2 * tramp-arm.c: JIT trampoline code for ARM
5 * Paolo Molaro (lupus@ximian.com)
7 * (C) 2001 Ximian, Inc.
13 #include <mono/metadata/appdomain.h>
14 #include <mono/metadata/marshal.h>
15 #include <mono/metadata/tabledefs.h>
16 #include <mono/arch/arm/arm-codegen.h>
21 static guint8* nullified_class_init_trampoline;
24 * Return the instruction to jump from code to target, 0 if not
25 * reachable with a single instruction
28 branch_for_target_reachable (guint8 *branch, guint8 *target)
30 gint diff = target - branch - 8;
31 g_assert ((diff & 3) == 0);
34 return (ARMCOND_AL << ARMCOND_SHIFT) | (ARM_BR_TAG) | (diff >> 2);
36 /* diff between 0 and -33554432 */
37 if (diff >= -33554432)
38 return (ARMCOND_AL << ARMCOND_SHIFT) | (ARM_BR_TAG) | ((diff >> 2) & ~0xff000000);
44 * mono_arch_get_unbox_trampoline:
45 * @gsctx: the generic sharing context
47 * @addr: pointer to native code for @m
49 * when value type methods are called through the vtable we need to unbox the
50 * this argument. This method returns a pointer to a trampoline which does
51 * unboxing before calling the method
54 mono_arch_get_unbox_trampoline (MonoGenericSharingContext *gsctx, MonoMethod *m, gpointer addr)
58 MonoDomain *domain = mono_domain_get ();
60 if (MONO_TYPE_ISSTRUCT (mono_method_signature (m)->ret))
63 mono_domain_lock (domain);
64 start = code = mono_code_manager_reserve (domain->code_mp, 16);
65 mono_domain_unlock (domain);
67 ARM_LDR_IMM (code, ARMREG_IP, ARMREG_PC, 4);
68 ARM_ADD_REG_IMM8 (code, this_pos, this_pos, sizeof (MonoObject));
69 ARM_MOV_REG_REG (code, ARMREG_PC, ARMREG_IP);
70 *(guint32*)code = (guint32)addr;
72 mono_arch_flush_icache (start, code - start);
73 g_assert ((code - start) <= 16);
74 /*g_print ("unbox trampoline at %d for %s:%s\n", this_pos, m->klass->name, m->name);
75 g_print ("unbox code is at %p for method at %p\n", start, addr);*/
81 mono_arch_patch_callsite (guint8 *method_start, guint8 *code_ptr, guint8 *addr)
83 guint32 *code = (guint32*)code_ptr;
85 /* This is the 'bl' or the 'mov pc' instruction */
89 * Note that methods are called also with the bl opcode.
91 if ((((*code) >> 25) & 7) == 5) {
92 /*g_print ("direct patching\n");*/
93 arm_patch ((guint8*)code, addr);
94 mono_arch_flush_icache ((guint8*)code, 4);
98 if ((((*code) >> 20) & 0xFF) == 0x12) {
99 /*g_print ("patching bx\n");*/
100 arm_patch ((guint8*)code, addr);
101 mono_arch_flush_icache ((guint8*)(code - 2), 4);
105 g_assert_not_reached ();
109 mono_arch_patch_plt_entry (guint8 *code, guint8 *addr)
111 /* Patch the jump table entry used by the plt entry */
112 guint32 offset = ((guint32*)code)[3];
113 guint8 *jump_entry = code + offset + 12;
115 *(guint8**)jump_entry = addr;
119 mono_arch_nullify_class_init_trampoline (guint8 *code, gssize *regs)
121 mono_arch_patch_callsite (NULL, code, nullified_class_init_trampoline);
125 mono_arch_nullify_plt_entry (guint8 *code)
127 if (mono_aot_only && !nullified_class_init_trampoline)
128 nullified_class_init_trampoline = mono_aot_get_named_code ("nullified_class_init_trampoline");
130 mono_arch_patch_plt_entry (code, nullified_class_init_trampoline);
133 /* Stack size for trampoline function
135 #define STACK (sizeof (MonoLMF))
137 /* Method-specific trampoline code fragment size */
138 #define METHOD_TRAMPOLINE_SIZE 64
140 /* Jump-specific trampoline code fragment size */
141 #define JUMP_TRAMPOLINE_SIZE 64
143 #define GEN_TRAMP_SIZE 192
146 * Stack frame description when the generic trampoline is called.
