[OpenSPARC-T2-SAM] / obp / obp / arch / sun4u / fieldberr.fth

\ ========== Copyright Header Begin ==========================================
\ 
\ Hypervisor Software File: fieldberr.fth
\ 
\ Copyright (c) 2006 Sun Microsystems, Inc. All Rights Reserved.
\ 
\  - Do no alter or remove copyright notices
\ 
\  - Redistribution and use of this software in source and binary forms, with 
\    or without modification, are permitted provided that the following 
\    conditions are met: 
\ 
\  - Redistribution of source code must retain the above copyright notice, 
\    this list of conditions and the following disclaimer.
\ 
\  - Redistribution in binary form must reproduce the above copyright notice,
\    this list of conditions and the following disclaimer in the
\    documentation and/or other materials provided with the distribution. 
\ 
\    Neither the name of Sun Microsystems, Inc. or the names of contributors 
\ may be used to endorse or promote products derived from this software 
\ without specific prior written permission. 
\ 
\     This software is provided "AS IS," without a warranty of any kind. 
\ ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, 
\ INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A 
\ PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE HEREBY EXCLUDED. SUN 
\ MICROSYSTEMS, INC. ("SUN") AND ITS LICENSORS SHALL NOT BE LIABLE FOR 
\ ANY DAMAGES SUFFERED BY LICENSEE AS A RESULT OF USING, MODIFYING OR 
\ DISTRIBUTING THIS SOFTWARE OR ITS DERIVATIVES. IN NO EVENT WILL SUN 
\ OR ITS LICENSORS BE LIABLE FOR ANY LOST REVENUE, PROFIT OR DATA, OR 
\ FOR DIRECT, INDIRECT, SPECIAL, CONSEQUENTIAL, INCIDENTAL OR PUNITIVE 
\ DAMAGES, HOWEVER CAUSED AND REGARDLESS OF THE THEORY OF LIABILITY, 
\ ARISING OUT OF THE USE OF OR INABILITY TO USE THIS SOFTWARE, EVEN IF 
\ SUN HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
\ 
\ You acknowledge that this software is not designed, licensed or
\ intended for use in the design, construction, operation or maintenance of
\ any nuclear facility. 
\ 
\ ========== Copyright Header End ============================================
id: @(#)fieldberr.fth 1.14 03/08/20
purpose: 
copyright: Copyright 1999-2003 Sun Microsystems, Inc.  All Rights Reserved
copyright: Use is subject to license terms.

\ This code is actually two pieces, the guarded execute landing pad is one of
\ them, the os/stand/probe.fth is the other. probe.fth puts sync membars around
\ the load and store operators to ensure that the error happens exactly where
\ we expect it.
\ 
\ This means it is possible to break the guarded-execute protection by simply
\ 
\	['] x! guarded-execute
\ 
\ However there is little we can do about that. Instead do not re-invent
\ the wheel - use the peek and poke routines which will do the correct thing
\ and will not sacrifice performance.
\ 
\ Landing-pad can be considered the FORTH equivalent of setjmp/longjmp.
\ 
\ The first time that landing-pad executes is does the setjmp and returns 0,
\ code that takes an exception will restart at landing pad with a non-zero
\ value on the stack (longjmp) and this time the throw will prevent the acf
\ from being re-executed.
\ 

headerless

h# 30 constant trap30 \ Data Access Exception
h# 1f constant trap1f \ Level 15 interrupt
h# 32 constant trap32 \ Data Access Error
h# 34 constant trap34 \ Memory Address not Aligned

label simple-handler 

   prom-main-task  %g4  up	setx		\ Set User Area Pointer
   base				rdpc		\ this is a trap so we're
   here 4 - origin - %g4	set		\ using alternate globals
   base  %g4         base	sub

   %g6				rdpstate	\ save the tstate & pstate
   %g7				rdtstate	\ then set trap-level to 0
   %g0	0			wrtl		\ so that we can field an mmu
						\ miss on the cpu-struct
   up	%g4		%g5	get-cpu-struct	
   0	>guarded-pc	%g4	set		\ retrieve the "landing-pad" pc
   %g5	%g4		%g5	add		\ value previously stored
   %g0	%g5		%g4	nget		\ in the >guarded-pc member

