1 /*
  2  * Copyright (c) 2000, 2024, Oracle and/or its affiliates. All rights reserved.
  3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  4  *
  5  * This code is free software; you can redistribute it and/or modify it
  6  * under the terms of the GNU General Public License version 2 only, as
  7  * published by the Free Software Foundation.
  8  *
  9  * This code is distributed in the hope that it will be useful, but WITHOUT
 10  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 11  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 12  * version 2 for more details (a copy is included in the LICENSE file that
 13  * accompanied this code).
 14  *
 15  * You should have received a copy of the GNU General Public License version
 16  * 2 along with this work; if not, write to the Free Software Foundation,
 17  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
 18  *
 19  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
 20  * or visit www.oracle.com if you need additional information or have any
 21  * questions.
 22  *
 23  */
 24 
 25 #include "precompiled.hpp"
 26 #include "classfile/classFileStream.hpp"
 27 #include "classfile/classLoader.hpp"
 28 #include "classfile/classLoadInfo.hpp"
 29 #include "classfile/javaClasses.inline.hpp"
 30 #include "classfile/systemDictionary.hpp"
 31 #include "classfile/vmSymbols.hpp"
 32 #include "jfr/jfrEvents.hpp"
 33 #include "jni.h"
 34 #include "jvm.h"
 35 #include "memory/allocation.inline.hpp"
 36 #include "memory/resourceArea.hpp"
 37 #include "oops/access.inline.hpp"
 38 #include "oops/fieldStreams.inline.hpp"
 39 #include "oops/instanceKlass.inline.hpp"
 40 #include "oops/klass.inline.hpp"
 41 #include "oops/objArrayOop.inline.hpp"
 42 #include "oops/oop.inline.hpp"
 43 #include "oops/typeArrayOop.inline.hpp"
 44 #include "prims/jvmtiExport.hpp"
 45 #include "prims/unsafe.hpp"
 46 #include "runtime/globals.hpp"
 47 #include "runtime/handles.inline.hpp"
 48 #include "runtime/interfaceSupport.inline.hpp"
 49 #include "runtime/javaThread.inline.hpp"
 50 #include "runtime/jniHandles.inline.hpp"
 51 #include "runtime/orderAccess.hpp"
 52 #include "runtime/reflection.hpp"
 53 #include "runtime/sharedRuntime.hpp"
 54 #include "runtime/stubRoutines.hpp"
 55 #include "runtime/threadSMR.hpp"
 56 #include "runtime/vmOperations.hpp"
 57 #include "runtime/vm_version.hpp"
 58 #include "services/threadService.hpp"
 59 #include "utilities/align.hpp"
 60 #include "utilities/copy.hpp"
 61 #include "utilities/dtrace.hpp"
 62 #include "utilities/macros.hpp"
 63 
 64 /**
 65  * Implementation of the jdk.internal.misc.Unsafe class
 66  */
 67 
 68 
 69 #define MAX_OBJECT_SIZE \
 70   ( arrayOopDesc::base_offset_in_bytes(T_DOUBLE) \
 71     + ((julong)max_jint * sizeof(double)) )
 72 
 73 #define UNSAFE_ENTRY(result_type, header) \
 74   JVM_ENTRY(static result_type, header)
 75 
 76 #define UNSAFE_LEAF(result_type, header) \
 77   JVM_LEAF(static result_type, header)
 78 
 79 // All memory access methods (e.g. getInt, copyMemory) must use this macro.
 80 // We call these methods "scoped" methods, as access to these methods is
 81 // typically governed by a "scope" (a MemorySessionImpl object), and no
 82 // access is allowed when the scope is no longer alive.
 83 //
 84 // Closing a scope object (cf. scopedMemoryAccess.cpp) can install
 85 // an async exception during a safepoint. When that happens,
 86 // scoped methods are not allowed to touch the underlying memory (as that
 87 // memory might have been released). Therefore, when entering a scoped method
 88 // we check if an async exception has been installed, and return immediately
 89 // if that is the case.
 90 //
 91 // As a rule, we disallow safepoints in the middle of a scoped method.
 92 // If an async exception handshake were installed in such a safepoint,
 93 // memory access might still occur before the handshake is honored by
 94 // the accessing thread.
 95 //
 96 // Corollary: as threads in native state are considered to be at a safepoint,
 97 // scoped methods must NOT be executed while in the native thread state.
 98 // Because of this, there can be no UNSAFE_LEAF_SCOPED.
 99 #define UNSAFE_ENTRY_SCOPED(result_type, header) \
100   JVM_ENTRY(static result_type, header) \
101   if (thread->has_async_exception_condition()) {return (result_type)0;}
102 
103 #define UNSAFE_END JVM_END
104 
105 
106 static inline void* addr_from_java(jlong addr) {
107   // This assert fails in a variety of ways on 32-bit systems.
108   // It is impossible to predict whether native code that converts
109   // pointers to longs will sign-extend or zero-extend the addresses.
110   //assert(addr == (uintptr_t)addr, "must not be odd high bits");
111   return (void*)(uintptr_t)addr;
112 }
113 
114 static inline jlong addr_to_java(void* p) {
115   assert(p == (void*)(uintptr_t)p, "must not be odd high bits");
116   return (uintptr_t)p;
117 }
118 
119 
120 // Note: The VM's obj_field and related accessors use byte-scaled
121 // ("unscaled") offsets, just as the unsafe methods do.
122 
123 // However, the method Unsafe.fieldOffset explicitly declines to
124 // guarantee this.  The field offset values manipulated by the Java user
125 // through the Unsafe API are opaque cookies that just happen to be byte
126 // offsets.  We represent this state of affairs by passing the cookies
127 // through conversion functions when going between the VM and the Unsafe API.
128 // The conversion functions just happen to be no-ops at present.
