1 /*
  2  * Copyright (c) 1997, 2025, Oracle and/or its affiliates. All rights reserved.
  3  * Copyright (c) 2014, Red Hat Inc. All rights reserved.
  4  * Copyright (c) 2020, 2023, Huawei Technologies Co., Ltd. All rights reserved.
  5  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  6  *
  7  * This code is free software; you can redistribute it and/or modify it
  8  * under the terms of the GNU General Public License version 2 only, as
  9  * published by the Free Software Foundation.
 10  *
 11  * This code is distributed in the hope that it will be useful, but WITHOUT
 12  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 13  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 14  * version 2 for more details (a copy is included in the LICENSE file that
 15  * accompanied this code).
 16  *
 17  * You should have received a copy of the GNU General Public License version
 18  * 2 along with this work; if not, write to the Free Software Foundation,
 19  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
 20  *
 21  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
 22  * or visit www.oracle.com if you need additional information or have any
 23  * questions.
 24  *
 25  */
 26 
 27 #include "asm/macroAssembler.hpp"
 28 #include "classfile/javaClasses.inline.hpp"
 29 #include "classfile/vmClasses.hpp"
 30 #include "compiler/disassembler.hpp"
 31 #include "interpreter/interpreter.hpp"
 32 #include "interpreter/interpreterRuntime.hpp"
 33 #include "memory/allocation.inline.hpp"
 34 #include "prims/jvmtiExport.hpp"
 35 #include "prims/methodHandles.hpp"
 36 #include "runtime/flags/flagSetting.hpp"
 37 #include "runtime/frame.inline.hpp"
 38 #include "runtime/stubRoutines.hpp"
 39 
 40 #define __ Disassembler::hook<MacroAssembler>(__FILE__, __LINE__, _masm)->
 41 
 42 #ifdef PRODUCT
 43 #define BLOCK_COMMENT(str) /* nothing */
 44 #else
 45 #define BLOCK_COMMENT(str) __ block_comment(str)
 46 #endif
 47 
 48 #define BIND(label) bind(label); BLOCK_COMMENT(#label ":")
 49 
 50 void MethodHandles::load_klass_from_Class(MacroAssembler* _masm, Register klass_reg) {
 51   if (VerifyMethodHandles) {
 52     verify_klass(_masm, klass_reg, VM_CLASS_ID(java_lang_Class),
 53                  "MH argument is a Class");
 54   }
 55   __ ld(klass_reg, Address(klass_reg, java_lang_Class::klass_offset()));
 56 }
 57 
 58 #ifdef ASSERT
 59 static int check_nonzero(const char* xname, int x) {
 60   assert(x != 0, "%s should be nonzero", xname);
 61   return x;
 62 }
 63 #define NONZERO(x) check_nonzero(#x, x)
 64 #else //ASSERT
 65 #define NONZERO(x) (x)
 66 #endif //PRODUCT
 67 
 68 #ifdef ASSERT
 69 void MethodHandles::verify_klass(MacroAssembler* _masm,
 70                                  Register obj, vmClassID klass_id,
 71                                  const char* error_message) {
 72   InstanceKlass** klass_addr = vmClasses::klass_addr_at(klass_id);
 73   Klass* klass = vmClasses::klass_at(klass_id);
 74   Register temp1 = t1;
 75   Register temp2 = t0;
 76   Label L_ok, L_bad;
 77   BLOCK_COMMENT("verify_klass {");
 78   __ verify_oop(obj);
 79   __ beqz(obj, L_bad);
 80 
 81   __ push_reg(RegSet::of(temp1, temp2), sp);
 82   __ load_klass(temp1, obj, temp2);
 83   __ ld(temp2, ExternalAddress((address)klass_addr));
 84   __ beq(temp1, temp2, L_ok);
 85 
 86   intptr_t super_check_offset = klass->super_check_offset();
 87   __ ld(temp1, Address(temp1, super_check_offset));
 88   __ ld(temp2, ExternalAddress((address)klass_addr));
 89   __ beq(temp1, temp2, L_ok);
 90 
 91   __ pop_reg(RegSet::of(temp1, temp2), sp);
 92   __ bind(L_bad);
 93   __ stop(error_message);
 94   __ BIND(L_ok);
 95   __ pop_reg(RegSet::of(temp1, temp2), sp);
 96   BLOCK_COMMENT("} verify_klass");
 97 }
 98 
 99 void MethodHandles::verify_ref_kind(MacroAssembler* _masm, int ref_kind, Register member_reg, Register temp) {}
100 
101 void MethodHandles::verify_method(MacroAssembler* _masm, Register method, vmIntrinsics::ID iid) {
102   BLOCK_COMMENT("verify_method {");
103   __ verify_method_ptr(method);
104   if (VerifyMethodHandles) {
105     Label L_ok;
106     assert_different_registers(method, t0, t1);
107     const Register method_holder = t1;
108     __ load_method_holder(method_holder, method);
109 
110     switch (iid) {
111       case vmIntrinsicID::_invokeBasic:
112         // Require compiled LambdaForm class to be fully initialized.
