uintptr_t) verified_entry + 4) / linesize,
461 "illegal address for code patching 3");
462 }
463
464
465 // MT safe inserting of a jump over an unknown instruction sequence (used by nmethod::makeZombie)
466 // The problem: jmp <dest> is a 5-byte instruction. Atomical write can be only with 4 bytes.
467 // First patches the first word atomically to be a jump to itself.
468 // Then patches the last byte and then atomically patches the first word (4-bytes),
469 // thus inserting the desired jump
470 // This code is mt-safe with the following conditions: entry point is 4 byte aligned,
471 // entry point is in same cache line as unverified entry point, and the instruction being
472 // patched is >= 5 byte (size of patch).
473 //
474 // In C2 the 5+ byte sized instruction is enforced by code in MachPrologNode::emit.
475 // In C1 the restriction is enforced by CodeEmitter::method_entry
476 // In JVMCI, the restriction is enforced by HotSpotFrameContext.enter(...)
477 //
478 void NativeJump::patch_verified_entry(address entry, address verified_entry, address dest) {
479 // complete jump instruction (to be inserted) is in code_buffer;
480 unsigned char code_buffer[5];
481 code_buffer[0] = instruction_code;
482 intptr_t disp = (intptr_t)dest - ((intptr_t)verified_entry + 1 + 4);
483 #ifdef AMD64
484 guarantee(disp == (intptr_t)(int32_t)disp, "must be 32-bit offset");
485 #endif // AMD64
486 *(int32_t*)(code_buffer + 1) = (int32_t)disp;
487
488 check_verified_entry_alignment(entry, verified_entry);
489
490 // Can't call nativeJump_at() because it's asserts jump exists
491 NativeJump* n_jump = (NativeJump*) verified_entry;
492
493 //First patch dummy jmp in place
494
495 unsigned char patch[4];
496 assert(sizeof(patch)==sizeof(int32_t), "sanity check");
497 patch[0] = 0xEB; // jmp rel8
498 patch[1] = 0xFE; // jmp to self
499 patch[2] = 0xEB;
500 patch[3] = 0xFE;
501
502 // First patch dummy jmp in place
503 *(int32_t*)verified_entry = *(int32_t *)patch;
504
505 n_jump->wrote(0);
506
507 // Patch 5th byte (from jump instruction)
508 verified_entry[4] = code_buffer[4];
509
510 n_jump->wrote(4);
511
512 // Patch bytes 0-3 (from jump instruction)
513 *(int32_t*)verified_entry = *(int32_t *)code_buffer;
514 // Invalidate. Opteron requires a flush after every write.
515 n_jump->wrote(0);
516
517 }
518
519 void NativePopReg::insert(address code_pos, Register reg) {
520 assert(reg->encoding() < 8, "no space for REX");
521 assert(NativePopReg::instruction_size == sizeof(char), "right address unit for update");
522 *code_pos = (u_char)(instruction_code | reg->encoding());
523 ICache::invalidate_range(code_pos, instruction_size);
524 }
525
526
527 void NativeIllegalInstruction::insert(address code_pos) {
528 assert(NativeIllegalInstruction::instruction_size == sizeof(short), "right address unit for update");
529 *(short *)code_pos = instruction_code;
530 ICache::invalidate_range(code_pos, instruction_size);
531 }
532
533 void NativeGeneralJump::verify() {
534 assert(((NativeInstruction *)this)->is_jump() ||
535 ((NativeInstruction *)this)->is_cond_jump(), "not a general jump instruction");
536 }
537
538
539 void NativeGeneralJump::insert_unconditional(address code_pos, address entry) {
540 intptr_t disp = (intptr_t)entry - ((intptr_t)code_pos + 1 + 4);
541 #ifdef AMD64
542 guarantee(disp == (intptr_t)(int32_t)disp, "must be 32-bit offset");
543 #endif // AMD64
544
545 *code_pos = unconditional_long_jump;
546 *((int32_t *)(code_pos+1)) = (int32_t) disp;
547 ICache::invalidate_range(code_pos, instruction_size);
548 }
549
550
551 // MT-safe patching of a long jump instruction.
552 // First patches first word of instruction to two jmp's that jmps to them
553 // selfs (spinlock). Then patches the last byte, and then atomicly replaces
554 // the jmp's with the first 4 byte of the new instruction.
555 void NativeGeneralJump::replace_mt_safe(address instr_addr, address code_buffer) {
556 assert (instr_addr != NULL, "illegal address for code patching (4)");
557 NativeGeneralJump* n_jump = nativeGeneralJump_at (instr_addr); // checking that it is a jump
558
559 // Temporary code
560 unsigned char patch[4];
561 assert(sizeof(patch)==sizeof(int32_t), "sanity check");
562 patch[0] = 0xEB; // jmp rel8
563 patch[1] = 0xFE; // jmp to self
564 patch[2] = 0xEB;
565 patch[3] = 0xFE;
566
567 // First patch dummy jmp in place
568 *(int32_t*)instr_addr = *(int32_t *)patch;
569 n_jump->wrote(0);
570
571 // Patch 4th byte
572 instr_addr[4] = code_buffer[4];
573
574 n_jump->wrote(4);
575
576 // Patch bytes 0-3
577 *(jint*)instr_addr = *(jint *)code_buffer;
578
579 n_jump->wrote(0);
580
581 #ifdef ASSERT
582 // verify patching
583 for ( int i = 0; i < instruction_size; i++) {
584 address ptr = (address)((intptr_t)code_buffer + i);
585 int a_byte = (*ptr) & 0xFF;
586 assert(*((address)((intptr_t)instr_addr + i)) == a_byte, "mt safe patching failed");
587 }
588 #endif
589
590 }
591
592
593
594 address NativeGeneralJump::jump_destination() const {
595 int op_code = ubyte_at(0);
596 bool is_rel32off = (op_code == 0xE9 || op_code == 0x0F);
597 int offset = (op_code == 0x0F) ? 2 : 1;
598 int length = offset + ((is_rel32off) ? 4 : 1);
599
600 if (is_rel32off)
601 return addr_at(0) + length + int_at(offset);
602 else
603 return addr_at(0) + length + sbyte_at(offset);
604 }