   %g0	%g4		%g0	subcc		\ is the guarded-pc nonzero?
   0<>	if
				nop		\ delay
      %g0	1		wrtl		\ set trap-level = 1
      %g6	0		wrpstate	\ restore pstate
      #sync			membar
      %g7	0		wrtstate	\ restore tstate
      #sync			membar
      %g0	%g4		wrtpc
      %g0	%g4		wrtnpc		\ set trap pcs to "landing pad"
      %g0	%g0	%g5	nput		\ clear saved pc
				retry		\ retry (to landing pad) will
   else						\ set trap level to 0
				nop
      %g0	h# 16		wrpstate	\ another (unrecoverable) trap
      save-state always		brif		\ set pstate to known state
				nop		\ and jump into save-state
   then
end-code

code landing-pad  ( -- executed? )
   h# 20			.align
   up	sc2		sc1	get-cpu-struct	\ sc1 = cpu-struct adr
   0	>guarded-pc	sc2	set		\ "landing-pad" pc container
   0	>guarded-ip	sc3	set		\ "landing-pad" ip container
   sc1	sc2		sc2	add		\ sc2 = guarded-pc adr
   sc1	sc3		sc3	add		\ sc3 = guarded-ip adr
   %g0	sc2		sc1	nget		\ sc1 = guarded-pc value
   ip	%g0		sc3	nput		\ store current ip
   sc4				rdpc		
   sc4	h# 10		sc4	add		\ sc4 = after never1
   never if					\ never1 (LANDING PAD)
      sc4	%g0	sc2	nput		\ (delay) store guarded pc
      up	sc1	sc2	get-cpu-struct	\ This code path is only taken
      0	>guarded-ip	sc1	set		\ on a retry from simple-handl
      sc2	sc1	sc2	add		\ 
      %g0	sc2	sc1	nget		\ sc1 = "guarded-ip"

      %g0	sc1	ip	add		\ restore the previously
      #sync			membar		\ stored ip so the code
      scr	sc1		clear-afsr	\ continues from landing-pad
      #sync			membar		\ rather than where the trap
      tos	sp		push		\ was encountered.
      %g0	h# bed	tos	add		\ mark error (this will then 
   else						\ be "thrown" back to 
				nop		\ guarded-execute
      tos	sp		push
      %g0	0	tos	add		\ first time through mark as 0
   then						\ so it won't be thrown
c;

: safe-guard  ( acf -- ?? )
    landing-pad throw execute
;

: newguarded-execute  ( ?? acf -- succeeded?-flag )
   trap30  vector@ >r		   ( acf )	( R: t30 )	
   trap1f  vector@ >r		   ( acf )	( R: t30 t1f )
   trap32  vector@ >r		   ( acf )	( R: t30 t1f t32 )
   trap34  vector@ >r		   ( acf )	( R: t30 t1f t32 )

				   \ replace with "safe" trap handler

   simple-handler trap30  vector!  ( acf )	( R: t30 t1f t32 t34 )
   simple-handler trap1f  vector!  ( acf )	( R: t30 t1f t32 t34 )
   simple-handler trap32  vector!  ( acf )	( R: t30 t1f t32 t34 )
   simple-handler trap34  vector!  ( acf )	( R: t30 t1f t32 t34 )

				   \ if %lsucr is changed upon fielding one of 
				   \ these traps flush the caches and restore 
				   \ the lsucr

   cpu-error-enable@ >r
   berr-on
   lsucr@ >r			   ( acf )	  ( R: t30 t1f t32 t34 lsucr )
   ['] safe-guard catch dup if	   ( 0 | acf -1 ) ( R: t30 t1f t32 t34 lsucr )
      nip			   ( -1 )	  ( R: t30 t1f t32 t34 lsucr )
   then 0=			   ( flag )	  ( R: t30 t1f t32 t34 lsucr )
   r> dup lsucr@ <> if		   ( flag lsucr ) ( R: t30 t1f t32 t34 )
      cache-off clear-cache lsucr! ( flag )	  ( R: t30 t1f t32 t34 )
   else				   ( flag lsucr ) ( R: t30 t1f t32 t34 )
      drop			   ( flag )	  ( R: t30 t1f t32 t34 )
   then
   r> cpu-error-enable!		   \ restore the original trap handlers

   r> trap34  vector!		   ( flag )	  ( R: t30 t1f t32 )
   r> trap32  vector!		   ( flag )	  ( R: t30 t1f )
   r> trap1f  vector!		   ( flag )	  ( R: t30 )
   r> trap30  vector!		   ( flag )	  ( R: )
;


