1 /*
2  * Copyright (c) 2008, 2020, Oracle and/or its affiliates. All rights reserved.
3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4  *
5  * This code is free software; you can redistribute it and/or modify it
6  * under the terms of the GNU General Public License version 2 only, as
7  * published by the Free Software Foundation.
8  *
9  * This code is distributed in the hope that it will be useful, but WITHOUT
10  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
11  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
12  * version 2 for more details (a copy is included in the LICENSE file that
13  * accompanied this code).
14  *
15  * You should have received a copy of the GNU General Public License version
16  * 2 along with this work; if not, write to the Free Software Foundation,
17  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
18  *
19  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
20  * or visit www.oracle.com if you need additional information or have any
21  * questions.
22  *
23  */
24 
25 #include "precompiled.hpp"
26 #include "interpreter/interpreter.hpp"
27 #include "memory/resourceArea.hpp"
28 #include "memory/universe.hpp"
29 #include "oops/markWord.hpp"
30 #include "oops/method.hpp"
31 #include "oops/oop.inline.hpp"
32 #include "runtime/frame.inline.hpp"
33 #include "runtime/handles.inline.hpp"
34 #include "runtime/javaCalls.hpp"
35 #include "runtime/monitorChunk.hpp"
36 #include "runtime/os.inline.hpp"
37 #include "runtime/signature.hpp"
38 #include "runtime/stubCodeGenerator.hpp"
39 #include "runtime/stubRoutines.hpp"
40 #include "vmreg_arm.inline.hpp"
41 #ifdef COMPILER1
42 #include "c1/c1_Runtime1.hpp"
43 #include "runtime/vframeArray.hpp"
44 #endif
45 #include "prims/methodHandles.hpp"
46 
47 #ifdef ASSERT
check_location_valid()48 void RegisterMap::check_location_valid() {
49 }
50 #endif
51 
52 
53 // Profiling/safepoint support
54 
safe_for_sender(JavaThread * thread)55 bool frame::safe_for_sender(JavaThread *thread) {
56   address   sp = (address)_sp;
57   address   fp = (address)_fp;
58   address   unextended_sp = (address)_unextended_sp;
59 
60   // consider stack guards when trying to determine "safe" stack pointers
61   // sp must be within the usable part of the stack (not in guards)
62   if (!thread->is_in_usable_stack(sp)) {
63     return false;
64   }
65 
66   if (!thread->is_in_stack_range_incl(unextended_sp, sp)) {
67     return false;
68   }
69 
70   // We know sp/unextended_sp are safe. Only fp is questionable here.
71 
72   bool fp_safe = thread->is_in_stack_range_incl(fp, sp);
73 
74   if (_cb != NULL ) {
75 
76     // First check if frame is complete and tester is reliable
77     // Unfortunately we can only check frame complete for runtime stubs and nmethod
78     // other generic buffer blobs are more problematic so we just assume they are
79     // ok. adapter blobs never have a frame complete and are never ok.
80 
81     if (!_cb->is_frame_complete_at(_pc)) {
82       if (_cb->is_compiled() || _cb->is_adapter_blob() || _cb->is_runtime_stub()) {
83         return false;
84       }
85     }
86 
87     // Could just be some random pointer within the codeBlob
88     if (!_cb->code_contains(_pc)) {
89       return false;
90     }
91 
92     // Entry frame checks
93     if (is_entry_frame()) {
94       // an entry frame must have a valid fp.
95       return fp_safe && is_entry_frame_valid(thread);
96     }
97 
98     intptr_t* sender_sp = NULL;
99     address   sender_pc = NULL;
100 
101     if (is_interpreted_frame()) {
102       // fp must be safe
103       if (!fp_safe) {
104         return false;
105       }
106 
107       sender_pc = (address) this->fp()[return_addr_offset];
108       sender_sp = (intptr_t*) addr_at(sender_sp_offset);
109 
110     } else {
111       // must be some sort of compiled/runtime frame
112       // fp does not have to be safe (although it could be check for c1?)
113 
114       sender_sp = _unextended_sp + _cb->frame_size();
115       // Is sender_sp safe?