129 
130 static inline jlong field_offset_to_byte_offset(jlong field_offset) {
131   return field_offset;
132 }
133 
134 static inline int field_offset_from_byte_offset(int byte_offset) {
135   return byte_offset;
136 }
137 
138 static inline void assert_field_offset_sane(oop p, jlong field_offset) {
139 #ifdef ASSERT
140   jlong byte_offset = field_offset_to_byte_offset(field_offset);
141 
142   if (p != nullptr) {
143     assert(byte_offset >= 0 && byte_offset <= (jlong)MAX_OBJECT_SIZE, "sane offset");
144     if (byte_offset == (jint)byte_offset) {
145       void* ptr_plus_disp = cast_from_oop<address>(p) + byte_offset;
146       assert(p->field_addr<void>((jint)byte_offset) == ptr_plus_disp,
147              "raw [ptr+disp] must be consistent with oop::field_addr");
148     }
149     jlong p_size = HeapWordSize * (jlong)(p->size());
150     assert(byte_offset < p_size, "Unsafe access: offset " INT64_FORMAT " > object's size " INT64_FORMAT, (int64_t)byte_offset, (int64_t)p_size);
151   }
152 #endif
153 }
154 
155 static inline void* index_oop_from_field_offset_long(oop p, jlong field_offset) {
156   assert_field_offset_sane(p, field_offset);
157   uintptr_t base_address = cast_from_oop<uintptr_t>(p);
158   uintptr_t byte_offset  = (uintptr_t)field_offset_to_byte_offset(field_offset);
159   return (void*)(base_address + byte_offset);
160 }
161 
162 // Externally callable versions:
163 // (Use these in compiler intrinsics which emulate unsafe primitives.)
164 jlong Unsafe_field_offset_to_byte_offset(jlong field_offset) {
165   return field_offset;
166 }
167 jlong Unsafe_field_offset_from_byte_offset(jlong byte_offset) {
168   return byte_offset;
169 }
170 
171 
172 ///// Data read/writes on the Java heap and in native (off-heap) memory
173 
174 /**
175  * Helper class to wrap memory accesses in JavaThread::doing_unsafe_access()
176  */
177 class GuardUnsafeAccess {
178   JavaThread* _thread;
179 
180 public:
181   GuardUnsafeAccess(JavaThread* thread) : _thread(thread) {
182     // native/off-heap access which may raise SIGBUS if accessing
183     // memory mapped file data in a region of the file which has
184     // been truncated and is now invalid.
185     _thread->set_doing_unsafe_access(true);
186   }
187 
188   ~GuardUnsafeAccess() {
189     _thread->set_doing_unsafe_access(false);
190   }
191 };
192 
193 /**
194  * Helper class for accessing memory.
195  *
196  * Normalizes values and wraps accesses in
197  * JavaThread::doing_unsafe_access() if needed.
198  */
199 template <typename T>
200 class MemoryAccess : StackObj {
201   JavaThread* _thread;
202   oop _obj;
203   ptrdiff_t _offset;
204 
205   // Resolves and returns the address of the memory access.
206   // This raw memory access may fault, so we make sure it happens within the
207   // guarded scope by making the access volatile at least. Since the store
208   // of Thread::set_doing_unsafe_access() is also volatile, these accesses
209   // can not be reordered by the compiler. Therefore, if the access triggers
210   // a fault, we will know that Thread::doing_unsafe_access() returns true.
211   volatile T* addr() {
212     void* addr = index_oop_from_field_offset_long(_obj, _offset);
213     return static_cast<volatile T*>(addr);
214   }
215 
216   template <typename U>
217   U normalize_for_write(U x) {
218     return x;
219   }
220 
221   jboolean normalize_for_write(jboolean x) {
222     return x & 1;
223   }
224 
225   template <typename U>
226   U normalize_for_read(U x) {
227     return x;
228   }
229 
230   jboolean normalize_for_read(jboolean x) {
231     return x != 0;
232   }
233 
234 public:
235   MemoryAccess(JavaThread* thread, jobject obj, jlong offset)
236     : _thread(thread), _obj(JNIHandles::resolve(obj)), _offset((ptrdiff_t)offset) {
237     assert_field_offset_sane(_obj, offset);
238   }
239 
240   T get() {
241     GuardUnsafeAccess guard(_thread);
242     return normalize_for_read(*addr());
243   }
244 
245   void put(T x) {
246     GuardUnsafeAccess guard(_thread);
247     *addr() = normalize_for_write(x);
248   }
249 
250 
251   T get_volatile() {
252     GuardUnsafeAccess guard(_thread);
253     volatile T ret = RawAccess<MO_SEQ_CST>::load(addr());
254     return normalize_for_read(ret);
255   }
256 
257   void put_volatile(T x) {
258     GuardUnsafeAccess guard(_thread);
259     RawAccess<MO_SEQ_CST>::store(addr(), normalize_for_write(x));
260   }
261 };
262 
263 // These functions allow a null base pointer with an arbitrary address.
264 // But if the base pointer is non-null, the offset should make some sense.
265 // That is, it should be in the range [0, MAX_OBJECT_SIZE].