 ' newguarded-execute is guarded-execute

headers
overload: scan-subtree ( dev-addr,len action-acf -- )
   ['] scan-subtree guarded-execute drop
;
Commit	Line	Data
920dae64 AT	1	\ ========== Copyright Header Begin ==========================================
	2	\
	3	\ Hypervisor Software File: fieldberr.fth
	4	\
	5	\ Copyright (c) 2006 Sun Microsystems, Inc. All Rights Reserved.
	6	\
	7	\ - Do no alter or remove copyright notices
	8	\
	9	\ - Redistribution and use of this software in source and binary forms, with
	10	\ or without modification, are permitted provided that the following
	11	\ conditions are met:
	12	\
	13	\ - Redistribution of source code must retain the above copyright notice,
	14	\ this list of conditions and the following disclaimer.
	15	\
	16	\ - Redistribution in binary form must reproduce the above copyright notice,
	17	\ this list of conditions and the following disclaimer in the
	18	\ documentation and/or other materials provided with the distribution.
	19	\
	20	\ Neither the name of Sun Microsystems, Inc. or the names of contributors
	21	\ may be used to endorse or promote products derived from this software
	22	\ without specific prior written permission.
	23	\
	24	\ This software is provided "AS IS," without a warranty of any kind.
	25	\ ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES,
	26	\ INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A
	27	\ PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE HEREBY EXCLUDED. SUN
	28	\ MICROSYSTEMS, INC. ("SUN") AND ITS LICENSORS SHALL NOT BE LIABLE FOR
	29	\ ANY DAMAGES SUFFERED BY LICENSEE AS A RESULT OF USING, MODIFYING OR
	30	\ DISTRIBUTING THIS SOFTWARE OR ITS DERIVATIVES. IN NO EVENT WILL SUN
	31	\ OR ITS LICENSORS BE LIABLE FOR ANY LOST REVENUE, PROFIT OR DATA, OR
	32	\ FOR DIRECT, INDIRECT, SPECIAL, CONSEQUENTIAL, INCIDENTAL OR PUNITIVE
	33	\ DAMAGES, HOWEVER CAUSED AND REGARDLESS OF THE THEORY OF LIABILITY,
	34	\ ARISING OUT OF THE USE OF OR INABILITY TO USE THIS SOFTWARE, EVEN IF
	35	\ SUN HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
	36	\
	37	\ You acknowledge that this software is not designed, licensed or
	38	\ intended for use in the design, construction, operation or maintenance of
	39	\ any nuclear facility.
	40	\
	41	\ ========== Copyright Header End ============================================
	42	id: @(#)fieldberr.fth 1.14 03/08/20
	43	purpose:
	44	copyright: Copyright 1999-2003 Sun Microsystems, Inc. All Rights Reserved
	45	copyright: Use is subject to license terms.
	46
	47	\ This code is actually two pieces, the guarded execute landing pad is one of
	48	\ them, the os/stand/probe.fth is the other. probe.fth puts sync membars around
	49	\ the load and store operators to ensure that the error happens exactly where
	50	\ we expect it.
	51	\
	52	\ This means it is possible to break the guarded-execute protection by simply
	53	\
	54	\ ['] x! guarded-execute
	55	\
	56	\ However there is little we can do about that. Instead do not re-invent
	57	\ the wheel - use the peek and poke routines which will do the correct thing
	58	\ and will not sacrifice performance.
	59	\
	60	\ Landing-pad can be considered the FORTH equivalent of setjmp/longjmp.
	61	\
	62	\ The first time that landing-pad executes is does the setjmp and returns 0,
	63	\ code that takes an exception will restart at landing pad with a non-zero
	64	\ value on the stack (longjmp) and this time the throw will prevent the acf
65	\ from being re-executed.
66	\
67
68	headerless
69
70	h# 30 constant trap30 \ Data Access Exception
71	h# 1f constant trap1f \ Level 15 interrupt
72	h# 32 constant trap32 \ Data Access Error
73	h# 34 constant trap34 \ Memory Address not Aligned
74
75	label simple-handler
76
77	prom-main-task %g4 up setx \ Set User Area Pointer