113         __ lbu(t0, Address(method_holder, InstanceKlass::init_state_offset()));
114         __ membar(MacroAssembler::LoadLoad | MacroAssembler::LoadStore);
115         __ mv(t1, InstanceKlass::fully_initialized);
116         __ beq(t0, t1, L_ok);
117         break;
118       case vmIntrinsicID::_linkToStatic:
119         __ clinit_barrier(method_holder, t0, &L_ok);
120         break;
121 
122       case vmIntrinsicID::_linkToVirtual:
123       case vmIntrinsicID::_linkToSpecial:
124       case vmIntrinsicID::_linkToInterface:
125         // Class initialization check is too strong here. Just ensure that class initialization has been initiated.
126         __ lbu(t0, Address(method_holder, InstanceKlass::init_state_offset()));
127         __ membar(MacroAssembler::LoadLoad | MacroAssembler::LoadStore);
128         __ mv(t1, InstanceKlass::being_initialized);
129         __ bge(t0, t1, L_ok);
130 
131         // init_state check failed, but it may be an abstract interface method
132         __ lhu(t0, Address(method, Method::access_flags_offset()));
133         __ test_bit(t1, t0, exact_log2(JVM_ACC_ABSTRACT));
134         __ bnez(t1, L_ok);
135         break;
136 
137       default:
138         fatal("unexpected intrinsic %d: %s", vmIntrinsics::as_int(iid), vmIntrinsics::name_at(iid));
139     }
140 
141     // Method holder init state check failed for a concrete method.
142     __ stop("Method holder klass is not initialized");
143     __ BIND(L_ok);
144   }
145   BLOCK_COMMENT("} verify_method");
146 }
147 #endif //ASSERT
148 
149 void MethodHandles::jump_from_method_handle(MacroAssembler* _masm, Register method, Register temp,
150                                             bool for_compiler_entry, vmIntrinsics::ID iid) {
151   assert(method == xmethod, "interpreter calling convention");
152   Label L_no_such_method;
153   __ beqz(xmethod, L_no_such_method);
154   verify_method(_masm, method, iid);
155 
156   if (!for_compiler_entry && JvmtiExport::can_post_interpreter_events()) {
157     Label run_compiled_code;
158     // JVMTI events, such as single-stepping, are implemented partly by avoiding running
159     // compiled code in threads for which the event is enabled.  Check here for
160     // interp_only_mode if these events CAN be enabled.
161 
162     __ lwu(t1, Address(xthread, JavaThread::interp_only_mode_offset()));
163     __ beqz(t1, run_compiled_code);
164     __ ld(t1, Address(method, Method::interpreter_entry_offset()));
165     __ jr(t1);
166     __ BIND(run_compiled_code);
167   }
168 
169   const ByteSize entry_offset = for_compiler_entry ? Method::from_compiled_offset() :
170                                                      Method::from_interpreted_offset();
171   __ ld(t1, Address(method, entry_offset));
172   __ jr(t1);
173   __ bind(L_no_such_method);
174   __ far_jump(RuntimeAddress(SharedRuntime::throw_AbstractMethodError_entry()));
175 }
176 
177 void MethodHandles::jump_to_lambda_form(MacroAssembler* _masm,
178                                         Register recv, Register method_temp,
179                                         Register temp2,
180                                         bool for_compiler_entry) {
181   BLOCK_COMMENT("jump_to_lambda_form {");
182   // This is the initial entry point of a lazy method handle.