116       if (!thread->is_in_full_stack_checked((address)sender_sp)) {
117         return false;
118       }
119       // With our calling conventions, the return_address should
120       // end up being the word on the stack
121       sender_pc = (address) *(sender_sp - sender_sp_offset + return_addr_offset);
122     }
123 
124     // We must always be able to find a recognizable pc
125     CodeBlob* sender_blob = CodeCache::find_blob_unsafe(sender_pc);
126     if (sender_pc == NULL || sender_blob == NULL) {
127       return false;
128     }
129 
130 
131     // If the potential sender is the interpreter then we can do some more checking
132     if (Interpreter::contains(sender_pc)) {
133 
134       // FP is always saved in a recognizable place in any code we generate. However
135       // only if the sender is interpreted/call_stub (c1 too?) are we certain that the saved FP
136       // is really a frame pointer.
137 
138       intptr_t *saved_fp = (intptr_t*)*(sender_sp - frame::sender_sp_offset + link_offset);
139       if (!thread->is_in_stack_range_excl((address)saved_fp, (address)sender_sp)) {
140         return false;
141       }
142 
143       // construct the potential sender
144 
145       frame sender(sender_sp, saved_fp, sender_pc);
146 
147       return sender.is_interpreted_frame_valid(thread);
148     }
149 
150     if (sender_blob->is_zombie() || sender_blob->is_unloaded()) {
151       return false;
152     }
153 
154     // Could just be some random pointer within the codeBlob
155     if (!sender_blob->code_contains(sender_pc)) {
156       return false;
157     }
158 
159     // We should never be able to see an adapter if the current frame is something from code cache
160     if (sender_blob->is_adapter_blob()) {
161       return false;
162     }
163 
164     // Could be the call_stub
165     if (StubRoutines::returns_to_call_stub(sender_pc)) {
166       intptr_t *saved_fp = (intptr_t*)*(sender_sp - frame::sender_sp_offset + link_offset);
167       if (!thread->is_in_stack_range_excl((address)saved_fp, (address)sender_sp)) {
168         return false;
169       }
170 
171       // construct the potential sender
172 
173       frame sender(sender_sp, saved_fp, sender_pc);
174 
175       // Validate the JavaCallWrapper an entry frame must have
176       address jcw = (address)sender.entry_frame_call_wrapper();
177 
178       return thread->is_in_stack_range_excl(jcw, (address)sender.fp());
179     }
180 
181     // If the frame size is 0 something (or less) is bad because every nmethod has a non-zero frame size
182     // because the return address counts against the callee's frame.
183 
184     if (sender_blob->frame_size() <= 0) {
185       assert(!sender_blob->is_compiled(), "should count return address at least");
186       return false;
187     }
188 
189     // We should never be able to see anything here except an nmethod. If something in the
190     // code cache (current frame) is called by an entity within the code cache that entity
191     // should not be anything but the call stub (already covered), the interpreter (already covered)
192     // or an nmethod.
193 
194     if (!sender_blob->is_compiled()) {
195       return false;
196     }
197 
198     // Could put some more validation for the potential non-interpreted sender
199     // frame we'd create by calling sender if I could think of any. Wait for next crash in forte...
200 
201     // One idea is seeing if the sender_pc we have is one that we'd expect to call to current cb
202 
203     // We've validated the potential sender that would be created
204     return true;
205   }
206 
207   // Must be native-compiled frame. Since sender will try and use fp to find
208   // linkages it must be safe
209 
210   if (!fp_safe) {
211     return false;
212   }
213 
214   // Will the pc we fetch be non-zero (which we'll find at the oldest frame)
215 
216   if ((address) this->fp()[return_addr_offset] == NULL) return false;
217 
218 
219   // could try and do some more potential verification of native frame if we could think of some...