266 UNSAFE_ENTRY(jobject, Unsafe_GetReference(JNIEnv *env, jobject unsafe, jobject obj, jlong offset)) {
267   oop p = JNIHandles::resolve(obj);
268   assert_field_offset_sane(p, offset);
269   oop v = HeapAccess<ON_UNKNOWN_OOP_REF>::oop_load_at(p, offset);
270   return JNIHandles::make_local(THREAD, v);
271 } UNSAFE_END
272 
273 UNSAFE_ENTRY(void, Unsafe_PutReference(JNIEnv *env, jobject unsafe, jobject obj, jlong offset, jobject x_h)) {
274   oop x = JNIHandles::resolve(x_h);
275   oop p = JNIHandles::resolve(obj);
276   assert_field_offset_sane(p, offset);
277   HeapAccess<ON_UNKNOWN_OOP_REF>::oop_store_at(p, offset, x);
278 } UNSAFE_END
279 
280 UNSAFE_ENTRY(jobject, Unsafe_GetReferenceVolatile(JNIEnv *env, jobject unsafe, jobject obj, jlong offset)) {
281   oop p = JNIHandles::resolve(obj);
282   assert_field_offset_sane(p, offset);
283   oop v = HeapAccess<MO_SEQ_CST | ON_UNKNOWN_OOP_REF>::oop_load_at(p, offset);
284   return JNIHandles::make_local(THREAD, v);
285 } UNSAFE_END
286 
287 UNSAFE_ENTRY(void, Unsafe_PutReferenceVolatile(JNIEnv *env, jobject unsafe, jobject obj, jlong offset, jobject x_h)) {
288   oop x = JNIHandles::resolve(x_h);
289   oop p = JNIHandles::resolve(obj);
290   assert_field_offset_sane(p, offset);
291   HeapAccess<MO_SEQ_CST | ON_UNKNOWN_OOP_REF>::oop_store_at(p, offset, x);
292 } UNSAFE_END
293 
294 UNSAFE_ENTRY(jobject, Unsafe_GetUncompressedObject(JNIEnv *env, jobject unsafe, jlong addr)) {
295   oop v = *(oop*) (address) addr;
296   return JNIHandles::make_local(THREAD, v);
297 } UNSAFE_END
298 
299 #define DEFINE_GETSETOOP(java_type, Type) \
300  \
301 UNSAFE_ENTRY_SCOPED(java_type, Unsafe_Get##Type(JNIEnv *env, jobject unsafe, jobject obj, jlong offset)) { \
302   return MemoryAccess<java_type>(thread, obj, offset).get(); \
303 } UNSAFE_END \
304  \
305 UNSAFE_ENTRY_SCOPED(void, Unsafe_Put##Type(JNIEnv *env, jobject unsafe, jobject obj, jlong offset, java_type x)) { \
306   MemoryAccess<java_type>(thread, obj, offset).put(x); \
307 } UNSAFE_END \
308  \
309 // END DEFINE_GETSETOOP.
310 
311 DEFINE_GETSETOOP(jboolean, Boolean)
312 DEFINE_GETSETOOP(jbyte, Byte)
313 DEFINE_GETSETOOP(jshort, Short);
314 DEFINE_GETSETOOP(jchar, Char);
315 DEFINE_GETSETOOP(jint, Int);
316 DEFINE_GETSETOOP(jlong, Long);
317 DEFINE_GETSETOOP(jfloat, Float);
318 DEFINE_GETSETOOP(jdouble, Double);
319 
320 #undef DEFINE_GETSETOOP
321 
322 #define DEFINE_GETSETOOP_VOLATILE(java_type, Type) \
323  \
324 UNSAFE_ENTRY_SCOPED(java_type, Unsafe_Get##Type##Volatile(JNIEnv *env, jobject unsafe, jobject obj, jlong offset)) { \
325   return MemoryAccess<java_type>(thread, obj, offset).get_volatile(); \
326 } UNSAFE_END \
327  \
328 UNSAFE_ENTRY_SCOPED(void, Unsafe_Put##Type##Volatile(JNIEnv *env, jobject unsafe, jobject obj, jlong offset, java_type x)) { \
329   MemoryAccess<java_type>(thread, obj, offset).put_volatile(x); \
330 } UNSAFE_END \
331  \
332 // END DEFINE_GETSETOOP_VOLATILE.
333 
334 DEFINE_GETSETOOP_VOLATILE(jboolean, Boolean)
335 DEFINE_GETSETOOP_VOLATILE(jbyte, Byte)
336 DEFINE_GETSETOOP_VOLATILE(jshort, Short);
337 DEFINE_GETSETOOP_VOLATILE(jchar, Char);
338 DEFINE_GETSETOOP_VOLATILE(jint, Int);
339 DEFINE_GETSETOOP_VOLATILE(jlong, Long);
340 DEFINE_GETSETOOP_VOLATILE(jfloat, Float);
341 DEFINE_GETSETOOP_VOLATILE(jdouble, Double);
342 
343 #undef DEFINE_GETSETOOP_VOLATILE
344 
345 UNSAFE_LEAF(void, Unsafe_FullFence(JNIEnv *env, jobject unsafe)) {
346   OrderAccess::fence();
347 } UNSAFE_END
348 
349 ////// Allocation requests
350 
351 UNSAFE_ENTRY(jobject, Unsafe_AllocateInstance(JNIEnv *env, jobject unsafe, jclass cls)) {
352   JvmtiVMObjectAllocEventCollector oam;
353   instanceOop i = InstanceKlass::allocate_instance(JNIHandles::resolve_non_null(cls), "unsafe", CHECK_NULL);
354   return JNIHandles::make_local(THREAD, i);
355 } UNSAFE_END
356 
357 UNSAFE_LEAF(jlong, Unsafe_AllocateMemory0(JNIEnv *env, jobject unsafe, jlong size)) {
358   size_t sz = (size_t)size;
359 
360   assert(is_aligned(sz, HeapWordSize), "sz not aligned");
361 
362   void* x = os::malloc(sz, mtOther);
363 
364   return addr_to_java(x);
365 } UNSAFE_END
366 
367 UNSAFE_LEAF(jlong, Unsafe_ReallocateMemory0(JNIEnv *env, jobject unsafe, jlong addr, jlong size)) {
368   void* p = addr_from_java(addr);
369   size_t sz = (size_t)size;
370 
371   assert(is_aligned(sz, HeapWordSize), "sz not aligned");
372 
373   void* x = os::realloc(p, sz, mtOther);
374 
375   return addr_to_java(x);
376 } UNSAFE_END
377 
378 UNSAFE_LEAF(void, Unsafe_FreeMemory0(JNIEnv *env, jobject unsafe, jlong addr)) {
379   void* p = addr_from_java(addr);
380 
381   os::free(p);
382 } UNSAFE_END
383 
384 UNSAFE_ENTRY_SCOPED(void, Unsafe_SetMemory0(JNIEnv *env, jobject unsafe, jobject obj, jlong offset, jlong size, jbyte value)) {
385   size_t sz = (size_t)size;
386 
387   oop base = JNIHandles::resolve(obj);
388   void* p = index_oop_from_field_offset_long(base, offset);
389 
390   {
391     GuardUnsafeAccess guard(thread);
392     if (StubRoutines::unsafe_setmemory() != nullptr) {
393       MACOS_AARCH64_ONLY(ThreadWXEnable wx(WXExec, thread));
394       StubRoutines::UnsafeSetMemory_stub()(p, sz, value);
395     } else {
396       Copy::fill_to_memory_atomic(p, sz, value);
397     }
398   }
399 } UNSAFE_END
400 
401 UNSAFE_ENTRY_SCOPED(void, Unsafe_CopyMemory0(JNIEnv *env, jobject unsafe, jobject srcObj, jlong srcOffset, jobject dstObj, jlong dstOffset, jlong size)) {
402   size_t sz = (size_t)size;
403 
404   oop srcp = JNIHandles::resolve(srcObj);
405   oop dstp = JNIHandles::resolve(dstObj);