183   // After type checking, it picks up the invoker from the LambdaForm.
184   assert_different_registers(recv, method_temp, temp2);
185   assert(recv != noreg, "required register");
186   assert(method_temp == xmethod, "required register for loading method");
187 
188   // Load the invoker, as MH -> MH.form -> LF.vmentry
189   __ verify_oop(recv);
190   __ load_heap_oop(method_temp, Address(recv, NONZERO(java_lang_invoke_MethodHandle::form_offset())), temp2, t1);
191   __ verify_oop(method_temp);
192   __ load_heap_oop(method_temp, Address(method_temp, NONZERO(java_lang_invoke_LambdaForm::vmentry_offset())), temp2, t1);
193   __ verify_oop(method_temp);
194   __ load_heap_oop(method_temp, Address(method_temp, NONZERO(java_lang_invoke_MemberName::method_offset())), temp2, t1);
195   __ verify_oop(method_temp);
196   __ access_load_at(T_ADDRESS, IN_HEAP, method_temp, Address(method_temp, NONZERO(java_lang_invoke_ResolvedMethodName::vmtarget_offset())), noreg, noreg);
197 
198   if (VerifyMethodHandles && !for_compiler_entry) {
199     // make sure recv is already on stack
200     __ ld(temp2, Address(method_temp, Method::const_offset()));
201     __ load_sized_value(temp2,
202                         Address(temp2, ConstMethod::size_of_parameters_offset()),
203                         sizeof(u2), /*is_signed*/ false);
204     Label L;
205     __ ld(t0, __ argument_address(temp2, -1));
206     __ beq(recv, t0, L);
207     __ ld(x10, __ argument_address(temp2, -1));
208     __ ebreak();
209     __ BIND(L);
210   }
211 
212   jump_from_method_handle(_masm, method_temp, temp2, for_compiler_entry, vmIntrinsics::_invokeBasic);
213   BLOCK_COMMENT("} jump_to_lambda_form");
214 }
215 
216 // Code generation
217 address MethodHandles::generate_method_handle_interpreter_entry(MacroAssembler* _masm,
218                                                                 vmIntrinsics::ID iid) {
219   const bool not_for_compiler_entry = false;  // this is the interpreter entry
220   assert(is_signature_polymorphic(iid), "expected invoke iid");
221   if (iid == vmIntrinsics::_invokeGeneric ||
222       iid == vmIntrinsics::_compiledLambdaForm) {
223     // Perhaps surprisingly, the symbolic references visible to Java are not directly used.
224     // They are linked to Java-generated adapters via MethodHandleNatives.linkMethod.
225     // They all allow an appendix argument.
226     __ ebreak();           // empty stubs make SG sick
227     return nullptr;
228   }
229 
230   // No need in interpreter entry for linkToNative for now.
231   // Interpreter calls compiled entry through i2c.
232   if (iid == vmIntrinsics::_linkToNative) {
233     __ ebreak();
234     return nullptr;
235   }
236 
237   // x19_sender_sp: sender SP (must preserve; see prepare_to_jump_from_interpreted)
238   // xmethod: Method*
239   // x13: argument locator (parameter slot count, added to sp)
240   // x11: used as temp to hold mh or receiver
241   // x10, x29: garbage temps, blown away
242   Register argp   = x13;   // argument list ptr, live on error paths
243   Register mh     = x11;   // MH receiver; dies quickly and is recycled
244 
245   // here's where control starts out:
246   __ align(CodeEntryAlignment);
247   address entry_point = __ pc();
248 
249   if (VerifyMethodHandles) {
250     assert(Method::intrinsic_id_size_in_bytes() == 2, "assuming Method::_intrinsic_id is u2");
251 
252     Label L;
253     BLOCK_COMMENT("verify_intrinsic_id {");
254     __ lhu(t0, Address(xmethod, Method::intrinsic_id_offset()));
255     __ mv(t1, (int) iid);
256     __ beq(t0, t1, L);
257     if (iid == vmIntrinsics::_linkToVirtual ||
258         iid == vmIntrinsics::_linkToSpecial) {
259       // could do this for all kinds, but would explode assembly code size
260       trace_method_handle(_masm, "bad Method*::intrinsic_id");
261     }
262     __ ebreak();
263     __ bind(L);
264     BLOCK_COMMENT("} verify_intrinsic_id");
265   }
266 
267   // First task:  Find out how big the argument list is.