78	base rdpc \ this is a trap so we're
79	here 4 - origin - %g4 set \ using alternate globals
80	base %g4 base sub
81
82	%g6 rdpstate \ save the tstate & pstate
83	%g7 rdtstate \ then set trap-level to 0
84	%g0 0 wrtl \ so that we can field an mmu
85	\ miss on the cpu-struct
86	up %g4 %g5 get-cpu-struct
87	0 >guarded-pc %g4 set \ retrieve the "landing-pad" pc
88	%g5 %g4 %g5 add \ value previously stored
89	%g0 %g5 %g4 nget \ in the >guarded-pc member
90
91	%g0 %g4 %g0 subcc \ is the guarded-pc nonzero?
92	0<> if
93	nop \ delay
94	%g0 1 wrtl \ set trap-level = 1
95	%g6 0 wrpstate \ restore pstate
96	#sync membar
97	%g7 0 wrtstate \ restore tstate
98	#sync membar
99	%g0 %g4 wrtpc
100	%g0 %g4 wrtnpc \ set trap pcs to "landing pad"
101	%g0 %g0 %g5 nput \ clear saved pc
102	retry \ retry (to landing pad) will
103	else \ set trap level to 0
104	nop
105	%g0 h# 16 wrpstate \ another (unrecoverable) trap
106	save-state always brif \ set pstate to known state
107	nop \ and jump into save-state
108	then
109	end-code
110
111	code landing-pad ( -- executed? )
112	h# 20 .align
113	up sc2 sc1 get-cpu-struct \ sc1 = cpu-struct adr
114	0 >guarded-pc sc2 set \ "landing-pad" pc container
115	0 >guarded-ip sc3 set \ "landing-pad" ip container
116	sc1 sc2 sc2 add \ sc2 = guarded-pc adr
117	sc1 sc3 sc3 add \ sc3 = guarded-ip adr
118	%g0 sc2 sc1 nget \ sc1 = guarded-pc value
119	ip %g0 sc3 nput \ store current ip
120	sc4 rdpc
121	sc4 h# 10 sc4 add \ sc4 = after never1
122	never if \ never1 (LANDING PAD)
123	sc4 %g0 sc2 nput \ (delay) store guarded pc
124	up sc1 sc2 get-cpu-struct \ This code path is only taken
125	0 >guarded-ip sc1 set \ on a retry from simple-handl
126	sc2 sc1 sc2 add \
127	%g0 sc2 sc1 nget \ sc1 = "guarded-ip"
128
129	%g0 sc1 ip add \ restore the previously
130	#sync membar \ stored ip so the code
131	scr sc1 clear-afsr \ continues from landing-pad
132	#sync membar \ rather than where the trap
133	tos sp push \ was encountered.
134	%g0 h# bed tos add \ mark error (this will then
135	else \ be "thrown" back to
136	nop \ guarded-execute
137	tos sp push
138	%g0 0 tos add \ first time through mark as 0
139	then \ so it won't be thrown
140	c;
141
142	: safe-guard ( acf -- ?? )
143	landing-pad throw execute
144	;
145
146	: newguarded-execute ( ?? acf -- succeeded?-flag )
147	trap30 vector@ >r ( acf ) ( R: t30 )
148	trap1f vector@ >r ( acf ) ( R: t30 t1f )
149	trap32 vector@ >r ( acf ) ( R: t30 t1f t32 )
150	trap34 vector@ >r ( acf ) ( R: t30 t1f t32 )
151
152	\ replace with "safe" trap handler
153
154	simple-handler trap30 vector! ( acf ) ( R: t30 t1f t32 t34 )
155	simple-handler trap1f vector! ( acf ) ( R: t30 t1f t32 t34 )
156	simple-handler trap32 vector! ( acf ) ( R: t30 t1f t32 t34 )
157	simple-handler trap34 vector! ( acf ) ( R: t30 t1f t32 t34 )
158
159	\ if %lsucr is changed upon fielding one of
160	\ these traps flush the caches and restore
161	\ the lsucr
162
163	cpu-error-enable@ >r
164	berr-on
165	lsucr@ >r ( acf ) ( R: t30 t1f t32 t34 lsucr )
166	['] safe-guard catch dup if ( 0 \| acf -1 ) ( R: t30 t1f t32 t34 lsucr )
167	nip ( -1 ) ( R: t30 t1f t32 t34 lsucr )
168	then 0= ( flag ) ( R: t30 t1f t32 t34 lsucr )
169	r> dup lsucr@ <> if ( flag lsucr ) ( R: t30 t1f t32 t34 )
170	cache-off clear-cache lsucr! ( flag ) ( R: t30 t1f t32 t34 )
171	else ( flag lsucr ) ( R: t30 t1f t32 t34 )
172	drop ( flag ) ( R: t30 t1f t32 t34 )
173	then
174	r> cpu-error-enable! \ restore the original trap handlers
175
176	r> trap34 vector! ( flag ) ( R: t30 t1f t32 )
177	r> trap32 vector! ( flag ) ( R: t30 t1f )
178	r> trap1f vector! ( flag ) ( R: t30 )
179	r> trap30 vector! ( flag ) ( R: )
180	;
181
182
183	' newguarded-execute is guarded-execute
184
185	headers
186	overload: scan-subtree ( dev-addr,len action-acf -- )
187	['] scan-subtree guarded-execute drop
188	;