406 
407   void* src = index_oop_from_field_offset_long(srcp, srcOffset);
408   void* dst = index_oop_from_field_offset_long(dstp, dstOffset);
409   {
410     GuardUnsafeAccess guard(thread);
411     if (StubRoutines::unsafe_arraycopy() != nullptr) {
412       MACOS_AARCH64_ONLY(ThreadWXEnable wx(WXExec, thread));
413       StubRoutines::UnsafeArrayCopy_stub()(src, dst, sz);
414     } else {
415       Copy::conjoint_memory_atomic(src, dst, sz);
416     }
417   }
418 } UNSAFE_END
419 
420 UNSAFE_ENTRY_SCOPED(void, Unsafe_CopySwapMemory0(JNIEnv *env, jobject unsafe, jobject srcObj, jlong srcOffset, jobject dstObj, jlong dstOffset, jlong size, jlong elemSize)) {
421   size_t sz = (size_t)size;
422   size_t esz = (size_t)elemSize;
423 
424   oop srcp = JNIHandles::resolve(srcObj);
425   oop dstp = JNIHandles::resolve(dstObj);
426 
427   address src = (address)index_oop_from_field_offset_long(srcp, srcOffset);
428   address dst = (address)index_oop_from_field_offset_long(dstp, dstOffset);
429 
430   {
431     GuardUnsafeAccess guard(thread);
432     Copy::conjoint_swap(src, dst, sz, esz);
433   }
434 } UNSAFE_END
435 
436 UNSAFE_LEAF (void, Unsafe_WriteBack0(JNIEnv *env, jobject unsafe, jlong line)) {
437   assert(VM_Version::supports_data_cache_line_flush(), "should not get here");
438 #ifdef ASSERT
439   if (TraceMemoryWriteback) {
440     tty->print_cr("Unsafe: writeback 0x%p", addr_from_java(line));
441   }
442 #endif
443 
444   MACOS_AARCH64_ONLY(ThreadWXEnable wx(WXExec, Thread::current()));
445   assert(StubRoutines::data_cache_writeback() != nullptr, "sanity");
446   (StubRoutines::DataCacheWriteback_stub())(addr_from_java(line));
447 } UNSAFE_END
448 
449 static void doWriteBackSync0(bool is_pre)
450 {
451   MACOS_AARCH64_ONLY(ThreadWXEnable wx(WXExec, Thread::current()));
452   assert(StubRoutines::data_cache_writeback_sync() != nullptr, "sanity");
453   (StubRoutines::DataCacheWritebackSync_stub())(is_pre);
454 }
455 
456 UNSAFE_LEAF (void, Unsafe_WriteBackPreSync0(JNIEnv *env, jobject unsafe)) {
457   assert(VM_Version::supports_data_cache_line_flush(), "should not get here");
458 #ifdef ASSERT
459   if (TraceMemoryWriteback) {
460       tty->print_cr("Unsafe: writeback pre-sync");
461   }
462 #endif
463 
464   doWriteBackSync0(true);
465 } UNSAFE_END
466 
467 UNSAFE_LEAF (void, Unsafe_WriteBackPostSync0(JNIEnv *env, jobject unsafe)) {
468   assert(VM_Version::supports_data_cache_line_flush(), "should not get here");
469 #ifdef ASSERT
470   if (TraceMemoryWriteback) {
471     tty->print_cr("Unsafe: writeback pre-sync");
472   }
473 #endif
474 
475   doWriteBackSync0(false);
476 } UNSAFE_END
477 
478 ////// Random queries
479 
480 static jlong find_field_offset(jclass clazz, jstring name, TRAPS) {
481   assert(clazz != nullptr, "clazz must not be null");
482   assert(name != nullptr, "name must not be null");
483 
484   ResourceMark rm(THREAD);
485   char *utf_name = java_lang_String::as_utf8_string(JNIHandles::resolve_non_null(name));
486 
487   InstanceKlass* k = InstanceKlass::cast(java_lang_Class::as_Klass(JNIHandles::resolve_non_null(clazz)));
488 
489   jint offset = -1;
490   for (JavaFieldStream fs(k); !fs.done(); fs.next()) {
491     Symbol *name = fs.name();
492     if (name->equals(utf_name)) {
493       offset = fs.offset();
494       break;
495     }
496   }
497   if (offset < 0) {
498     THROW_0(vmSymbols::java_lang_InternalError());
499   }
500   return field_offset_from_byte_offset(offset);
501 }
502 
503 static jlong find_field_offset(jobject field, int must_be_static, TRAPS) {
504   assert(field != nullptr, "field must not be null");
505 
506   oop reflected   = JNIHandles::resolve_non_null(field);
507   oop mirror      = java_lang_reflect_Field::clazz(reflected);
508   Klass* k        = java_lang_Class::as_Klass(mirror);
509   int slot        = java_lang_reflect_Field::slot(reflected);
510   int modifiers   = java_lang_reflect_Field::modifiers(reflected);
511 
512   if (must_be_static >= 0) {
513     int really_is_static = ((modifiers & JVM_ACC_STATIC) != 0);
514     if (must_be_static != really_is_static) {
515       THROW_0(vmSymbols::java_lang_IllegalArgumentException());
516     }
517   }
518 
519   int offset = InstanceKlass::cast(k)->field_offset(slot);
520   return field_offset_from_byte_offset(offset);
521 }
522 
523 UNSAFE_ENTRY(jlong, Unsafe_ObjectFieldOffset0(JNIEnv *env, jobject unsafe, jobject field)) {
524   return find_field_offset(field, 0, THREAD);
525 } UNSAFE_END
526 
527 UNSAFE_ENTRY(jlong, Unsafe_ObjectFieldOffset1(JNIEnv *env, jobject unsafe, jclass c, jstring name)) {
528   return find_field_offset(c, name, THREAD);
529 } UNSAFE_END
530 
531 UNSAFE_ENTRY(jlong, Unsafe_StaticFieldOffset0(JNIEnv *env, jobject unsafe, jobject field)) {
532   return find_field_offset(field, 1, THREAD);
533 } UNSAFE_END
534 
535 UNSAFE_ENTRY(jobject, Unsafe_StaticFieldBase0(JNIEnv *env, jobject unsafe, jobject field)) {
536   assert(field != nullptr, "field must not be null");
537 
538   // Note:  In this VM implementation, a field address is always a short
539   // offset from the base of a klass metaobject.  Thus, the full dynamic
540   // range of the return type is never used.  However, some implementations
541   // might put the static field inside an array shared by many classes,
542   // or even at a fixed address, in which case the address could be quite
543   // large.  In that last case, this function would return null, since
544   // the address would operate alone, without any base pointer.