220 
221   return true;
222 }
223 
224 
patch_pc(Thread * thread,address pc)225 void frame::patch_pc(Thread* thread, address pc) {
226   assert(_cb == CodeCache::find_blob(pc), "unexpected pc");
227   address* pc_addr = &((address *)sp())[-sender_sp_offset+return_addr_offset];
228   if (TracePcPatching) {
229     tty->print_cr("patch_pc at address" INTPTR_FORMAT " [" INTPTR_FORMAT " -> " INTPTR_FORMAT "] ",
230                   p2i(pc_addr), p2i(*pc_addr), p2i(pc));
231   }
232   *pc_addr = pc;
233   address original_pc = CompiledMethod::get_deopt_original_pc(this);
234   if (original_pc != NULL) {
235     assert(original_pc == _pc, "expected original PC to be stored before patching");
236     _deopt_state = is_deoptimized;
237     // leave _pc as is
238   } else {
239     _deopt_state = not_deoptimized;
240     _pc = pc;
241   }
242 }
243 
is_interpreted_frame() const244 bool frame::is_interpreted_frame() const  {
245   return Interpreter::contains(pc());
246 }
247 
frame_size(RegisterMap * map) const248 int frame::frame_size(RegisterMap* map) const {
249   frame sender = this->sender(map);
250   return sender.sp() - sp();
251 }
252 
entry_frame_argument_at(int offset) const253 intptr_t* frame::entry_frame_argument_at(int offset) const {
254   assert(is_entry_frame(), "entry frame expected");
255   // convert offset to index to deal with tsi
256   int index = (Interpreter::expr_offset_in_bytes(offset)/wordSize);
257   // Entry frame's arguments are always in relation to unextended_sp()
258   return &unextended_sp()[index];
259 }
260 
261 // sender_sp
interpreter_frame_sender_sp() const262 intptr_t* frame::interpreter_frame_sender_sp() const {
263   assert(is_interpreted_frame(), "interpreted frame expected");
264   return (intptr_t*) at(interpreter_frame_sender_sp_offset);
265 }
266 
set_interpreter_frame_sender_sp(intptr_t * sender_sp)267 void frame::set_interpreter_frame_sender_sp(intptr_t* sender_sp) {
268   assert(is_interpreted_frame(), "interpreted frame expected");
269   ptr_at_put(interpreter_frame_sender_sp_offset, (intptr_t) sender_sp);
270 }
271 
272 
273 // monitor elements
274 
interpreter_frame_monitor_begin() const275 BasicObjectLock* frame::interpreter_frame_monitor_begin() const {
276   return (BasicObjectLock*) addr_at(interpreter_frame_monitor_block_bottom_offset);
277 }
278 
interpreter_frame_monitor_end() const279 BasicObjectLock* frame::interpreter_frame_monitor_end() const {
280   BasicObjectLock* result = (BasicObjectLock*) *addr_at(interpreter_frame_monitor_block_top_offset);
281   // make sure the pointer points inside the frame
282   assert((intptr_t) fp() >  (intptr_t) result, "result must <  than frame pointer");
283   assert((intptr_t) sp() <= (intptr_t) result, "result must >= than stack pointer");
284   return result;
285 }
286 
interpreter_frame_set_monitor_end(BasicObjectLock * value)287 void frame::interpreter_frame_set_monitor_end(BasicObjectLock* value) {
288   *((BasicObjectLock**)addr_at(interpreter_frame_monitor_block_top_offset)) = value;
289 }
290 
291 
292 // Used by template based interpreter deoptimization
interpreter_frame_set_last_sp(intptr_t * sp)293 void frame::interpreter_frame_set_last_sp(intptr_t* sp) {
294     *((intptr_t**)addr_at(interpreter_frame_last_sp_offset)) = sp;
295 }
296 
297 
sender_for_entry_frame(RegisterMap * map) const298 frame frame::sender_for_entry_frame(RegisterMap* map) const {
299   assert(map != NULL, "map must be set");
300   // Java frame called from C; skip all C frames and return top C
301   // frame of that chunk as the sender
302   JavaFrameAnchor* jfa = entry_frame_call_wrapper()->anchor();
303   assert(!entry_frame_is_first(), "next Java fp must be non zero");
304   assert(jfa->last_Java_sp() > sp(), "must be above this frame on stack");
305   map->clear();
306   assert(map->include_argument_oops(), "should be set by clear");
307   if (jfa->last_Java_pc() != NULL) {
308     frame fr(jfa->last_Java_sp(), jfa->last_Java_fp(), jfa->last_Java_pc());
309     return fr;
310   }
311   frame fr(jfa->last_Java_sp(), jfa->last_Java_fp());
312   return fr;
313 }
314 
315 //------------------------------------------------------------------------------
316 // frame::verify_deopt_original_pc
317 //
318 // Verifies the calculated original PC of a deoptimization PC for the
319 // given unextended SP.  The unextended SP might also be the saved SP
320 // for MethodHandle call sites.