148 * ------------------- old sp
150 * ------------------- sp
153 mono_arch_create_trampoline_code (MonoTrampolineType tramp_type)
158 return mono_arch_create_trampoline_code_full (tramp_type, &code_size, &ji, FALSE);
162 mono_arch_create_trampoline_code_full (MonoTrampolineType tramp_type, guint32 *code_size, MonoJumpInfo **ji, gboolean aot)
164 guint8 *buf, *code = NULL;
165 guint8 *load_get_lmf_addr, *load_trampoline;
167 GSList *unwind_ops = NULL, *l;
172 /* Now we'll create in 'buf' the ARM trampoline code. This
173 is the trampoline code common to all methods */
175 code = buf = mono_global_codeman_reserve (GEN_TRAMP_SIZE);
178 * At this point lr points to the specific arg and sp points to the saved
179 * regs on the stack (all but PC and SP). The original LR value has been
180 * saved as sp + LR_OFFSET by the push in the specific trampoline
182 #define LR_OFFSET (sizeof (gpointer) * 13)
184 // FIXME: Finish the unwind info, the current info allows us to unwind
185 // when the trampoline is not in the epilog
187 // CFA = SP + (num registers pushed) * 4
188 cfa_offset = 14 * sizeof (gpointer);
189 mono_add_unwind_op_def_cfa (unwind_ops, code, buf, ARMREG_SP, cfa_offset);
190 // PC saved at sp+LR_OFFSET
191 mono_add_unwind_op_offset (unwind_ops, code, buf, ARMREG_LR, -4);
193 ARM_MOV_REG_REG (code, ARMREG_V1, ARMREG_SP);
194 if (aot && tramp_type != MONO_TRAMPOLINE_GENERIC_CLASS_INIT) {
196 * The trampoline contains a pc-relative offset to the got slot where the
197 * value is stored. The offset can be found at [lr + 4].
199 ARM_LDR_IMM (code, ARMREG_V2, ARMREG_LR, 4);
200 ARM_LDR_REG_REG (code, ARMREG_V2, ARMREG_V2, ARMREG_LR);
202 if (tramp_type != MONO_TRAMPOLINE_GENERIC_CLASS_INIT)
203 ARM_LDR_IMM (code, ARMREG_V2, ARMREG_LR, 0);
205 ARM_MOV_REG_REG (code, ARMREG_V2, MONO_ARCH_VTABLE_REG);
207 ARM_LDR_IMM (code, ARMREG_V3, ARMREG_SP, LR_OFFSET);
209 /* ok, now we can continue with the MonoLMF setup, mostly untouched
210 * from emit_prolog in mini-arm.c
211 * This is a synthetized call to mono_get_lmf_addr ()
214 *ji = mono_patch_info_list_prepend (*ji, code - buf, MONO_PATCH_INFO_JIT_ICALL_ADDR, "mono_get_lmf_addr");
215 ARM_LDR_IMM (code, ARMREG_R0, ARMREG_PC, 0);
217 *(gpointer*)code = NULL;
219 ARM_LDR_REG_REG (code, ARMREG_R0, ARMREG_PC, ARMREG_R0);
221 load_get_lmf_addr = code;
224 ARM_MOV_REG_REG (code, ARMREG_LR, ARMREG_PC);
225 ARM_MOV_REG_REG (code, ARMREG_PC, ARMREG_R0);
227 /* we build the MonoLMF structure on the stack - see mini-arm.h
228 * The pointer to the struct is put in r1.
229 * the iregs array is already allocated on the stack by push.
