Unknown why this works, but if we return EXCP_ITLB_MISS we
will triple-fault the first userland instruction fetch.
Is it something to do with having a combined I/DTLB?
Signed-off-by: NRichard Henderson <richard.henderson@linaro.org>

Signed-off-by: NRichard Henderson <richard.henderson@linaro.org>

Signed-off-by: NRichard Henderson <richard.henderson@linaro.org>

Signed-off-by: NRichard Henderson <richard.henderson@linaro.org>

Linux sets sr4-sr7 all to the same value, which means that we
need not do any runtime computation to find out what space to
use in forming the GVA.
Signed-off-by: NRichard Henderson <richard.henderson@linaro.org>

Real hardware would use an external device to control the power.
But for the moment let's invent instructions in reserved space,
to be used by our custom firmware.
Signed-off-by: NHelge Deller <deller@gmx.de>
Signed-off-by: NRichard Henderson <richard.henderson@linaro.org>

Signed-off-by: NRichard Henderson <richard.henderson@linaro.org>

Signed-off-by: NRichard Henderson <richard.henderson@linaro.org>

Signed-off-by: NRichard Henderson <richard.henderson@linaro.org>

Signed-off-by: NRichard Henderson <richard.henderson@linaro.org>

We now have all of the TLB manipulation instructions.
Signed-off-by: NRichard Henderson <richard.henderson@linaro.org>

The TLB can now be populated, but it cannot yet be cleared.
Signed-off-by: NRichard Henderson <richard.henderson@linaro.org>

Signed-off-by: NRichard Henderson <richard.henderson@linaro.org>

Signed-off-by: NRichard Henderson <richard.henderson@linaro.org>

Signed-off-by: NRichard Henderson <richard.henderson@linaro.org>

However since HPPA has a software-managed TLB, and the relevant
TLB manipulation instructions are not implemented, this does not
actually do anything.
Signed-off-by: NRichard Henderson <richard.henderson@linaro.org>

Any one TB will have only one space value.  If we change spaces,
we change TBs.  Thus BE and BEV must exit the TB immediately.
Signed-off-by: NRichard Henderson <richard.henderson@linaro.org>

These instructions force the destination privilege level
of the branch destination to be no higher than current.
Signed-off-by: NRichard Henderson <richard.henderson@linaro.org>

This changes the system virtual address width to 64-bit and
incorporates the space registers into load/store operations.
Signed-off-by: NRichard Henderson <richard.henderson@linaro.org>

Signed-off-by: NRichard Henderson <richard.henderson@linaro.org>

Signed-off-by: NRichard Henderson <richard.henderson@linaro.org>

Signed-off-by: NRichard Henderson <richard.henderson@linaro.org>

While the E bit is only used for pa2.0 mfctl,w from sar,
the otherwise reserved bit does not appear to be decoded.
Signed-off-by: NRichard Henderson <richard.henderson@linaro.org>

Signed-off-by: NRichard Henderson <richard.henderson@linaro.org>

Not used where they should be yet, but we can copy them.
Signed-off-by: NRichard Henderson <richard.henderson@linaro.org>

Signed-off-by: NRichard Henderson <richard.henderson@linaro.org>

Most aspects of privilege are not yet handled.  But this
gives us the start from which to begin checking.
Signed-off-by: NRichard Henderson <richard.henderson@linaro.org>

For system mode, we will need 64-bit virtual addresses even when
we have 32-bit register sizes.  Since the rest of QEMU equates
TARGET_LONG_BITS with the address size, redefine everything
related to register size in terms of a new TARGET_REGISTER_BITS.
Signed-off-by: NRichard Henderson <richard.henderson@linaro.org>

Signed-off-by: NRichard Henderson <richard.henderson@linaro.org>

Signed-off-by: NRichard Henderson <richard.henderson@linaro.org>

We don't actually do anything with most of the bits yet,
but at least they have names and we have somewhere to
store them.
Signed-off-by: NRichard Henderson <richard.henderson@linaro.org>

With the addition of default-configs/hppa-softmmu.mak, this
will compile.  It is not enabled with this patch, however.
Signed-off-by: NHelge Deller <deller@gmx.de>
Signed-off-by: NRichard Henderson <richard.henderson@linaro.org>

Merge tpm 2018/01/26 v2

# gpg: Signature made Mon 29 Jan 2018 22:20:05 GMT
# gpg:                using RSA key 0x75AD65802A0B4211
# gpg: Good signature from "Stefan Berger <stefanb@linux.vnet.ibm.com>"
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: B818 B9CA DF90 89C2 D5CE  C66B 75AD 6580 2A0B 4211

* remotes/stefanberger/tags/pull-tpm-2018-01-26-2:
  tpm: add CRB device
  tpm: report backend request error
  tpm: replace GThreadPool with AIO threadpool
  tpm: lookup cancel path under tpm device class
  tpm: fix alignment issues
  tpm: Set the flags of the CMD_INIT command to 0
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

The SPARC code in linux-user/signal.c defines a set of
MC_* constants. On some SPARC hosts these are also defined
by sys/ucontext.h, resulting in build failures:

linux-user/signal.c:2786:0: error: "MC_NGREG" redefined [-Werror]
 #define MC_NGREG 19

In file included from /usr/include/signal.h:302:0,
                 from include/qemu/osdep.h:86,
                 from linux-user/signal.c:19:
/usr/include/sparc64-linux-gnu/sys/ucontext.h:59:0: note: this is the location of the previous definition
 # define MC_NGREG __MC_NGREG

Rename all these constants to SPARC_MC_* to avoid the clash.