545 
546   oop reflected   = JNIHandles::resolve_non_null(field);
547   oop mirror      = java_lang_reflect_Field::clazz(reflected);
548   int modifiers   = java_lang_reflect_Field::modifiers(reflected);
549 
550   if ((modifiers & JVM_ACC_STATIC) == 0) {
551     THROW_0(vmSymbols::java_lang_IllegalArgumentException());
552   }
553 
554   return JNIHandles::make_local(THREAD, mirror);
555 } UNSAFE_END
556 
557 UNSAFE_ENTRY(void, Unsafe_EnsureClassInitialized0(JNIEnv *env, jobject unsafe, jobject clazz)) {
558   assert(clazz != nullptr, "clazz must not be null");
559 
560   oop mirror = JNIHandles::resolve_non_null(clazz);
561 
562   Klass* klass = java_lang_Class::as_Klass(mirror);
563   if (klass != nullptr && klass->should_be_initialized()) {
564     InstanceKlass* k = InstanceKlass::cast(klass);
565     k->initialize(CHECK);
566   }
567 }
568 UNSAFE_END
569 
570 UNSAFE_ENTRY(jboolean, Unsafe_ShouldBeInitialized0(JNIEnv *env, jobject unsafe, jobject clazz)) {
571   assert(clazz != nullptr, "clazz must not be null");
572 
573   oop mirror = JNIHandles::resolve_non_null(clazz);
574   Klass* klass = java_lang_Class::as_Klass(mirror);
575 
576   if (klass != nullptr && klass->should_be_initialized()) {
577     return true;
578   }
579 
580   return false;
581 }
582 UNSAFE_END
583 
584 static void getBaseAndScale(int& base, int& scale, jclass clazz, TRAPS) {
585   assert(clazz != nullptr, "clazz must not be null");
586 
587   oop mirror = JNIHandles::resolve_non_null(clazz);
588   Klass* k = java_lang_Class::as_Klass(mirror);
589 
590   if (k == nullptr || !k->is_array_klass()) {
591     THROW(vmSymbols::java_lang_InvalidClassException());
592   } else if (k->is_objArray_klass()) {
593     base  = arrayOopDesc::base_offset_in_bytes(T_OBJECT);
594     scale = heapOopSize;
595   } else if (k->is_typeArray_klass()) {
596     TypeArrayKlass* tak = TypeArrayKlass::cast(k);
597     base  = tak->array_header_in_bytes();
598     assert(base == arrayOopDesc::base_offset_in_bytes(tak->element_type()), "array_header_size semantics ok");
599     scale = (1 << tak->log2_element_size());
600   } else {
601     ShouldNotReachHere();
602   }
603 }
604 
605 UNSAFE_ENTRY(jint, Unsafe_ArrayBaseOffset0(JNIEnv *env, jobject unsafe, jclass clazz)) {
606   int base = 0, scale = 0;
607   getBaseAndScale(base, scale, clazz, CHECK_0);
608 
609   return field_offset_from_byte_offset(base);
610 } UNSAFE_END
611 
612 
613 UNSAFE_ENTRY(jint, Unsafe_ArrayIndexScale0(JNIEnv *env, jobject unsafe, jclass clazz)) {
614   int base = 0, scale = 0;
615   getBaseAndScale(base, scale, clazz, CHECK_0);
616 
617   // This VM packs both fields and array elements down to the byte.
618   // But watch out:  If this changes, so that array references for
619   // a given primitive type (say, T_BOOLEAN) use different memory units
620   // than fields, this method MUST return zero for such arrays.
621   // For example, the VM used to store sub-word sized fields in full
622   // words in the object layout, so that accessors like getByte(Object,int)
623   // did not really do what one might expect for arrays.  Therefore,
624   // this function used to report a zero scale factor, so that the user
625   // would know not to attempt to access sub-word array elements.
626   // // Code for unpacked fields:
627   // if (scale < wordSize)  return 0;
628 
629   // The following allows for a pretty general fieldOffset cookie scheme,
630   // but requires it to be linear in byte offset.