321 #ifdef ASSERT
verify_deopt_original_pc(CompiledMethod * nm,intptr_t * unextended_sp,bool is_method_handle_return)322 void frame::verify_deopt_original_pc(CompiledMethod* nm, intptr_t* unextended_sp, bool is_method_handle_return) {
323   frame fr;
324 
325   // This is ugly but it's better than to change {get,set}_original_pc
326   // to take an SP value as argument.  And it's only a debugging
327   // method anyway.
328   fr._unextended_sp = unextended_sp;
329 
330   address original_pc = nm->get_original_pc(&fr);
331   assert(nm->insts_contains_inclusive(original_pc),
332          "original PC must be in the main code section of the the compiled method (or must be immediately following it)");
333   assert(nm->is_method_handle_return(original_pc) == is_method_handle_return, "must be");
334 }
335 #endif
336 
337 //------------------------------------------------------------------------------
338 // frame::adjust_unextended_sp
adjust_unextended_sp()339 void frame::adjust_unextended_sp() {
340   // same as on x86
341 
342   // If we are returning to a compiled MethodHandle call site, the
343   // saved_fp will in fact be a saved value of the unextended SP.  The
344   // simplest way to tell whether we are returning to such a call site
345   // is as follows:
346 
347   CompiledMethod* sender_cm = (_cb == NULL) ? NULL : _cb->as_compiled_method_or_null();
348   if (sender_cm != NULL) {
349     // If the sender PC is a deoptimization point, get the original
350     // PC.  For MethodHandle call site the unextended_sp is stored in
351     // saved_fp.
352     if (sender_cm->is_deopt_mh_entry(_pc)) {
353       DEBUG_ONLY(verify_deopt_mh_original_pc(sender_cm, _fp));
354       _unextended_sp = _fp;
355     }
356     else if (sender_cm->is_deopt_entry(_pc)) {
357       DEBUG_ONLY(verify_deopt_original_pc(sender_cm, _unextended_sp));
358     }
359     else if (sender_cm->is_method_handle_return(_pc)) {
360       _unextended_sp = _fp;
361     }
362   }
363 }
364 
365 //------------------------------------------------------------------------------
366 // frame::update_map_with_saved_link
update_map_with_saved_link(RegisterMap * map,intptr_t ** link_addr)367 void frame::update_map_with_saved_link(RegisterMap* map, intptr_t** link_addr) {
368   // see x86 for comments
369   map->set_location(FP->as_VMReg(), (address) link_addr);
370 }
371 
sender_for_interpreter_frame(RegisterMap * map) const372 frame frame::sender_for_interpreter_frame(RegisterMap* map) const {
373   // SP is the raw SP from the sender after adapter or interpreter
374   // extension.
375   intptr_t* sender_sp = this->sender_sp();
376 
377   // This is the sp before any possible extension (adapter/locals).
378   intptr_t* unextended_sp = interpreter_frame_sender_sp();
379 
380 #ifdef COMPILER2
381   if (map->update_map()) {
382     update_map_with_saved_link(map, (intptr_t**) addr_at(link_offset));
383   }
384 #endif // COMPILER2
385 
386   return frame(sender_sp, unextended_sp, link(), sender_pc());
387 }
388 
sender_for_compiled_frame(RegisterMap * map) const389 frame frame::sender_for_compiled_frame(RegisterMap* map) const {
390   assert(map != NULL, "map must be set");
391 
392   // frame owned by optimizing compiler
393   assert(_cb->frame_size() >= 0, "must have non-zero frame size");
394   intptr_t* sender_sp = unextended_sp() + _cb->frame_size();
395   intptr_t* unextended_sp = sender_sp;
396 
397   address sender_pc = (address) *(sender_sp - sender_sp_offset + return_addr_offset);
398 
399   // This is the saved value of FP which may or may not really be an FP.
400   // It is only an FP if the sender is an interpreter frame (or C1?).