Cc: qemu-stable@nongnu.org
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1517318239-15764-1-git-send-email-peter.maydell@linaro.org

# gpg: Signature made Mon 29 Jan 2018 15:49:05 GMT
# gpg:                using RSA key 0x9CA4ABB381AB73C8
# gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
# gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"
# Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35  775A 9CA4 ABB3 81AB 73C8

* remotes/stefanha/tags/tracing-pull-request:
  tracetool: report error on foo() instead of foo(void)
  tracetool: clarify that "formats" means "format strings"
  tracetool: prefix parse errors with line numbers
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

tpm_crb is a device for TPM 2.0 Command Response Buffer (CRB)
Interface as defined in TCG PC Client Platform TPM Profile (PTP)
Specification Family “2.0” Level 00 Revision 01.03 v22.

The PTP allows device implementation to switch between TIS and CRB
model at run time, but given that CRB is a simpler device to
implement, I chose to implement it as a different device.

The device doesn't implement other locality than 0 for now (my laptop
TPM doesn't either, so I assume this isn't so bad)

Tested with some success with Linux upstream and Windows 10, seabios &
modified ovmf. The device is recognized and correctly transmit
command/response with passthrough & emu. However, we are missing PPI
ACPI part atm.
Signed-off-by: NMarc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: NStefan Berger <stefanb@linux.vnet.ibm.com>
Signed-off-by: NStefan Berger <stefanb@linux.vnet.ibm.com>

Use an Error** for request to let the caller handle error reporting.

This will also allow to inform the frontend of a backend error.
Signed-off-by: NMarc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: NStefan Berger <stefanb@linux.vnet.ibm.com>
Signed-off-by: NStefan Berger <stefanb@linux.vnet.ibm.com>

The TPM backend uses a GThreadPool to handle IO in a seperate
thread. However, GThreadPool isn't integrated with Qemu main loops,
making it unnecessarily complicated to deal with.

Qemu has a AIO threadpool, that is better integrated with loops and
various IO functions, provides completion BH by default etc.

Remove the only user of GThreadPool from qemu, use AIO threadpool.

Note that the backend:
- no longer accepts queing multiple requests (unneeded so far)
- increase ref to itself when handling a command, for extra safety
- tpm_backend_thread_end() is renamed tpm_backend_finish_sync() and
will wait for completion of BH (request_completed), which will help
migration handling.
Signed-off-by: NMarc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: NStefan Berger <stefanb@linux.vnet.ibm.com>
Signed-off-by: NStefan Berger <stefanb@linux.vnet.ibm.com>

Since Linux commit 313d21eeab9282e, tpm devices have their own device
class "tpm" and the cancel path must be looked up under
/sys/class/tpm/ instead of /sys/class/misc/.
Signed-off-by: NMarc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: NStefan Berger <stefanb@linux.vnet.ibm.com>
Signed-off-by: NStefan Berger <stefanb@linux.vnet.ibm.com>

The new tpm-crb-test fails on sparc host:

TEST: tests/tpm-crb-test... (pid=230409)
  /i386/tpm-crb/test:
Broken pipe
FAIL
GTester: last random seed: R02S29cea50247fe1efa59ee885a26d51a85
(pid=230423)
FAIL: tests/tpm-crb-test

and generates a new clang sanitizer runtime warning:

/home/petmay01/linaro/qemu-for-merges/hw/tpm/tpm_util.h:36:24: runtime
error: load of misaligned address 0x7fdc24c00002 for type 'const
uint32_t' (aka 'const unsigned int'), which requires 4 byte alignment
0x7fdc24c00002: note: pointer points here
<memory cannot be printed>

The sparc architecture does not allow misaligned loads and will
segfault if you try them.  For example, this function:

static inline uint32_t tpm_cmd_get_size(const void *b)
{
    return be32_to_cpu(*(const uint32_t *)(b + 2));
}

Should read,
    return ldl_be_p(b + 2);

As a general rule you can't take an arbitrary pointer into a byte
buffer and try to interpret it as a structure or a pointer to a
larger-than-bytesize-data simply by casting the pointer.

Use this clean up as an opportunity to remove unnecessary temporary
buffers and casts.
Reported-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NMarc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: NStefan Berger <stefanb@linux.vnet.ibm.com>
Signed-off-by: NStefan Berger <stefanb@linux.vnet.ibm.com>