631   return field_offset_from_byte_offset(scale) - field_offset_from_byte_offset(0);
632 } UNSAFE_END
633 
634 
635 static inline void throw_new(JNIEnv *env, const char *ename) {
636   jclass cls = env->FindClass(ename);
637   if (env->ExceptionCheck()) {
638     env->ExceptionClear();
639     tty->print_cr("Unsafe: cannot throw %s because FindClass has failed", ename);
640     return;
641   }
642 
643   env->ThrowNew(cls, nullptr);
644 }
645 
646 static jclass Unsafe_DefineClass_impl(JNIEnv *env, jstring name, jbyteArray data, int offset, int length, jobject loader, jobject pd) {
647   // Code lifted from JDK 1.3 ClassLoader.c
648 
649   jbyte *body;
650   char *utfName = nullptr;
651   jclass result = 0;
652   char buf[128];
653 
654   assert(data != nullptr, "Class bytes must not be null");
655   assert(length >= 0, "length must not be negative: %d", length);
656 
657   if (UsePerfData) {
658     ClassLoader::unsafe_defineClassCallCounter()->inc();
659   }
660 
661   body = NEW_C_HEAP_ARRAY_RETURN_NULL(jbyte, length, mtInternal);
662   if (body == nullptr) {
663     throw_new(env, "java/lang/OutOfMemoryError");
664     return 0;
665   }
666 
667   env->GetByteArrayRegion(data, offset, length, body);
668   if (env->ExceptionOccurred()) {
669     goto free_body;
670   }
671 
672   if (name != nullptr) {
673     uint len = env->GetStringUTFLength(name);
674     int unicode_len = env->GetStringLength(name);
675 
676     if (len >= sizeof(buf)) {
677       utfName = NEW_C_HEAP_ARRAY_RETURN_NULL(char, len + 1, mtInternal);
678       if (utfName == nullptr) {
679         throw_new(env, "java/lang/OutOfMemoryError");
680         goto free_body;
681       }
682     } else {
683       utfName = buf;
684     }
685 
686     env->GetStringUTFRegion(name, 0, unicode_len, utfName);
687 
688     for (uint i = 0; i < len; i++) {
689       if (utfName[i] == '.')   utfName[i] = '/';
690     }
691   }
692 
693   result = JVM_DefineClass(env, utfName, loader, body, length, pd);
694 
695   if (utfName && utfName != buf) {
696     FREE_C_HEAP_ARRAY(char, utfName);
697   }
698 
699  free_body:
700   FREE_C_HEAP_ARRAY(jbyte, body);
701   return result;
702 }
703 
704 
705 UNSAFE_ENTRY(jclass, Unsafe_DefineClass0(JNIEnv *env, jobject unsafe, jstring name, jbyteArray data, int offset, int length, jobject loader, jobject pd)) {
706   ThreadToNativeFromVM ttnfv(thread);
707 
708   return Unsafe_DefineClass_impl(env, name, data, offset, length, loader, pd);
709 } UNSAFE_END
710 
711 
712 UNSAFE_ENTRY(void, Unsafe_ThrowException(JNIEnv *env, jobject unsafe, jthrowable thr)) {
713   ThreadToNativeFromVM ttnfv(thread);
714   env->Throw(thr);
715 } UNSAFE_END
716 
717 // JSR166 ------------------------------------------------------------------
718 
719 UNSAFE_ENTRY(jobject, Unsafe_CompareAndExchangeReference(JNIEnv *env, jobject unsafe, jobject obj, jlong offset, jobject e_h, jobject x_h)) {
720   oop x = JNIHandles::resolve(x_h);
721   oop e = JNIHandles::resolve(e_h);
722   oop p = JNIHandles::resolve(obj);
723   assert_field_offset_sane(p, offset);
724   oop res = HeapAccess<ON_UNKNOWN_OOP_REF>::oop_atomic_cmpxchg_at(p, (ptrdiff_t)offset, e, x);
725   return JNIHandles::make_local(THREAD, res);
726 } UNSAFE_END
727 
728 UNSAFE_ENTRY_SCOPED(jint, Unsafe_CompareAndExchangeInt(JNIEnv *env, jobject unsafe, jobject obj, jlong offset, jint e, jint x)) {
729   oop p = JNIHandles::resolve(obj);
730   volatile jint* addr = (volatile jint*)index_oop_from_field_offset_long(p, offset);
731   return Atomic::cmpxchg(addr, e, x);
732 } UNSAFE_END
733 
734 UNSAFE_ENTRY_SCOPED(jlong, Unsafe_CompareAndExchangeLong(JNIEnv *env, jobject unsafe, jobject obj, jlong offset, jlong e, jlong x)) {
735   oop p = JNIHandles::resolve(obj);
736   volatile jlong* addr = (volatile jlong*)index_oop_from_field_offset_long(p, offset);
737   return Atomic::cmpxchg(addr, e, x);
738 } UNSAFE_END
739 
740 UNSAFE_ENTRY(jboolean, Unsafe_CompareAndSetReference(JNIEnv *env, jobject unsafe, jobject obj, jlong offset, jobject e_h, jobject x_h)) {
741   oop x = JNIHandles::resolve(x_h);
742   oop e = JNIHandles::resolve(e_h);
743   oop p = JNIHandles::resolve(obj);
744   assert_field_offset_sane(p, offset);
745   oop ret = HeapAccess<ON_UNKNOWN_OOP_REF>::oop_atomic_cmpxchg_at(p, (ptrdiff_t)offset, e, x);
746   return ret == e;
747 } UNSAFE_END
748 
749 UNSAFE_ENTRY_SCOPED(jboolean, Unsafe_CompareAndSetInt(JNIEnv *env, jobject unsafe, jobject obj, jlong offset, jint e, jint x)) {
750   oop p = JNIHandles::resolve(obj);
751   volatile jint* addr = (volatile jint*)index_oop_from_field_offset_long(p, offset);