268   Address x13_first_arg_addr;
269   int ref_kind = signature_polymorphic_intrinsic_ref_kind(iid);
270   assert(ref_kind != 0 || iid == vmIntrinsics::_invokeBasic, "must be _invokeBasic or a linkTo intrinsic");
271   if (ref_kind == 0 || MethodHandles::ref_kind_has_receiver(ref_kind)) {
272     __ ld(argp, Address(xmethod, Method::const_offset()));
273     __ load_sized_value(argp,
274                         Address(argp, ConstMethod::size_of_parameters_offset()),
275                         sizeof(u2), /*is_signed*/ false);
276     x13_first_arg_addr = __ argument_address(argp, -1);
277   } else {
278     DEBUG_ONLY(argp = noreg);
279   }
280 
281   if (!is_signature_polymorphic_static(iid)) {
282     __ ld(mh, x13_first_arg_addr);
283     DEBUG_ONLY(argp = noreg);
284   }
285 
286   // x13_first_arg_addr is live!
287 
288   trace_method_handle_interpreter_entry(_masm, iid);
289   if (iid == vmIntrinsics::_invokeBasic) {
290     generate_method_handle_dispatch(_masm, iid, mh, noreg, not_for_compiler_entry);
291   } else {
292     // Adjust argument list by popping the trailing MemberName argument.
293     Register recv = noreg;
294     if (MethodHandles::ref_kind_has_receiver(ref_kind)) {
295       // Load the receiver (not the MH; the actual MemberName's receiver) up from the interpreter stack.
296       __ ld(recv = x12, x13_first_arg_addr);
297     }
298     DEBUG_ONLY(argp = noreg);
299     Register xmember = xmethod;  // MemberName ptr; incoming method ptr is dead now
300     __ pop_reg(xmember);             // extract last argument
301     generate_method_handle_dispatch(_masm, iid, recv, xmember, not_for_compiler_entry);
302   }
303 
304   return entry_point;
305 }
306 
307 void MethodHandles::jump_to_native_invoker(MacroAssembler* _masm, Register nep_reg, Register temp_target) {
308   BLOCK_COMMENT("jump_to_native_invoker {");
309   assert_different_registers(nep_reg, temp_target);
310   assert(nep_reg != noreg, "required register");
311 
312   // Load the invoker, as NEP -> .invoker
313   __ verify_oop(nep_reg);
314   __ access_load_at(T_ADDRESS, IN_HEAP, temp_target,
315                     Address(nep_reg, NONZERO(jdk_internal_foreign_abi_NativeEntryPoint::downcall_stub_address_offset_in_bytes())),
316                     noreg, noreg);
317 
318   __ jr(temp_target);
319   BLOCK_COMMENT("} jump_to_native_invoker");
320 }
321 
322 void MethodHandles::generate_method_handle_dispatch(MacroAssembler* _masm,
323                                                     vmIntrinsics::ID iid,
324                                                     Register receiver_reg,
325                                                     Register member_reg,
326                                                     bool for_compiler_entry) {
327   assert(is_signature_polymorphic(iid), "expected invoke iid");
328   // temps used in this code are not used in *either* compiled or interpreted calling sequences
329   Register temp1 = x7;
330   Register temp2 = x28;
331   Register temp3 = x29;
332   if (for_compiler_entry) {
333     assert(receiver_reg == (iid == vmIntrinsics::_linkToStatic || iid == vmIntrinsics::_linkToNative ? noreg : j_rarg0), "only valid assignment");
334     assert_different_registers(temp1, j_rarg0, j_rarg1, j_rarg2, j_rarg3, j_rarg4, j_rarg5, j_rarg6, j_rarg7);
335     assert_different_registers(temp2, j_rarg0, j_rarg1, j_rarg2, j_rarg3, j_rarg4, j_rarg5, j_rarg6, j_rarg7);
336     assert_different_registers(temp3, j_rarg0, j_rarg1, j_rarg2, j_rarg3, j_rarg4, j_rarg5, j_rarg6, j_rarg7);
337   }
338 
339   assert_different_registers(temp1, temp2, temp3, receiver_reg);
340   assert_different_registers(temp1, temp2, temp3, member_reg);
341 
342   if (iid == vmIntrinsics::_invokeBasic) {
343     // indirect through MH.form.vmentry.vmtarget
344     jump_to_lambda_form(_masm, receiver_reg, xmethod, temp1, for_compiler_entry);
345   } else if (iid == vmIntrinsics::_linkToNative) {
346     assert(for_compiler_entry, "only compiler entry is supported");
347     jump_to_native_invoker(_masm, member_reg, temp1);
348   } else {
349     // The method is a member invoker used by direct method handles.