231 ARM_SUB_REG_IMM8 (code, ARMREG_SP, ARMREG_SP, sizeof (MonoLMF) - sizeof (guint) * 14);
232 cfa_offset += sizeof (MonoLMF) - sizeof (guint) * 14;
233 mono_add_unwind_op_def_cfa_offset (unwind_ops, code, buf, cfa_offset);
234 ARM_ADD_REG_IMM8 (code, ARMREG_R1, ARMREG_SP, STACK - sizeof (MonoLMF));
235 /* r0 is the result from mono_get_lmf_addr () */
236 ARM_STR_IMM (code, ARMREG_R0, ARMREG_R1, G_STRUCT_OFFSET (MonoLMF, lmf_addr));
237 /* new_lmf->previous_lmf = *lmf_addr */
238 ARM_LDR_IMM (code, ARMREG_R2, ARMREG_R0, G_STRUCT_OFFSET (MonoLMF, previous_lmf));
239 ARM_STR_IMM (code, ARMREG_R2, ARMREG_R1, G_STRUCT_OFFSET (MonoLMF, previous_lmf));
240 /* *(lmf_addr) = r1 */
241 ARM_STR_IMM (code, ARMREG_R1, ARMREG_R0, G_STRUCT_OFFSET (MonoLMF, previous_lmf));
242 /* save method info (it's in v2) */
243 if ((tramp_type == MONO_TRAMPOLINE_JIT) || (tramp_type == MONO_TRAMPOLINE_JUMP))
244 ARM_STR_IMM (code, ARMREG_V2, ARMREG_R1, G_STRUCT_OFFSET (MonoLMF, method));
245 ARM_STR_IMM (code, ARMREG_SP, ARMREG_R1, G_STRUCT_OFFSET (MonoLMF, ebp));
246 /* save the IP (caller ip) */
247 if (tramp_type == MONO_TRAMPOLINE_JUMP) {
248 ARM_MOV_REG_IMM8 (code, ARMREG_R2, 0);
250 /* assumes STACK == sizeof (MonoLMF) */
251 ARM_LDR_IMM (code, ARMREG_R2, ARMREG_SP, (G_STRUCT_OFFSET (MonoLMF, iregs) + 13*4));
253 ARM_STR_IMM (code, ARMREG_R2, ARMREG_R1, G_STRUCT_OFFSET (MonoLMF, eip));
256 * Now we're ready to call xxx_trampoline ().
258 /* Arg 1: the saved registers. It was put in v1 */
259 ARM_MOV_REG_REG (code, ARMREG_R0, ARMREG_V1);
261 /* Arg 2: code (next address to the instruction that called us) */
262 if (tramp_type == MONO_TRAMPOLINE_JUMP) {
263 ARM_MOV_REG_IMM8 (code, ARMREG_R1, 0);
265 ARM_MOV_REG_REG (code, ARMREG_R1, ARMREG_V3);
268 /* Arg 3: the specific argument, stored in v2
270 ARM_MOV_REG_REG (code, ARMREG_R2, ARMREG_V2);
273 char *icall_name = g_strdup_printf ("trampoline_func_%d", tramp_type);
274 *ji = mono_patch_info_list_prepend (*ji, code - buf, MONO_PATCH_INFO_JIT_ICALL_ADDR, icall_name);
275 ARM_LDR_IMM (code, ARMREG_IP, ARMREG_PC, 0);
277 *(gpointer*)code = NULL;
279 ARM_LDR_REG_REG (code, ARMREG_IP, ARMREG_PC, ARMREG_IP);
281 load_trampoline = code;
285 ARM_MOV_REG_REG (code, ARMREG_LR, ARMREG_PC);
286 ARM_MOV_REG_REG (code, ARMREG_PC, ARMREG_IP);
288 /* OK, code address is now on r0. Move it to the place on the stack
289 * where IP was saved (it is now no more useful to us and it can be
290 * clobbered). This way we can just restore all the regs in one inst
293 ARM_STR_IMM (code, ARMREG_R0, ARMREG_V1, (ARMREG_R12 * 4));
295 /* Check for thread interruption */
296 /* This is not perf critical code so no need to check the interrupt flag */
298 * Have to call the _force_ variant, since there could be a protected wrapper on the top of the stack.