752   return Atomic::cmpxchg(addr, e, x) == e;
753 } UNSAFE_END
754 
755 UNSAFE_ENTRY_SCOPED(jboolean, Unsafe_CompareAndSetLong(JNIEnv *env, jobject unsafe, jobject obj, jlong offset, jlong e, jlong x)) {
756   oop p = JNIHandles::resolve(obj);
757   volatile jlong* addr = (volatile jlong*)index_oop_from_field_offset_long(p, offset);
758   return Atomic::cmpxchg(addr, e, x) == e;
759 } UNSAFE_END
760 
761 static void post_thread_park_event(EventThreadPark* event, const oop obj, jlong timeout_nanos, jlong until_epoch_millis) {
762   assert(event != nullptr, "invariant");
763   event->set_parkedClass((obj != nullptr) ? obj->klass() : nullptr);
764   event->set_timeout(timeout_nanos);
765   event->set_until(until_epoch_millis);
766   event->set_address((obj != nullptr) ? (u8)cast_from_oop<uintptr_t>(obj) : 0);
767   event->commit();
768 }
769 
770 UNSAFE_ENTRY(void, Unsafe_Park(JNIEnv *env, jobject unsafe, jboolean isAbsolute, jlong time)) {
771   HOTSPOT_THREAD_PARK_BEGIN((uintptr_t) thread->parker(), (int) isAbsolute, time);
772   EventThreadPark event;
773 
774   JavaThreadParkedState jtps(thread, time != 0);
775   thread->parker()->park(isAbsolute != 0, time);
776   if (event.should_commit()) {
777     const oop obj = thread->current_park_blocker();
778     if (time == 0) {
779       post_thread_park_event(&event, obj, min_jlong, min_jlong);
780     } else {
781       if (isAbsolute != 0) {
782         post_thread_park_event(&event, obj, min_jlong, time);
783       } else {
784         post_thread_park_event(&event, obj, time, min_jlong);
785       }
786     }
787   }
788   HOTSPOT_THREAD_PARK_END((uintptr_t) thread->parker());
789 } UNSAFE_END
790 
791 UNSAFE_ENTRY(void, Unsafe_Unpark(JNIEnv *env, jobject unsafe, jobject jthread)) {
792   if (jthread != nullptr) {
793     oop thread_oop = JNIHandles::resolve_non_null(jthread);
794     // Get the JavaThread* stored in the java.lang.Thread object _before_
795     // the embedded ThreadsListHandle is constructed so we know if the
796     // early life stage of the JavaThread* is protected. We use acquire
797     // here to ensure that if we see a non-nullptr value, then we also
798     // see the main ThreadsList updates from the JavaThread* being added.
799     FastThreadsListHandle ftlh(thread_oop, java_lang_Thread::thread_acquire(thread_oop));
800     JavaThread* thr = ftlh.protected_java_thread();
801     if (thr != nullptr) {
802       // The still live JavaThread* is protected by the FastThreadsListHandle
803       // so it is safe to access.
804       Parker* p = thr->parker();
805       HOTSPOT_THREAD_UNPARK((uintptr_t) p);
806       p->unpark();
807     }
808   } // FastThreadsListHandle is destroyed here.
809 } UNSAFE_END
810 
811 UNSAFE_ENTRY(jint, Unsafe_GetLoadAverage0(JNIEnv *env, jobject unsafe, jdoubleArray loadavg, jint nelem)) {
812   const int max_nelem = 3;
813   double la[max_nelem];
814   jint ret;
815 
816   typeArrayOop a = typeArrayOop(JNIHandles::resolve_non_null(loadavg));
817   assert(a->is_typeArray(), "must be type array");
818 
819   ret = os::loadavg(la, nelem);
820   if (ret == -1) {
821     return -1;
822   }
823 
824   // if successful, ret is the number of samples actually retrieved.
825   assert(ret >= 0 && ret <= max_nelem, "Unexpected loadavg return value");
826   switch(ret) {
827     case 3: a->double_at_put(2, (jdouble)la[2]); // fall through
828     case 2: a->double_at_put(1, (jdouble)la[1]); // fall through
829     case 1: a->double_at_put(0, (jdouble)la[0]); break;
830   }
831 
832   return ret;
833 } UNSAFE_END
834 
835 
836 /// JVM_RegisterUnsafeMethods
837 
838 #define ADR "J"
839 
840 #define LANG "Ljava/lang/"
841 
842 #define OBJ LANG "Object;"
843 #define CLS LANG "Class;"
844 #define FLD LANG "reflect/Field;"
845 #define THR LANG "Throwable;"
846 
847 #define DC_Args  LANG "String;[BII" LANG "ClassLoader;" "Ljava/security/ProtectionDomain;"
848 #define DAC_Args CLS "[B[" OBJ
849 
850 #define CC (char*)  /*cast a literal from (const char*)*/
851 #define FN_PTR(f) CAST_FROM_FN_PTR(void*, &f)
852 
853 #define DECLARE_GETPUTOOP(Type, Desc) \
854     {CC "get" #Type,      CC "(" OBJ "J)" #Desc,       FN_PTR(Unsafe_Get##Type)}, \
855     {CC "put" #Type,      CC "(" OBJ "J" #Desc ")V",   FN_PTR(Unsafe_Put##Type)}, \
856     {CC "get" #Type "Volatile",      CC "(" OBJ "J)" #Desc,       FN_PTR(Unsafe_Get##Type##Volatile)}, \
857     {CC "put" #Type "Volatile",      CC "(" OBJ "J" #Desc ")V",   FN_PTR(Unsafe_Put##Type##Volatile)}
858 
859 