350     if (VerifyMethodHandles) {
351       // make sure the trailing argument really is a MemberName (caller responsibility)
352       verify_klass(_masm, member_reg, VM_CLASS_ID(java_lang_invoke_MemberName),
353                    "MemberName required for invokeVirtual etc.");
354     }
355 
356     Address member_clazz(    member_reg, NONZERO(java_lang_invoke_MemberName::clazz_offset()));
357     Address member_vmindex(  member_reg, NONZERO(java_lang_invoke_MemberName::vmindex_offset()));
358     Address member_vmtarget( member_reg, NONZERO(java_lang_invoke_MemberName::method_offset()));
359     Address vmtarget_method( xmethod, NONZERO(java_lang_invoke_ResolvedMethodName::vmtarget_offset()));
360 
361     Register temp1_recv_klass = temp1;
362     if (iid != vmIntrinsics::_linkToStatic) {
363       __ verify_oop(receiver_reg);
364       if (iid == vmIntrinsics::_linkToSpecial) {
365         // Don't actually load the klass; just null-check the receiver.
366         __ null_check(receiver_reg);
367       } else {
368         // load receiver klass itself
369         __ load_klass(temp1_recv_klass, receiver_reg);
370         __ verify_klass_ptr(temp1_recv_klass);
371       }
372       BLOCK_COMMENT("check_receiver {");
373       // The receiver for the MemberName must be in receiver_reg.
374       // Check the receiver against the MemberName.clazz
375       if (VerifyMethodHandles && iid == vmIntrinsics::_linkToSpecial) {
376         // Did not load it above...
377         __ load_klass(temp1_recv_klass, receiver_reg);
378         __ verify_klass_ptr(temp1_recv_klass);
379       }
380       if (VerifyMethodHandles && iid != vmIntrinsics::_linkToInterface) {
381         Label L_ok;
382         Register temp2_defc = temp2;
383         __ load_heap_oop(temp2_defc, member_clazz, temp3, t1);
384         load_klass_from_Class(_masm, temp2_defc);
385         __ verify_klass_ptr(temp2_defc);
386         __ check_klass_subtype(temp1_recv_klass, temp2_defc, temp3, L_ok);
387         // If we get here, the type check failed!
388         __ ebreak();
389         __ bind(L_ok);
390       }
391       BLOCK_COMMENT("} check_receiver");
392     }
393     if (iid == vmIntrinsics::_linkToSpecial ||
394         iid == vmIntrinsics::_linkToStatic) {
395       DEBUG_ONLY(temp1_recv_klass = noreg);  // these guys didn't load the recv_klass
396     }
397 
398     // Live registers at this point:
399     //  member_reg - MemberName that was the trailing argument
400     //  temp1_recv_klass - klass of stacked receiver, if needed
401     //  x19 - interpreter linkage (if interpreted)
402     //  x11 ... x10 - compiler arguments (if compiled)
403 
404     Label L_incompatible_class_change_error;
405     switch (iid) {
406       case vmIntrinsics::_linkToSpecial:
407         if (VerifyMethodHandles) {
408           verify_ref_kind(_masm, JVM_REF_invokeSpecial, member_reg, temp3);
409         }
410         __ load_heap_oop(xmethod, member_vmtarget, temp3, t1);
411         __ access_load_at(T_ADDRESS, IN_HEAP, xmethod, vmtarget_method, noreg, noreg);
412         break;
413 
414       case vmIntrinsics::_linkToStatic:
415         if (VerifyMethodHandles) {
416           verify_ref_kind(_masm, JVM_REF_invokeStatic, member_reg, temp3);
417         }
418         __ load_heap_oop(xmethod, member_vmtarget, temp3, t1);
419         __ access_load_at(T_ADDRESS, IN_HEAP, xmethod, vmtarget_method, noreg, noreg);
420         break;
421 
422       case vmIntrinsics::_linkToVirtual:
423       {
424         // same as TemplateTable::invokevirtual,
425         // minus the CP setup and profiling:
426 
427         if (VerifyMethodHandles) {
428           verify_ref_kind(_masm, JVM_REF_invokeVirtual, member_reg, temp3);
429         }
430 
431         // pick out the vtable index from the MemberName, and then we can discard it:
432         Register temp2_index = temp2;
433         __ access_load_at(T_ADDRESS, IN_HEAP, temp2_index, member_vmindex, noreg, noreg);
434 
435         if (VerifyMethodHandles) {
436           Label L_index_ok;
437           __ bgez(temp2_index, L_index_ok);
438           __ ebreak();
439           __ BIND(L_index_ok);
440         }
441 
442         // Note:  The verifier invariants allow us to ignore MemberName.clazz and vmtarget
443         // at this point.  And VerifyMethodHandles has already checked clazz, if needed.