301 *ji = mono_patch_info_list_prepend (*ji, code - buf, MONO_PATCH_INFO_JIT_ICALL_ADDR, "mono_thread_force_interruption_checkpoint");
302 ARM_LDR_IMM (code, ARMREG_IP, ARMREG_PC, 0);
304 *(gpointer*)code = NULL;
306 ARM_LDR_REG_REG (code, ARMREG_IP, ARMREG_PC, ARMREG_IP);
308 ARM_LDR_IMM (code, ARMREG_IP, ARMREG_PC, 0);
310 *(gpointer*)code = mono_thread_force_interruption_checkpoint;
313 ARM_MOV_REG_REG (code, ARMREG_LR, ARMREG_PC);
314 ARM_MOV_REG_REG (code, ARMREG_PC, ARMREG_IP);
317 * Now we restore the MonoLMF (see emit_epilogue in mini-arm.c)
318 * and the rest of the registers, so the method called will see
319 * the same state as before we executed.
320 * The pointer to MonoLMF is in r2.
322 ARM_MOV_REG_REG (code, ARMREG_R2, ARMREG_SP);
323 /* ip = previous_lmf */
324 ARM_LDR_IMM (code, ARMREG_IP, ARMREG_R2, G_STRUCT_OFFSET (MonoLMF, previous_lmf));
326 ARM_LDR_IMM (code, ARMREG_LR, ARMREG_R2, G_STRUCT_OFFSET (MonoLMF, lmf_addr));
327 /* *(lmf_addr) = previous_lmf */
328 ARM_STR_IMM (code, ARMREG_IP, ARMREG_LR, G_STRUCT_OFFSET (MonoLMF, previous_lmf));
330 /* Non-standard function epilogue. Instead of doing a proper
331 * return, we just jump to the compiled code.
333 /* Restore the registers and jump to the code:
334 * Note that IP has been conveniently set to the method addr.
336 ARM_ADD_REG_IMM8 (code, ARMREG_SP, ARMREG_SP, sizeof (MonoLMF) - sizeof (guint) * 14);
337 ARM_POP_NWB (code, 0x5fff);
338 if (tramp_type == MONO_TRAMPOLINE_RGCTX_LAZY_FETCH)
339 ARM_MOV_REG_REG (code, ARMREG_R0, ARMREG_IP);
340 /* do we need to set sp? */
341 ARM_ADD_REG_IMM8 (code, ARMREG_SP, ARMREG_SP, (14 * 4));
342 if ((tramp_type == MONO_TRAMPOLINE_CLASS_INIT) || (tramp_type == MONO_TRAMPOLINE_GENERIC_CLASS_INIT) || (tramp_type == MONO_TRAMPOLINE_RGCTX_LAZY_FETCH))
343 ARM_MOV_REG_REG (code, ARMREG_PC, ARMREG_LR);
345 ARM_MOV_REG_REG (code, ARMREG_PC, ARMREG_IP);
347 constants = (gpointer*)code;
348 constants [0] = mono_get_lmf_addr;
349 constants [1] = (gpointer)mono_get_trampoline_func (tramp_type);
352 /* backpatch by emitting the missing instructions skipped above */
353 ARM_LDR_IMM (load_get_lmf_addr, ARMREG_R0, ARMREG_PC, (code - load_get_lmf_addr - 8));
354 ARM_LDR_IMM (load_trampoline, ARMREG_IP, ARMREG_PC, (code + 4 - load_trampoline - 8));
359 /* Flush instruction cache, since we've generated code */
360 mono_arch_flush_icache (buf, code - buf);
363 g_assert ((code - buf) <= GEN_TRAMP_SIZE);
365 *code_size = code - buf;
367 if (tramp_type == MONO_TRAMPOLINE_CLASS_INIT) {
370 /* Initialize the nullified class init trampoline used in the AOT case */
371 nullified_class_init_trampoline = mono_arch_get_nullified_class_init_trampoline (&code_len);
374 mono_save_trampoline_xdebug_info ("<generic_trampoline>", buf, *code_size, unwind_ops);
376 for (l = unwind_ops; l; l = l->next)
378 g_slist_free (unwind_ops);
384 mono_arch_get_nullified_class_init_trampoline (guint32 *code_len)
388 code = buf = mono_global_codeman_reserve (16);
390 ARM_MOV_REG_REG (code, ARMREG_PC, ARMREG_LR);