401   intptr_t** saved_fp_addr = (intptr_t**) (sender_sp - sender_sp_offset + link_offset);
402 
403   if (map->update_map()) {
404     // Tell GC to use argument oopmaps for some runtime stubs that need it.
405     // For C1, the runtime stub might not have oop maps, so set this flag
406     // outside of update_register_map.
407     map->set_include_argument_oops(_cb->caller_must_gc_arguments(map->thread()));
408     if (_cb->oop_maps() != NULL) {
409       OopMapSet::update_register_map(this, map);
410     }
411 
412     // Since the prolog does the save and restore of FP there is no oopmap
413     // for it so we must fill in its location as if there was an oopmap entry
414     // since if our caller was compiled code there could be live jvm state in it.
415     update_map_with_saved_link(map, saved_fp_addr);
416   }
417 
418   assert(sender_sp != sp(), "must have changed");
419   return frame(sender_sp, unextended_sp, *saved_fp_addr, sender_pc);
420 }
421 
sender(RegisterMap * map) const422 frame frame::sender(RegisterMap* map) const {
423   // Default is we done have to follow them. The sender_for_xxx will
424   // update it accordingly
425   map->set_include_argument_oops(false);
426 
427   if (is_entry_frame())       return sender_for_entry_frame(map);
428   if (is_interpreted_frame()) return sender_for_interpreter_frame(map);
429   assert(_cb == CodeCache::find_blob(pc()),"Must be the same");
430 
431   if (_cb != NULL) {
432     return sender_for_compiled_frame(map);
433   }
434 
435   assert(false, "should not be called for a C frame");
436   return frame();
437 }
438 
is_interpreted_frame_valid(JavaThread * thread) const439 bool frame::is_interpreted_frame_valid(JavaThread* thread) const {
440   assert(is_interpreted_frame(), "Not an interpreted frame");
441   // These are reasonable sanity checks
442   if (fp() == 0 || (intptr_t(fp()) & (wordSize-1)) != 0) {
443     return false;
444   }
445   if (sp() == 0 || (intptr_t(sp()) & (wordSize-1)) != 0) {
446     return false;
447   }
448   if (fp() + interpreter_frame_initial_sp_offset < sp()) {
449     return false;
450   }
451   // These are hacks to keep us out of trouble.
452   // The problem with these is that they mask other problems
453   if (fp() <= sp()) {        // this attempts to deal with unsigned comparison above
454     return false;
455   }
456   // do some validation of frame elements
457 
458   // first the method
459 
460   Method* m = *interpreter_frame_method_addr();
461 
462   // validate the method we'd find in this potential sender
463   if (!Method::is_valid_method(m)) return false;
464 
465   // stack frames shouldn't be much larger than max_stack elements
466 
467   if (fp() - sp() > 1024 + m->max_stack()*Interpreter::stackElementSize) {
468     return false;
469   }
470 
471   // validate bci/bcp
472 
473   address bcp = interpreter_frame_bcp();
474   if (m->validate_bci_from_bcp(bcp) < 0) {
475     return false;
476   }
477 
478   // validate ConstantPoolCache*
479   ConstantPoolCache* cp = *interpreter_frame_cache_addr();
480   if (MetaspaceObj::is_valid(cp) == false) return false;
481 
482   // validate locals
483 
484   address locals =  (address) *interpreter_frame_locals_addr();
485   return thread->is_in_stack_range_incl(locals, (address)fp());
486 }
487 
interpreter_frame_result(oop * oop_result,jvalue * value_result)488 BasicType frame::interpreter_frame_result(oop* oop_result, jvalue* value_result) {
489   assert(is_interpreted_frame(), "interpreted frame expected");
490   Method* method = interpreter_frame_method();
491   BasicType type = method->result_type();
492 
493   intptr_t* res_addr;
494   if (method->is_native()) {
495     // Prior to calling into the runtime to report the method_exit both of
496     // the possible return value registers are saved.