444 
445         // get target Method* & entry point
446         __ lookup_virtual_method(temp1_recv_klass, temp2_index, xmethod);
447         break;
448       }
449 
450       case vmIntrinsics::_linkToInterface:
451       {
452         // same as TemplateTable::invokeinterface
453         // (minus the CP setup and profiling, with different argument motion)
454         if (VerifyMethodHandles) {
455           verify_ref_kind(_masm, JVM_REF_invokeInterface, member_reg, temp3);
456         }
457 
458         Register temp3_intf = temp3;
459         __ load_heap_oop(temp3_intf, member_clazz, temp2, t1);
460         load_klass_from_Class(_masm, temp3_intf);
461         __ verify_klass_ptr(temp3_intf);
462 
463         Register rindex = xmethod;
464         __ access_load_at(T_ADDRESS, IN_HEAP, rindex, member_vmindex, noreg, noreg);
465         if (VerifyMethodHandles) {
466           Label L;
467           __ bgez(rindex, L);
468           __ ebreak();
469           __ bind(L);
470         }
471 
472         // given intf, index, and recv klass, dispatch to the implementation method
473         __ lookup_interface_method(temp1_recv_klass, temp3_intf,
474                                    // note: next two args must be the same:
475                                    rindex, xmethod,
476                                    temp2,
477                                    L_incompatible_class_change_error);
478         break;
479       }
480 
481       default:
482         fatal("unexpected intrinsic %d: %s", vmIntrinsics::as_int(iid), vmIntrinsics::name_at(iid));
483         break;
484     }
485 
486     // live at this point:  xmethod, x19_sender_sp (if interpreted)
487 
488     // After figuring out which concrete method to call, jump into it.
489     // Note that this works in the interpreter with no data motion.
490     // But the compiled version will require that r2_recv be shifted out.
491     jump_from_method_handle(_masm, xmethod, temp1, for_compiler_entry, iid);
492     if (iid == vmIntrinsics::_linkToInterface) {
493       __ bind(L_incompatible_class_change_error);
494       __ far_jump(RuntimeAddress(SharedRuntime::throw_IncompatibleClassChangeError_entry()));
495     }
496   }
497 }
498 
499 #ifndef PRODUCT
500 void trace_method_handle_stub(const char* adaptername,
501                               oopDesc* mh,
502                               intptr_t* saved_regs,
503                               intptr_t* entry_sp) {  }
504 
505 // The stub wraps the arguments in a struct on the stack to avoid
506 // dealing with the different calling conventions for passing 6
507 // arguments.
508 struct MethodHandleStubArguments {
509   const char* adaptername;
510   oopDesc* mh;
511   intptr_t* saved_regs;
512   intptr_t* entry_sp;
513 };
514 void trace_method_handle_stub_wrapper(MethodHandleStubArguments* args) {  }
515 
516 void MethodHandles::trace_method_handle(MacroAssembler* _masm, const char* adaptername) {  }
517 #endif //PRODUCT