392 mono_arch_flush_icache (buf, code - buf);
394 *code_len = code - buf;
399 #define SPEC_TRAMP_SIZE 24
402 mono_arch_create_specific_trampoline (gpointer arg1, MonoTrampolineType tramp_type, MonoDomain *domain, guint32 *code_len)
404 guint8 *code, *buf, *tramp;
406 guint32 short_branch, size = SPEC_TRAMP_SIZE;
408 tramp = mono_get_trampoline_code (tramp_type);
410 mono_domain_lock (domain);
411 code = buf = mono_code_manager_reserve_align (domain->code_mp, size, 4);
412 if ((short_branch = branch_for_target_reachable (code + 8, tramp))) {
414 mono_code_manager_commit (domain->code_mp, code, SPEC_TRAMP_SIZE, size);
416 mono_domain_unlock (domain);
418 /* we could reduce this to 12 bytes if tramp is within reach:
422 * The called code can access method using the lr register
423 * A 20 byte sequence could be:
425 * ARM_MOV_REG_REG (lr, pc)
426 * ARM_LDR_IMM (pc, pc, 0)
430 /* We save all the registers, except PC and SP */
431 ARM_PUSH (code, 0x5fff);
433 constants = (gpointer*)code;
434 constants [0] = GUINT_TO_POINTER (short_branch | (1 << 24));
435 constants [1] = arg1;
438 ARM_LDR_IMM (code, ARMREG_R1, ARMREG_PC, 8); /* temp reg */
439 ARM_MOV_REG_REG (code, ARMREG_LR, ARMREG_PC);
440 ARM_MOV_REG_REG (code, ARMREG_PC, ARMREG_R1);
442 constants = (gpointer*)code;
443 constants [0] = arg1;
444 constants [1] = tramp;
448 /* Flush instruction cache, since we've generated code */
449 mono_arch_flush_icache (buf, code - buf);
451 g_assert ((code - buf) <= size);
454 *code_len = code - buf;
459 #define arm_is_imm12(v) ((int)(v) > -4096 && (int)(v) < 4096)
462 mono_arch_create_rgctx_lazy_fetch_trampoline (guint32 slot)
467 return mono_arch_create_rgctx_lazy_fetch_trampoline_full (slot, &code_size, &ji, FALSE);
471 mono_arch_create_rgctx_lazy_fetch_trampoline_full (guint32 slot, guint32 *code_size, MonoJumpInfo **ji, gboolean aot)
477 guint8 **rgctx_null_jumps;
484 mrgctx = MONO_RGCTX_SLOT_IS_MRGCTX (slot);
485 index = MONO_RGCTX_SLOT_INDEX (slot);
487 index += sizeof (MonoMethodRuntimeGenericContext) / sizeof (gpointer);
488 for (depth = 0; ; ++depth) {
489 int size = mono_class_rgctx_get_array_size (depth, mrgctx);
491 if (index < size - 1)
496 tramp_size = 64 + 16 * depth;
498 code = buf = mono_global_codeman_reserve (tramp_size);
500 rgctx_null_jumps = g_malloc (sizeof (guint8*) * (depth + 2));
503 /* The vtable/mrgctx is in R0 */
504 g_assert (MONO_ARCH_VTABLE_REG == ARMREG_R0);
508 ARM_MOV_REG_REG (code, ARMREG_R1, ARMREG_R0);
510 /* load rgctx ptr from vtable */
511 g_assert (arm_is_imm12 (G_STRUCT_OFFSET (MonoVTable, runtime_generic_context)));
512 ARM_LDR_IMM (code, ARMREG_R1, ARMREG_R0, G_STRUCT_OFFSET (MonoVTable, runtime_generic_context));
513 /* is the rgctx ptr null? */
514 ARM_CMP_REG_IMM (code, ARMREG_R1, 0, 0);
515 /* if yes, jump to actual trampoline */
516 rgctx_null_jumps [njumps ++] = code;
517 ARM_B_COND (code, ARMCOND_EQ, 0);
520 for (i = 0; i < depth; ++i) {
521 /* load ptr to next array */
522 if (mrgctx && i == 0) {