497     // Return value registers are pushed to the native stack
498     res_addr = (intptr_t*)sp();
499 #ifdef __ABI_HARD__
500     // FP result is pushed onto a stack along with integer result registers
501     if (type == T_FLOAT || type == T_DOUBLE) {
502       res_addr += 2;
503     }
504 #endif // __ABI_HARD__
505   } else {
506     res_addr = (intptr_t*)interpreter_frame_tos_address();
507   }
508 
509   switch (type) {
510     case T_OBJECT  :
511     case T_ARRAY   : {
512       oop obj;
513       if (method->is_native()) {
514         obj = cast_to_oop(at(interpreter_frame_oop_temp_offset));
515       } else {
516         obj = *(oop*)res_addr;
517       }
518       assert(obj == NULL || Universe::heap()->is_in(obj), "sanity check");
519       *oop_result = obj;
520       break;
521     }
522     case T_BOOLEAN : value_result->z = *(jboolean*)res_addr; break;
523     case T_BYTE    : value_result->b = *(jbyte*)res_addr; break;
524     case T_CHAR    : value_result->c = *(jchar*)res_addr; break;
525     case T_SHORT   : value_result->s = *(jshort*)res_addr; break;
526     case T_INT     : value_result->i = *(jint*)res_addr; break;
527     case T_LONG    : value_result->j = *(jlong*)res_addr; break;
528     case T_FLOAT   : value_result->f = *(jfloat*)res_addr; break;
529     case T_DOUBLE  : value_result->d = *(jdouble*)res_addr; break;
530     case T_VOID    : /* Nothing to do */ break;
531     default        : ShouldNotReachHere();
532   }
533 
534   return type;
535 }
536 
537 
interpreter_frame_tos_at(jint offset) const538 intptr_t* frame::interpreter_frame_tos_at(jint offset) const {
539   int index = (Interpreter::expr_offset_in_bytes(offset)/wordSize);
540   return &interpreter_frame_tos_address()[index];
541 }
542 
543 #ifndef PRODUCT
544 
545 #define DESCRIBE_FP_OFFSET(name) \
546   values.describe(frame_no, fp() + frame::name##_offset, #name)
547 
describe_pd(FrameValues & values,int frame_no)548 void frame::describe_pd(FrameValues& values, int frame_no) {
549   if (is_interpreted_frame()) {
550     DESCRIBE_FP_OFFSET(interpreter_frame_sender_sp);
551     DESCRIBE_FP_OFFSET(interpreter_frame_last_sp);
552     DESCRIBE_FP_OFFSET(interpreter_frame_method);
553     DESCRIBE_FP_OFFSET(interpreter_frame_mdp);
554     DESCRIBE_FP_OFFSET(interpreter_frame_cache);
555     DESCRIBE_FP_OFFSET(interpreter_frame_locals);
556     DESCRIBE_FP_OFFSET(interpreter_frame_bcp);
557     DESCRIBE_FP_OFFSET(interpreter_frame_initial_sp);
558   }
559 }
560 
561 // This is a generic constructor which is only used by pns() in debug.cpp.
frame(void * sp,void * fp,void * pc)562 frame::frame(void* sp, void* fp, void* pc) {
563   init((intptr_t*)sp, (intptr_t*)fp, (address)pc);
564 }
565 
pd_ps()566 void frame::pd_ps() {}
567 #endif
568 
initial_deoptimization_info()569 intptr_t *frame::initial_deoptimization_info() {
570   // used to reset the saved FP
571   return fp();
572 }
573 
real_fp() const574 intptr_t* frame::real_fp() const {
575   if (is_entry_frame()) {
576     // Work-around: FP (currently) does not conform to the ABI for entry
577     // frames (see generate_call_stub). Might be worth fixing as another CR.
578     // Following code assumes (and asserts) this has not yet been fixed.
579     assert(frame::entry_frame_call_wrapper_offset == 0, "adjust this code");
580     intptr_t* new_fp = fp();
581     new_fp += 5; // saved R0,R1,R2,R4,R10
582 #ifndef __SOFTFP__
583     new_fp += 8*2; // saved D8..D15
584 #endif
585     return new_fp;
586   }
587   if (_cb != NULL) {
588     // use the frame size if valid
589     int size = _cb->frame_size();
590     if (size > 0) {
591       return unextended_sp() + size;
592     }
593   }
594   // else rely on fp()
595   assert(! is_compiled_frame(), "unknown compiled frame size");
596   return fp();
597 }
598