860 static JNINativeMethod jdk_internal_misc_Unsafe_methods[] = {
861     {CC "getReference",         CC "(" OBJ "J)" OBJ "",   FN_PTR(Unsafe_GetReference)},
862     {CC "putReference",         CC "(" OBJ "J" OBJ ")V",  FN_PTR(Unsafe_PutReference)},
863     {CC "getReferenceVolatile", CC "(" OBJ "J)" OBJ,      FN_PTR(Unsafe_GetReferenceVolatile)},
864     {CC "putReferenceVolatile", CC "(" OBJ "J" OBJ ")V",  FN_PTR(Unsafe_PutReferenceVolatile)},
865 
866     {CC "getUncompressedObject", CC "(" ADR ")" OBJ,  FN_PTR(Unsafe_GetUncompressedObject)},
867 
868     DECLARE_GETPUTOOP(Boolean, Z),
869     DECLARE_GETPUTOOP(Byte, B),
870     DECLARE_GETPUTOOP(Short, S),
871     DECLARE_GETPUTOOP(Char, C),
872     DECLARE_GETPUTOOP(Int, I),
873     DECLARE_GETPUTOOP(Long, J),
874     DECLARE_GETPUTOOP(Float, F),
875     DECLARE_GETPUTOOP(Double, D),
876 
877     {CC "allocateMemory0",    CC "(J)" ADR,              FN_PTR(Unsafe_AllocateMemory0)},
878     {CC "reallocateMemory0",  CC "(" ADR "J)" ADR,       FN_PTR(Unsafe_ReallocateMemory0)},
879     {CC "freeMemory0",        CC "(" ADR ")V",           FN_PTR(Unsafe_FreeMemory0)},
880 
881     {CC "objectFieldOffset0", CC "(" FLD ")J",           FN_PTR(Unsafe_ObjectFieldOffset0)},
882     {CC "objectFieldOffset1", CC "(" CLS LANG "String;)J", FN_PTR(Unsafe_ObjectFieldOffset1)},
883     {CC "staticFieldOffset0", CC "(" FLD ")J",           FN_PTR(Unsafe_StaticFieldOffset0)},
884     {CC "staticFieldBase0",   CC "(" FLD ")" OBJ,        FN_PTR(Unsafe_StaticFieldBase0)},
885     {CC "ensureClassInitialized0", CC "(" CLS ")V",      FN_PTR(Unsafe_EnsureClassInitialized0)},
886     {CC "arrayBaseOffset0",   CC "(" CLS ")I",           FN_PTR(Unsafe_ArrayBaseOffset0)},
887     {CC "arrayIndexScale0",   CC "(" CLS ")I",           FN_PTR(Unsafe_ArrayIndexScale0)},
888 
889     {CC "defineClass0",       CC "(" DC_Args ")" CLS,    FN_PTR(Unsafe_DefineClass0)},
890     {CC "allocateInstance",   CC "(" CLS ")" OBJ,        FN_PTR(Unsafe_AllocateInstance)},
891     {CC "throwException",     CC "(" THR ")V",           FN_PTR(Unsafe_ThrowException)},
892     {CC "compareAndSetReference",CC "(" OBJ "J" OBJ "" OBJ ")Z", FN_PTR(Unsafe_CompareAndSetReference)},
893     {CC "compareAndSetInt",   CC "(" OBJ "J""I""I"")Z",  FN_PTR(Unsafe_CompareAndSetInt)},
894     {CC "compareAndSetLong",  CC "(" OBJ "J""J""J"")Z",  FN_PTR(Unsafe_CompareAndSetLong)},
895     {CC "compareAndExchangeReference", CC "(" OBJ "J" OBJ "" OBJ ")" OBJ, FN_PTR(Unsafe_CompareAndExchangeReference)},
896     {CC "compareAndExchangeInt",  CC "(" OBJ "J""I""I"")I", FN_PTR(Unsafe_CompareAndExchangeInt)},
897     {CC "compareAndExchangeLong", CC "(" OBJ "J""J""J"")J", FN_PTR(Unsafe_CompareAndExchangeLong)},
898 
899     {CC "park",               CC "(ZJ)V",                FN_PTR(Unsafe_Park)},
900     {CC "unpark",             CC "(" OBJ ")V",           FN_PTR(Unsafe_Unpark)},
901 
902     {CC "getLoadAverage0",    CC "([DI)I",               FN_PTR(Unsafe_GetLoadAverage0)},
903 
904     {CC "copyMemory0",        CC "(" OBJ "J" OBJ "JJ)V", FN_PTR(Unsafe_CopyMemory0)},
905     {CC "copySwapMemory0",    CC "(" OBJ "J" OBJ "JJJ)V", FN_PTR(Unsafe_CopySwapMemory0)},
906     {CC "writeback0",         CC "(" "J" ")V",           FN_PTR(Unsafe_WriteBack0)},
907     {CC "writebackPreSync0",  CC "()V",                  FN_PTR(Unsafe_WriteBackPreSync0)},
908     {CC "writebackPostSync0", CC "()V",                  FN_PTR(Unsafe_WriteBackPostSync0)},
909     {CC "setMemory0",         CC "(" OBJ "JJB)V",        FN_PTR(Unsafe_SetMemory0)},
910 
911     {CC "shouldBeInitialized0", CC "(" CLS ")Z",         FN_PTR(Unsafe_ShouldBeInitialized0)},
912 
913     {CC "fullFence",          CC "()V",                  FN_PTR(Unsafe_FullFence)},
914 };
915 
916 #undef CC
917 #undef FN_PTR
918 
919 #undef ADR
920 #undef LANG
921 #undef OBJ
922 #undef CLS
923 #undef FLD
924 #undef THR
925 #undef DC_Args
926 #undef DAC_Args
927 
928 #undef DECLARE_GETPUTOOP
929 
930 
931 // This function is exported, used by NativeLookup.
932 // The Unsafe_xxx functions above are called only from the interpreter.
933 // The optimizer looks at names and signatures to recognize
934 // individual functions.
935 
936 JVM_ENTRY(void, JVM_RegisterJDKInternalMiscUnsafeMethods(JNIEnv *env, jclass unsafeclass)) {
937   ThreadToNativeFromVM ttnfv(thread);
938 
939   int ok = env->RegisterNatives(unsafeclass, jdk_internal_misc_Unsafe_methods, sizeof(jdk_internal_misc_Unsafe_methods)/sizeof(JNINativeMethod));
940   guarantee(ok == 0, "register jdk.internal.misc.Unsafe natives");
941 } JVM_END