523 g_assert (arm_is_imm12 (sizeof (MonoMethodRuntimeGenericContext)));
524 ARM_LDR_IMM (code, ARMREG_R1, ARMREG_R1, sizeof (MonoMethodRuntimeGenericContext));
526 ARM_LDR_IMM (code, ARMREG_R1, ARMREG_R1, 0);
528 /* is the ptr null? */
529 ARM_CMP_REG_IMM (code, ARMREG_R1, 0, 0);
530 /* if yes, jump to actual trampoline */
531 rgctx_null_jumps [njumps ++] = code;
532 ARM_B_COND (code, ARMCOND_EQ, 0);
536 code = mono_arm_emit_load_imm (code, ARMREG_R2, sizeof (gpointer) * (index + 1));
537 ARM_LDR_REG_REG (code, ARMREG_R1, ARMREG_R1, ARMREG_R2);
538 /* is the slot null? */
539 ARM_CMP_REG_IMM (code, ARMREG_R1, 0, 0);
540 /* if yes, jump to actual trampoline */
541 rgctx_null_jumps [njumps ++] = code;
542 ARM_B_COND (code, ARMCOND_EQ, 0);
543 /* otherwise return, result is in R1 */
544 ARM_MOV_REG_REG (code, ARMREG_R0, ARMREG_R1);
545 ARM_MOV_REG_REG (code, ARMREG_PC, ARMREG_LR);
547 g_assert (njumps <= depth + 2);
548 for (i = 0; i < njumps; ++i)
549 arm_patch (rgctx_null_jumps [i], code);
551 g_free (rgctx_null_jumps);
555 /* The vtable/mrgctx is still in R0 */
558 *ji = mono_patch_info_list_prepend (*ji, code - buf, MONO_PATCH_INFO_JIT_ICALL_ADDR, g_strdup_printf ("specific_trampoline_lazy_fetch_%u", slot));
559 ARM_LDR_IMM (code, ARMREG_R1, ARMREG_PC, 0);
561 *(gpointer*)code = NULL;
563 ARM_LDR_REG_REG (code, ARMREG_PC, ARMREG_PC, ARMREG_R1);
565 tramp = mono_arch_create_specific_trampoline (GUINT_TO_POINTER (slot), MONO_TRAMPOLINE_RGCTX_LAZY_FETCH, mono_get_root_domain (), &code_len);
567 /* Jump to the actual trampoline */
568 ARM_LDR_IMM (code, ARMREG_R1, ARMREG_PC, 0); /* temp reg */
569 ARM_MOV_REG_REG (code, ARMREG_PC, ARMREG_R1);
570 *(gpointer*)code = tramp;
574 mono_arch_flush_icache (buf, code - buf);
576 g_assert (code - buf <= tramp_size);
578 *code_size = code - buf;
583 #define arm_is_imm8(v) ((v) > -256 && (v) < 256)
586 mono_arch_create_generic_class_init_trampoline (void)
590 static int byte_offset = -1;
591 static guint8 bitmask;
594 guint32 code_len, imm8;
599 code = buf = mono_global_codeman_reserve (tramp_size);
602 mono_marshal_find_bitfield_offset (MonoVTable, initialized, &byte_offset, &bitmask);
604 g_assert (arm_is_imm8 (byte_offset));
605 ARM_LDRSB_IMM (code, ARMREG_IP, MONO_ARCH_VTABLE_REG, byte_offset);
606 imm8 = mono_arm_is_rotated_imm8 (bitmask, &rot_amount);
607 g_assert (imm8 >= 0);
608 ARM_AND_REG_IMM (code, ARMREG_IP, ARMREG_IP, imm8, rot_amount);
609 ARM_CMP_REG_IMM (code, ARMREG_IP, 0, 0);
611 ARM_B_COND (code, ARMCOND_EQ, 0);
613 /* Initialized case */
614 ARM_MOV_REG_REG (code, ARMREG_PC, ARMREG_LR);
616 /* Uninitialized case */
617 arm_patch (jump, code);
619 tramp = mono_arch_create_specific_trampoline (NULL, MONO_TRAMPOLINE_GENERIC_CLASS_INIT, mono_get_root_domain (), &code_len);
621 /* Jump to the actual trampoline */
622 ARM_LDR_IMM (code, ARMREG_R1, ARMREG_PC, 0); /* temp reg */
623 ARM_MOV_REG_REG (code, ARMREG_PC, ARMREG_R1);
624 *(gpointer*)code = tramp;
627 mono_arch_flush_icache (buf, code - buf);
629 g_assert (code - buf <= tramp_size);